# Allow the deployer to manage external identity groups and their aliases, which
# is how OIDC group membership (the ak_groups claim) maps onto Vault policies.
# Both the collection endpoints and the per-id endpoints are needed: create posts
# to identity/group, subsequent reads and updates address identity/group/id/<id>.
---
rules:
  - path: "identity/group"
    capabilities:
      - create
      - update
  - path: "identity/group/*"
    capabilities:
      - create
      - update
      - read
      - delete
      - list
  - path: "identity/group-alias"
    capabilities:
      - create
      - update
  - path: "identity/group-alias/*"
    capabilities:
      - create
      - update
      - read
      - delete
      - list
  - path: "identity/lookup/group"
    capabilities:
      - create
      - update

auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault