From 9bdf9ce9fc898ff41eea668a9c852b5e879d9ea7 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 6 Aug 2026 23:09:00 +1000 Subject: [PATCH] Fix vault provider auth in CI: skip_child_token + correct kv path The woodpecker_terraform_infra role cannot mint child tokens (auth/token/create 403), which failed the plan's vault_kv_secret_v2 read. Set skip_child_token so the provider uses the login token directly (estate pattern). Also correct the KV path missed in the ipam->infra rename: service/terraform/infra. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --- modules/infra/providers.tf | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/infra/providers.tf b/modules/infra/providers.tf index 0b53b71..f276eed 100644 --- a/modules/infra/providers.tf +++ b/modules/infra/providers.tf @@ -1,12 +1,15 @@ provider "vault" { address = var.vault_address + # The woodpecker_terraform_infra role cannot mint child tokens (auth/token/create + # is denied); use the login token directly. + skip_child_token = true } # KeaAPI and NetBox tokens live in a single Vault KV v2 secret. The vault # provider authenticates with the VAULT_TOKEN set by the Makefile. data "vault_kv_secret_v2" "tokens" { mount = "kv" - name = "service/terraform/ipam" + name = "service/terraform/infra" } provider "netbox" {