terraform-authentik/config/permissions/akP-mediamark-user.yaml at main - terraform-authentik - Gitea

unkin/terraform-authentik

Files

T

unkin-agent 1485962cf5

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

Fix mediamark Vault secret path and permission group name

The terraform-authentik runner's Vault policy only grants read on
kv/data/kubernetes/namespace/+/default/oauth-credentials (literal trailing
filename), so the arrstack/default/mediamark-oauth-credentials path 403s at
plan time and reddens CI. mediamark deploys in its own `mediamark` namespace
(watchstate model), so point the data source at
kubernetes/namespace/mediamark/default/oauth-credentials, which the policy
covers. Hostnames are unchanged.

Rename the permission group to akP-mediamark-user to match the peer tier-suffix
convention (akP-watchstate-admin, akP-arrstack-user). The group name is derived
from the filename in config/config.hcl, so update the akR-media-adult
reference too.

2026-08-29 21:13:41 +10:00

5 lines

189 B

YAML

Raw Permalink Blame History

 # Permission group akP-mediamark-user (name = filename). Grants user access to
 # mediamark: bound to the mediamark application, gating the kids-content
 # marking UI.
 application: mediamark