# Allow the Terraform Authentik runner to read OAuth2/OIDC client secrets that
# back authentik providers. Secrets live under each target service's kv
# namespace path (kv/kubernetes/namespace/<ns>/default/oauth-credentials) and
# are read by the module's data.vault_kv_secret_v2 lookups.
---
rules:
  - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials"
    capabilities:
      - read

auth:
  approle:
    - terraform_authentik
  k8s/au/syd1:
    - woodpecker_terraform_authentik