From d96d36a0795d28a63e72817757ab11271e3d2caa Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Mon, 6 Jul 2026 23:32:21 +1000
Subject: [PATCH] makefile: source TF_VAR_authentik_token from vault
 (kv/service/terraform/authentik)

The authentik provider needs a token but nothing supplied it, so plan
failed with 'No value for required variable authentik_token'. Source it
from Vault in vault_env like the consul creds, from the dedicated
terraform-service path kv/service/terraform/authentik (field: token),
overridable via AUTHENTIK_TOKEN_KV_* vars.
---
 Makefile | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index fe3ec71..7ba8788 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,10 @@ VAULT_AUTH_METHOD ?= approle
 VAULT_K8S_ROLE ?= woodpecker_terraform_authentik
 VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
 VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
+# kv-v2 location of the Authentik API token used by the provider.
+AUTHENTIK_TOKEN_KV_MOUNT ?= kv
+AUTHENTIK_TOKEN_KV_PATH ?= service/terraform/authentik
+AUTHENTIK_TOKEN_KV_FIELD ?= token
 
 define vault_env
 	@export VAULT_ADDR="https://vault.service.consul:8200" && \
@@ -12,7 +16,8 @@ define vault_env
 	else \
 		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
 	fi && \
-	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-authentik)
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-authentik) && \
+	export TF_VAR_authentik_token=$$(vault kv get -mount=$(AUTHENTIK_TOKEN_KV_MOUNT) -field=$(AUTHENTIK_TOKEN_KV_FIELD) $(AUTHENTIK_TOKEN_KV_PATH))
 endef
 
 init: