2026-10-17 12:46:37 +11:00
1 changed files with 15 additions and 0 deletions
@@ -0,0 +1,15 @@
+# Lets the agents AppRole read the BinaryLane gateway WireGuard keypairs so they
+# can be eyaml-encrypted into puppet hiera. Read-only; terraform-binarylane owns writes.
+---
+rules:
+  - path: "kv/data/service/wireguard/binarylane/*"
+    capabilities:
+      - read
+  - path: "kv/metadata/service/wireguard/binarylane/*"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - agents