# Allow the terraform-infra runner to read the NetBox + KeaAPI tokens
# (netbox_token / kea_token fields) used by the netbox and kea providers.
---
rules:
  - path: "kv/data/service/terraform/infra"
    capabilities:
      - read
  # vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
  # metadata path on every plan/apply; a 403 here fails the plan.
  - path: "kv/metadata/service/terraform/infra"
    capabilities:
      - read

auth:
  approle:
    - terraform_infra
  k8s/au/syd1:
    - woodpecker_terraform_infra