3 Commits

Author	SHA1	Message	Date
unkinben	65f844cbe1	Fix: add policy binding for forgebot K8s auth role ... Every K8s auth role needs at least one entry in the policy_auth_map. Add a policy granting the forgebot role read access to the namespace- scoped KV path, which the operator SA needs when authenticating with the forgebot role instead of the default role.	2026-06-08 23:00:35 +10:00
unkinben	f5803605d6	Simplify: use default templated policy for forgebot KV access ... The default K8s auth policy already provides namespace-scoped access to kv/data/kubernetes/namespace/{namespace}/{sa}/* via identity templating. Forgebot secrets should be stored at kv/kubernetes/namespace/forgebot/default/* instead of kv/service/forgebot/*, eliminating the need for 5 individual policies. The forgebot K8s auth role is kept for the forgebot-operator SA.	2026-06-08 22:54:58 +10:00
unkinben	2c4d0d7f64	Add Vault access for forgebot service ... K8s auth role binding for forgebot namespace (default + forgebot-operator service accounts) and KV read policies for environment config, LiteLLM API key, Gitea token, PostgreSQL credentials, and webhook secret.	2026-06-08 22:53:25 +10:00