coulomb/railiance-platform
Archived
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Close delegated prod applier pilot

Browse Source
This commit is contained in:
Bernd Worsch
2026-07-01 23:34:13 +02:00
parent 2db4d1afe1
commit 38936d8fd6
5 changed files with 79 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
openbao/policies/credential-change-nonprod-applier.hcl
View File

@@ -15,8 +15,9 @@ path "sys/policies/acl/credential-broker-*-issuer" {
capabilities = ["create", "update", "read"]
}
# OIDC roles for caller-scoped workload KV lanes.
path "auth/netkingdom/role/*-workload-kv-read" {
# OIDC roles for caller-scoped workload KV lanes. The local applier
# dry-run constrains role names and bound claims per CCR.
path "auth/netkingdom/role/*" {
capabilities = ["create", "update", "read"]
}

5
openbao/policies/credential-change-prod-applier.hcl
View File

@@ -15,8 +15,9 @@ path "sys/policies/acl/credential-broker-*-issuer" {
capabilities = ["create", "update", "read"]
}
# OIDC roles for caller-scoped workload KV lanes.
path "auth/netkingdom/role/*-workload-kv-read" {
# OIDC roles for caller-scoped workload KV lanes. The local applier
# dry-run constrains role names and bound claims per CCR.
path "auth/netkingdom/role/*" {
capabilities = ["create", "update", "read"]
}