vault provider: skip child token creation in CI

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
2026-07-27 21:52:24 +10:00
parent c068f56eca
commit 0385d2a1ef
1 changed files with 5 additions and 1 deletions
@@ -14,7 +14,11 @@ provider "woodpecker" {
 # Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the
 # Makefile authenticates via k8s auth before running terragrunt). Used to seed
 # bot-account credentials into Vault KV (see modules/user vault_seed_path).
-provider "vault" {}
+# skip_child_token: the CI token from the k8s auth role cannot create child
+# tokens (apply fails with "failed to create limited child token").
+provider "vault" {
+  skip_child_token = true
+}

 terraform {
  backend "consul" {