24 lines
550 B
YAML
24 lines
550 B
YAML
# Allow the vault deployer to manage the gpg mount's OpenPGP keys via the
|
|
# gpgvaultsecret provider. Registering the plugin itself is a sys/plugins/catalog
|
|
# grant, carried by policies/sys/plugins/catalog/admin.yaml.
|
|
---
|
|
rules:
|
|
# Manage keys (create/rotate/config/delete) in the gpg mount.
|
|
- path: "gpg/keys/*"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
- list
|
|
- path: "gpg/keys"
|
|
capabilities:
|
|
- read
|
|
- list
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|