# Allow the Terraform Rancher runner to read:
#  - its own Rancher admin API token (rancher2 provider auth), and
#  - the OAuth2/OIDC client secret backing the Rancher keycloakoidc AuthConfig
#    (same secret Authentik sets on the provider).
---
rules:
  - path: "kv/data/service/terraform/rancher"
    capabilities:
      - read
  - path: "kv/data/kubernetes/namespace/cattle-system/default/oauth-credentials"
    capabilities:
      - read

auth:
  approle:
    - terraform_rancher
  k8s/au/syd1:
    - woodpecker_terraform_rancher