# A seeded, auto-rotated Rancher service-account token on the "rancher" engine.
# The seed token itself is sensitive and read from KV (not stored here):
#   kv/service/vault/au/syd1/secret_backend/rancher/service_account/admin
#   -> keys: token (required), token_name (optional)
# Populate that KV path with a live Rancher admin token BEFORE applying; the
# engine then rotates it (mints a fresh 90d token every 45d) so it never lapses.
token_ttl: 7776000       # 90d in seconds
rotation_period: 3888000 # 45d in seconds