# Allow the vault deployer to manage the netbox token secrets engine: its
# connection config (seeded admin token), in-place token rotation, and
# token-minting roles.
#
# Scoped to netbox/* only, and deliberately excludes netbox/creds/* - minting
# tokens is for consumers, not the deployer. The plugin-catalog grant needed to
# import the plugin is the shared, sudo-protected wildcard in
# policies/sys/plugins/catalog/admin.yaml (already covers this plugin), and
# mounting the engine uses the deployer's existing sys/mounts/* access, so no
# new catalog/mount grant is added here (mirrors the gitea/rancher engines).
---
rules:
  # Engine connection config (NetBox URL, TLS, token_version, seeded admin token).
  - path: "netbox/config"
    capabilities:
      - create
      - read
      - update
      - delete
  # In-place rotation of the seeded admin token (write-only trigger).
  - path: "netbox/config/rotate"
    capabilities:
      - create
      - update
  # Token-minting roles.
  - path: "netbox/roles/*"
    capabilities:
      - create
      - read
      - update
      - delete
      - list
  - path: "netbox/roles"
    capabilities:
      - read
      - list

auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault