Manage the agent API service account and token in Terraform #30

2026-08-29T22:59:07+10:00

unkin-agent commented

2026-08-29 22:59:07 +10:00

Why

The Authentik API token used by estate automation was created by hand in the UI and pasted into Vault. It is undocumented, unauditable, and cannot be rotated reproducibly. First consumer: agentvault seed-outpost, which reads kv/service/authentik/agent-api-token (key token) to fetch outpost tokens.

How

New yaml-discovered config kind config/service_accounts/<username>.yaml, wired through config/config.hcl + terragrunt inputs exactly like the existing kinds.
Per entry the module creates: authentik_user (type = service_account), an authentik_rbac_role holding its global permissions, authentik_rbac_permission_role grants, authentik_tokens, and a vault_kv_secret_v2 write publishing each token key.
config/service_accounts/sa-agent-api.yaml: grants authentik_outposts.view_outpost, authentik_core.view_token, authentik_core.view_token_key; token agent-api-token, intent api, expiring = false, key written to kv/service/authentik/agent-api-token.

Merge order — terraform-vault first

This PR must not be applied before terraform-vault PR benvin/tf-authentik-kv-write is applied. This repo's Vault role currently only reads kv; the new vault_kv_secret_v2 needs a write grant on kv/data/service/authentik/agent-api-token. Plan here passes (new resource, no prior state, no read of the path), but apply will 403 until that grant lands.

Notes

authentik_rbac_permission_user is deprecated in provider 2026.5 ("Migrate to authentik_rbac_permission_role"), so permissions attach to a per-account RBAC role and the role attaches to the account — same effective global grants, non-deprecated path.
retrieve_key = true is required for the provider to populate the token key; without it the attribute is empty and nothing reaches Vault.
The token key lands in Terraform state. Accepted — consistent with the OAuth2 client secrets this module already reads into state.

## Why The Authentik API token used by estate automation was created by hand in the UI and pasted into Vault. It is undocumented, unauditable, and cannot be rotated reproducibly. First consumer: `agentvault seed-outpost`, which reads `kv/service/authentik/agent-api-token` (key `token`) to fetch outpost tokens. ## How - New yaml-discovered config kind `config/service_accounts/<username>.yaml`, wired through `config/config.hcl` + terragrunt inputs exactly like the existing kinds. - Per entry the module creates: `authentik_user` (`type = service_account`), an `authentik_rbac_role` holding its global permissions, `authentik_rbac_permission_role` grants, `authentik_token`s, and a `vault_kv_secret_v2` write publishing each token key. - `config/service_accounts/sa-agent-api.yaml`: grants `authentik_outposts.view_outpost`, `authentik_core.view_token`, `authentik_core.view_token_key`; token `agent-api-token`, intent `api`, `expiring = false`, key written to `kv/service/authentik/agent-api-token`. ## Merge order — terraform-vault first **This PR must not be applied before `terraform-vault` PR `benvin/tf-authentik-kv-write` is applied.** This repo's Vault role currently only *reads* kv; the new `vault_kv_secret_v2` needs a write grant on `kv/data/service/authentik/agent-api-token`. Plan here passes (new resource, no prior state, no read of the path), but **apply will 403 until that grant lands**. ## Notes - `authentik_rbac_permission_user` is deprecated in provider 2026.5 ("Migrate to `authentik_rbac_permission_role`"), so permissions attach to a per-account RBAC role and the role attaches to the account — same effective global grants, non-deprecated path. - `retrieve_key = true` is required for the provider to populate the token `key`; without it the attribute is empty and nothing reaches Vault. - The token key lands in Terraform state. Accepted — consistent with the OAuth2 client secrets this module already reads into state.

unkin-agent added 1 commit 2026-08-29 22:59:07 +10:00

Manage the agent API service account and token in Terraform

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

8ec8bbda8e

The Authentik API token used by estate automation was created by hand in the
UI and pasted into Vault, so it was undocumented, unauditable and impossible
to rotate reproducibly. Model it as config instead.

Add a service_accounts config kind, discovered from config/service_accounts/
like the other kinds. Each entry creates a service_account user, an RBAC role
carrying its global permissions, its API tokens, and (optionally) a kv-v2
write publishing each token key.

Add sa-agent-api granting view_outpost, view_token and view_token_key, with a
non-expiring api token agent-api-token published to kv/service/authentik/agent-api-token.

benvin merged commit 3884a5b21f into main

2026-08-29 23:04:05 +10:00

benvin deleted branch benvin/agent-api-token-iac

2026-08-29 23:04:05 +10:00

unkin-agent referenced this pull request

2026-08-29 23:11:26 +10:00

Namespace service account token map keys by account #31

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#30