unkin/terraform-git
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vault provider: skip child token creation in CI #48

Merged
benvin merged 1 commits from benvin/vault-skip-child-token into main 2026-07-27 22:03:28 +10:00
Conversation 0 Commits 1 Files Changed 1
+5 -1
unkinben commented 2026-07-27 21:52:35 +10:00
Owner
Copy Link
Copy Source

The main-branch apply pipeline has been failing since #46 introduced the vault provider: the provider defaults to minting a limited child token, which the CI token from the woodpecker k8s auth role is not permitted to do ("failed to create limited child token", pipelines 103/104). The gitea-vault-admin user and the logarchiver repo were still created by those partial applies, but the one-time KV seed for the gitea secret engine has not been written — so this also blocks terraform-vault #101.

  • set skip_child_token = true on the vault provider so it uses the CI token directly

After merge, the next main apply retries the outstanding vault_kv_secret_v2 seed.

The main-branch apply pipeline has been failing since #46 introduced the vault provider: the provider defaults to minting a limited child token, which the CI token from the woodpecker k8s auth role is not permitted to do ("failed to create limited child token", pipelines 103/104). The gitea-vault-admin user and the logarchiver repo were still created by those partial applies, but the one-time KV seed for the gitea secret engine has not been written — so this also blocks terraform-vault #101. - set skip_child_token = true on the vault provider so it uses the CI token directly After merge, the next main apply retries the outstanding vault_kv_secret_v2 seed.
unkinben added 1 commit 2026-07-27 21:52:36 +10:00
vault provider: skip child token creation in CI
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
0385d2a1ef 
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin merged commit 38849ba79f into main 2026-07-27 22:03:28 +10:00
benvin deleted branch benvin/vault-skip-child-token 2026-07-27 22:03:29 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) repospawner (Repo Spawner) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-git#48
Delete Branch "benvin/vault-skip-child-token"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?