unkinben
93742883a5
The CI VAULT_TOKEN (short-lived k8s-auth role token) can't create child tokens, so the vault provider failed with 'failed to create limited child token: permission denied'. Use the token directly.
36 lines
1002 B
HCL
36 lines
1002 B
HCL
generate "backend" {
|
|
path = "backend.tf"
|
|
if_exists = "overwrite"
|
|
contents = <<EOF
|
|
provider "authentik" {
|
|
url = "https://${path_relative_to_include()}"
|
|
token = var.authentik_token
|
|
}
|
|
|
|
# Reads client secrets seeded in Vault (kv-v2). Auth via VAULT_ADDR + VAULT_TOKEN
|
|
# from the environment (set by the Makefile vault_env helper). skip_child_token
|
|
# is required because the short-lived CI token cannot create child tokens.
|
|
provider "vault" {
|
|
skip_child_token = true
|
|
}
|
|
|
|
variable "authentik_token" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
terraform {
|
|
backend "consul" {
|
|
address = "https://consul.service.consul"
|
|
path = "infra/terraform/authentik/${path_relative_to_include()}/state"
|
|
scheme = "https"
|
|
lock = true
|
|
ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
|
|
}
|
|
required_version = ">= 1.10"
|
|
# required_providers are declared in the module's versions.tf; declaring them
|
|
# here as well is a duplicate configuration (OpenTofu permits only one).
|
|
}
|
|
EOF
|
|
}
|