From 739de129e18baa9fac27ce02c704ca8f86971a5f Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Fri, 24 Jul 2026 23:18:11 +1000 Subject: [PATCH] Add terraform-enc woodpecker ServiceAccount (#274) The new **terragrunt-enc** repo (single source of truth for encapi ENC data) runs its Terraform apply/plan in Woodpecker and authenticates to Vault via kubernetes auth. The Vault k8s role `woodpecker_terraform_enc` (terraform-vault PR #98) binds to a ServiceAccount named `terraform-enc` in the `woodpecker` namespace, which must exist for that auth to work. Changes: - Add `apps/base/woodpecker/serviceaccount_terraform_enc.yaml` (SA `terraform-enc` in namespace `woodpecker`). - Register it in the woodpecker kustomization. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/274 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/woodpecker/kustomization.yaml | 1 + apps/base/woodpecker/serviceaccount_terraform_enc.yaml | 6 ++++++ 2 files changed, 7 insertions(+) create mode 100644 apps/base/woodpecker/serviceaccount_terraform_enc.yaml diff --git a/apps/base/woodpecker/kustomization.yaml b/apps/base/woodpecker/kustomization.yaml index cbc24eb..0289803 100644 --- a/apps/base/woodpecker/kustomization.yaml +++ b/apps/base/woodpecker/kustomization.yaml @@ -8,6 +8,7 @@ resources: - cnpg_pooler.yaml - serviceaccount_terraform_artifactapi.yaml - serviceaccount_terraform_authentik.yaml + - serviceaccount_terraform_enc.yaml - serviceaccount_terraform_git.yaml - serviceaccount_terraform_prowlarr.yaml - serviceaccount_terraform_rancher.yaml diff --git a/apps/base/woodpecker/serviceaccount_terraform_enc.yaml b/apps/base/woodpecker/serviceaccount_terraform_enc.yaml new file mode 100644 index 0000000..364c649 --- /dev/null +++ b/apps/base/woodpecker/serviceaccount_terraform_enc.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: terraform-enc + namespace: woodpecker