ghp (a GitHub proxy) reads its GitHub App credentials and encryption key from kv/kubernetes/ghp/*; it uses the postgres storage backend so it only needs read access to those kv secrets.
- add k8s/au/syd1 auth role ghp bound to ServiceAccount ghp in namespace ghp (ttl 600s, audience vault)
- add read-only kv policy granting read on kv/data/kubernetes/ghp/* and read+list on kv/metadata/kubernetes/ghp/*
- mirrors the artifactapi / logging_logarchiver per-app pattern (app-SA-bound k8s role + single kv read policy consumed by VSO)
unkin-agent
1dace21b37