unkin-agent
8ec8bbda8e
The Authentik API token used by estate automation was created by hand in the UI and pasted into Vault, so it was undocumented, unauditable and impossible to rotate reproducibly. Model it as config instead. Add a service_accounts config kind, discovered from config/service_accounts/ like the other kinds. Each entry creates a service_account user, an RBAC role carrying its global permissions, its API tokens, and (optionally) a kv-v2 write publishing each token key. Add sa-agent-api granting view_outpost, view_token and view_token_key, with a non-expiring api token agent-api-token published to kv/service/authentik/agent-api-token.
20 lines
693 B
YAML
20 lines
693 B
YAML
# Service account sa-agent-api (username = filename). Machine identity for
|
|
# estate automation that needs to read Authentik outpost tokens; replaces the
|
|
# hand-created token an operator used to paste into Vault.
|
|
name: Agent API
|
|
permissions:
|
|
# List outposts and read their bootstrap token keys.
|
|
- authentik_outposts.view_outpost
|
|
- authentik_core.view_token
|
|
- authentik_core.view_token_key
|
|
tokens:
|
|
agent-api-token:
|
|
description: >-
|
|
Used by agentvault seed-outpost to look up Authentik outpost tokens.
|
|
Managed by terraform-authentik; key published to Vault kv.
|
|
expiring: false
|
|
vault:
|
|
mount: kv
|
|
path: service/authentik/agent-api-token
|
|
key: token
|