From 4453e9ab47ec98ab46073ec2082147a561128bd1 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 17 Oct 2026 12:36:02 +1100
Subject: [PATCH] Grant agents approle read on binarylane wireguard keys

---
 .../kv/service/wireguard/binarylane/agents.yaml   | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 policies/kv/service/wireguard/binarylane/agents.yaml

diff --git a/policies/kv/service/wireguard/binarylane/agents.yaml b/policies/kv/service/wireguard/binarylane/agents.yaml
new file mode 100644
index 0000000..b2b49e9
--- /dev/null
+++ b/policies/kv/service/wireguard/binarylane/agents.yaml
@@ -0,0 +1,15 @@
+# Lets the agents AppRole read the BinaryLane gateway WireGuard keypairs so they
+# can be eyaml-encrypted into puppet hiera. Read-only; terraform-binarylane owns writes.
+---
+rules:
+  - path: "kv/data/service/wireguard/binarylane/*"
+    capabilities:
+      - read
+  - path: "kv/metadata/service/wireguard/binarylane/*"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - agents
-- 
2.47.3