Makefile

@@ -4,6 +4,10 @@ VAULT_AUTH_METHOD ?= approle
 VAULT_K8S_ROLE ?= woodpecker_terraform_authentik
 VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
 VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
+# kv-v2 location of the Authentik API token used by the provider.
+AUTHENTIK_TOKEN_KV_MOUNT ?= kv
+AUTHENTIK_TOKEN_KV_PATH ?= service/terraform/authentik
+AUTHENTIK_TOKEN_KV_FIELD ?= token
 
 define vault_env
 	@export VAULT_ADDR="https://vault.service.consul:8200" && \
@@ -12,7 +16,8 @@ define vault_env
 	else \
 		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
 	fi && \
-	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-authentik)
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-authentik) && \
+	export TF_VAR_authentik_token=$$(vault kv get -mount=$(AUTHENTIK_TOKEN_KV_MOUNT) -field=$(AUTHENTIK_TOKEN_KV_FIELD) $(AUTHENTIK_TOKEN_KV_PATH))
 endef
 
 init: