unkinben
d289775e38
ci/woodpecker/push/apply Pipeline was successful
## Why The forthcoming `gitea_secret_backend` + role configuration (separate PR, `benvin/gitea-secret-engine`) is applied by terraform-vault under the deployment identity (`tf_vault` approle / `woodpecker_terraform_vault` k8s role). That identity has no access to the `gitea/` mount yet, so writing the engine's config and roles would 403. This mirrors `policies/rancher/admin.yaml`. ## Change - Add `policies/gitea/admin.yaml` granting the deployer: - create/read/update/delete on `gitea/config` - create/update on `gitea/config/rotate-root` (write-only rotation trigger) - full manage + list on `gitea/roles/*` (and list on `gitea/roles`) - Deliberately excludes `gitea/creds/*` — minting tokens is for consumers, not the deployer. - No new catalog or mount grant: plugin registration is already covered by the shared, sudo-protected wildcard in `policies/sys/plugins/catalog/admin.yaml`, and mounting uses the deployer's existing `sys/mounts/*` access — same as the rancher engine. ## Order Merge and apply this **before** the `benvin/gitea-secret-engine` PR, so the deployer can write the engine config/roles on that apply. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv Reviewed-on: #100 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>