unkin-agent
0d2823293e
Engine plugin v0.2.0 added a `methods` field to roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can be handed a key that cannot write. The provider had no way to express it. - Add an optional `methods` set attribute to arrstack_secret_backend_role, validated at plan time against GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS. - Always write `methods`, since the engine only clears a scope when the key is present; an unrestricted role reads back as null rather than an empty set so an omitted config value does not drift. - Document the attribute in the README and examples, and cover the write mapping, read-back, and validation in tests.
24 lines
769 B
Terraform
24 lines
769 B
Terraform
# A role that mints short-lived arrproxy API keys scoped to a subset of the arr
|
|
# apps. Reading arrstack/creds/<role> returns a lease-bound key that the engine
|
|
# revokes when the lease ends.
|
|
resource "arrstack_secret_backend_role" "sonarr" {
|
|
backend = arrstack_secret_backend.arrstack.path
|
|
name = "sonarr"
|
|
apps = ["sonarr"]
|
|
|
|
ttl = 60 # 1m
|
|
max_ttl = 86400 # 24h
|
|
}
|
|
|
|
# The same role narrowed to read-only traffic: keys minted from it may only
|
|
# issue GET/HEAD against Sonarr. Omitting methods leaves a key unrestricted.
|
|
resource "arrstack_secret_backend_role" "sonarr_ro" {
|
|
backend = arrstack_secret_backend.arrstack.path
|
|
name = "sonarr-ro"
|
|
apps = ["sonarr"]
|
|
methods = ["GET", "HEAD"]
|
|
|
|
ttl = 60 # 1m
|
|
max_ttl = 86400 # 24h
|
|
}
|