Merge pull request 'vault provider: skip child token creation in CI' (#48) from benvin/vault-skip-child-token into main

Reviewed-on: #48

environments/root.hcl

@@ -14,7 +14,11 @@ provider "woodpecker" {
 # Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the
 # Makefile authenticates via k8s auth before running terragrunt). Used to seed
 # bot-account credentials into Vault KV (see modules/user vault_seed_path).
-provider "vault" {}
+# skip_child_token: the CI token from the k8s auth role cannot create child
+# tokens (apply fails with "failed to create limited child token").
+provider "vault" {
+  skip_child_token = true
+}
 
 terraform {
   backend "consul" {