# Allow the vault deployer to manage the rancher secrets engine: its connection
# config, seeded (auto-rotated) service-account tokens, and token-minting roles.
#
# Scoped to rancher/* only. The plugin-catalog grant needed to import the plugin
# lives under policies/sys/plugins/catalog/ so a code owner of this policy path
# cannot grant themselves access outside the rancher mount.
---
rules:
  # Engine connection config.
  - path: "rancher/config"
    capabilities:
      - create
      - read
      - update
      - delete
  # Seeded, auto-rotated service-account tokens (+ manual rotate).
  - path: "rancher/service-accounts/*"
    capabilities:
      - create
      - read
      - update
      - delete
      - list
  - path: "rancher/service-accounts"
    capabilities:
      - read
      - list
  # Token-minting roles.
  - path: "rancher/roles/*"
    capabilities:
      - create
      - read
      - update
      - delete
      - list
  - path: "rancher/roles"
    capabilities:
      - read
      - list

auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault