Authenticate config writes with a Vault OIDC token #64

2026-10-16T22:05:08+11:00

unkin-agent commented

2026-10-16 22:05:08 +11:00

artifactapi now requires a bearer JWT on config writes. Terraform mints a Vault identity-OIDC token and passes it via provider v0.7.0's ARTIFACTAPI_TOKEN env fallback.

export ARTIFACTAPI_TOKEN from identity/oidc/token/terraform-artifactapi in vault_env, failing if empty
require artifactapi provider ~> 0.7

Requires terraform-vault #167 applied first.

artifactapi now requires a bearer JWT on config writes. Terraform mints a Vault identity-OIDC token and passes it via provider v0.7.0's `ARTIFACTAPI_TOKEN` env fallback. - export `ARTIFACTAPI_TOKEN` from `identity/oidc/token/terraform-artifactapi` in `vault_env`, failing if empty - require artifactapi provider `~> 0.7` Requires terraform-vault #167 applied first.

unkin-agent added 1 commit 2026-10-16 22:05:08 +11:00

Export artifactapi OIDC token and require provider 0.7

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

363e7b3897

unkin-agent commented

2026-10-16 22:06:09 +11:00

Makefile:16 — ci/woodpecker/pr/plan fails on head 363e7b3; terraform-vault #167 (creates identity/oidc/token/terraform-artifactapi) is still open/unmerged, so the vault read cannot succeed → merge and apply #167 first, then re-run plan; do not merge this until plan is green.

- Makefile:16 — `ci/woodpecker/pr/plan` fails on head 363e7b3; terraform-vault #167 (creates `identity/oidc/token/terraform-artifactapi`) is still open/unmerged, so the `vault read` cannot succeed → merge and apply #167 first, then re-run plan; do not merge this until plan is green.

benvin merged commit 20912de489 into main

2026-10-16 22:22:06 +11:00

benvin deleted branch benvin/oidc-token

2026-10-16 22:22:06 +11:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-artifactapi#64