# Allow the vault deployer to import (register/deregister) the rancher secrets
# plugin in the catalog. sys/plugins/catalog is sudo-protected, so this lives
# under policies/sys/ where only a sys code owner can grant it — keeping the
# rancher engine policy (policies/rancher/) scoped to rancher/* paths.
---
rules:
  - path: "sys/plugins/catalog/secret/vault-plugin-secrets-rancher"
    capabilities:
      - create
      - read
      - update
      - delete
      - sudo

auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault