25 lines
619 B
YAML
25 lines
619 B
YAML
# Allow the deployer to manage the identity group aliases that map external OIDC
|
|
# group membership (the ak_groups claim) onto the Vault groups managed under
|
|
# policies/identity/group/. Both endpoints are needed: create posts to
|
|
# identity/group-alias, subsequent reads and updates address
|
|
# identity/group-alias/id/<id>.
|
|
---
|
|
rules:
|
|
- path: "identity/group-alias"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- path: "identity/group-alias/*"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- read
|
|
- delete
|
|
- list
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|