infra/tf/bao-policies/k8s-default-sa.hcl

path "test-kv/data/{{identity.entity.aliases.auth_kubernetes_6872b6a9.metadata.service_account_namespace}}/*" {
    capabilities = ["read"]
}