# Allow the Terraform Authentik runner to read:
#  - its own Authentik API token (provider auth), and
#  - OAuth2/OIDC client secrets that back authentik providers (per target
#    service's kv namespace path, via the module's data.vault_kv_secret_v2).
---
rules:
  - path: "kv/data/service/terraform/authentik"
    capabilities:
      - read
  - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials"
    capabilities:
      - read

auth:
  approle:
    - terraform_authentik
  k8s/au/syd1:
    - woodpecker_terraform_authentik