repospawner needs to create and seed Gitea repositories without a static
token. Add the gitea engine role, a Kubernetes auth role for its in-cluster
service account, and the policy binding the two.
- Add gitea_secret_backend_role repospawner (write:repository, write:issue,
read:user; 1h ttl / 4h max)
- Add auth_kubernetes_role k8s/au/syd1/repospawner bound to
repospawner/repospawner with the vault audience
- Add policies/gitea/creds/repospawner granting read on
gitea/creds/repospawner to that Kubernetes role only
unkin-agent