2026-07-27 22:03:28 +10:00
1 changed files with 5 additions and 1 deletions
@@ -14,7 +14,11 @@ provider "woodpecker" {
 # Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the
 # Makefile authenticates via k8s auth before running terragrunt). Used to seed
 # bot-account credentials into Vault KV (see modules/user vault_seed_path).
-provider "vault" {}
+# skip_child_token: the CI token from the k8s auth role cannot create child
+# tokens (apply fails with "failed to create limited child token").
+provider "vault" {
+  skip_child_token = true
+}

 terraform {
  backend "consul" {