From c1f3d28c93eddd439bf5870d56ab2b7834aae7ad Mon Sep 17 00:00:00 2001
From: Ian Fijolek <ian@iamthefij.com>
Date: Wed, 27 Sep 2023 21:35:55 -0700
Subject: [PATCH] Give Diun task socket access to read jobs

---
 services/diun.tf | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/services/diun.tf b/services/diun.tf
index 250c509..ca7433b 100644
--- a/services/diun.tf
+++ b/services/diun.tf
@@ -35,4 +35,18 @@ module "diun" {
       mount       = false
     },
   ]
+
+  workload_acl_policy = {
+    name        = "diun-read"
+    description = "Give the diun task read access to jobs"
+
+    rules_hcl = <<EOH
+namespace "default" {
+  capabilities = [
+    "list-jobs",
+    "read-job",
+  ]
+}
+EOH
+  }
 }