2026-09-27 16:37:25 +00:00
1 changed files with 21 additions and 0 deletions
@@ -0,0 +1,21 @@
+# OpenBao policy: secret-exists-check
+#
+# Lets the Paperclip agents Argus and Atlas check whether a secret exists in the
+# `homelab` KV v2 mount (paths, versions, timestamps) without reading any value.
+# Metadata only: no access to homelab/data/*, no writes.
+#
+# Identity: userpass user `agent-secret-check`. Its password is a Paperclip
+# agent secret bound to Argus and Atlas.
+#
+# NOT applied by Flux. Apply ONCE with an admin token:
+#
+#   bao policy write secret-exists-check kubernetes/infrastructure/openbao/policies/secret-exists-check.hcl
+#   bao write auth/userpass/users/agent-secret-check \
+#     password=<generated> token_policies=secret-exists-check \
+#     token_ttl=1h token_max_ttl=4h
+#
+# Check: `bao kv metadata get homelab/<path>` succeeds, `bao kv get homelab/<path>` is denied.
+
+path "homelab/metadata/*" {
+  capabilities = ["read", "list"]
+}