From 0385d2a1ef0ac0c027e8feff07983a73d6bd38f9 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 27 Jul 2026 21:52:24 +1000 Subject: [PATCH] vault provider: skip child token creation in CI Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- environments/root.hcl | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/environments/root.hcl b/environments/root.hcl index 83b3e5b..7413786 100644 --- a/environments/root.hcl +++ b/environments/root.hcl @@ -14,7 +14,11 @@ provider "woodpecker" { # Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the # Makefile authenticates via k8s auth before running terragrunt). Used to seed # bot-account credentials into Vault KV (see modules/user vault_seed_path). -provider "vault" {} +# skip_child_token: the CI token from the k8s auth role cannot create child +# tokens (apply fails with "failed to create limited child token"). +provider "vault" { + skip_child_token = true +} terraform { backend "consul" {