From b1b2112c667f1c694152d95bc76e4806a06db99d Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 16 Jul 2026 22:22:13 +1000 Subject: [PATCH] Add terraform-rancher woodpecker ServiceAccount (#257) ## Why The new terraform-rancher CI pipeline runs as a pod in the woodpecker namespace; its ServiceAccount token is what Vault binds to the `woodpecker_terraform_rancher` k8s auth role (see terraform-vault#86) for rancher2 provider auth + Consul state. ## Change - Add `ServiceAccount/terraform-rancher` (woodpecker ns) and wire it into the woodpecker kustomization, mirroring the other terraform-* runner SAs. ## Validation `kustomize build apps/base/woodpecker` renders it; pre-commit clean. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/257 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/woodpecker/kustomization.yaml | 1 + apps/base/woodpecker/serviceaccount_terraform_rancher.yaml | 6 ++++++ 2 files changed, 7 insertions(+) create mode 100644 apps/base/woodpecker/serviceaccount_terraform_rancher.yaml diff --git a/apps/base/woodpecker/kustomization.yaml b/apps/base/woodpecker/kustomization.yaml index b9c7e42..cbc24eb 100644 --- a/apps/base/woodpecker/kustomization.yaml +++ b/apps/base/woodpecker/kustomization.yaml @@ -10,6 +10,7 @@ resources: - serviceaccount_terraform_authentik.yaml - serviceaccount_terraform_git.yaml - serviceaccount_terraform_prowlarr.yaml + - serviceaccount_terraform_rancher.yaml - serviceaccount_terraform_radarr.yaml - serviceaccount_terraform_sonarr.yaml - serviceaccount_terraform_vault.yaml diff --git a/apps/base/woodpecker/serviceaccount_terraform_rancher.yaml b/apps/base/woodpecker/serviceaccount_terraform_rancher.yaml new file mode 100644 index 0000000..7c6640e --- /dev/null +++ b/apps/base/woodpecker/serviceaccount_terraform_rancher.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: terraform-rancher + namespace: woodpecker