scaffold terraform-provider-vault-secrets-ghp #1

2026-08-15T20:26:29+10:00

unkin-agent commented

2026-08-15 20:26:29 +10:00

Why: Terraform provider for the ghp Vault/OpenBao secrets engine (vault-plugin-secrets-ghp), following the vault-secrets-netbox convention. Manages the engine mount/config and roles as code so the terraform-vault repo can declare the ghp backend + roles.

How: modelled 1:1 on terraform-provider-vault-secrets-netbox.

provider source address git.unkin.net/unkin/vault-secrets-ghp, TypeName ghp
resource ghp_secret_backend: base_url, admin_token (write-only ghpsvc_ service token), ca_cert (write-only), tls_skip_verify, request_timeout_seconds
resource ghp_secret_role: token_type (agent|proxy), installation_id (required for agent), app_record_id, repositories, scopes, session_prefix, ttl, max_ttl
unit tests for value conversions + field mapping (gofmt/vet/build/test -race green)
.woodpecker mirrors netbox (pre-commit/build/test on PR; release PUTs the zip to the artifactapi terraform-unkin repo under unkin/vault-secrets-ghp on v* tags)
Makefile make patch|minor|major + package

Pairs with the released vault-plugin-secrets-ghp v0.1.0. Next: terraform-vault declares the plugin-catalog entry + ghp_secret_backend/role module instances via this provider.

Why: Terraform provider for the ghp Vault/OpenBao secrets engine (vault-plugin-secrets-ghp), following the vault-secrets-netbox convention. Manages the engine mount/config and roles as code so the terraform-vault repo can declare the ghp backend + roles. How: modelled 1:1 on terraform-provider-vault-secrets-netbox. - provider source address git.unkin.net/unkin/vault-secrets-ghp, TypeName ghp - resource ghp_secret_backend: base_url, admin_token (write-only ghpsvc_ service token), ca_cert (write-only), tls_skip_verify, request_timeout_seconds - resource ghp_secret_role: token_type (agent|proxy), installation_id (required for agent), app_record_id, repositories, scopes, session_prefix, ttl, max_ttl - unit tests for value conversions + field mapping (gofmt/vet/build/test -race green) - .woodpecker mirrors netbox (pre-commit/build/test on PR; release PUTs the zip to the artifactapi terraform-unkin repo under unkin/vault-secrets-ghp on v* tags) - Makefile make patch|minor|major + package Pairs with the released vault-plugin-secrets-ghp v0.1.0. Next: terraform-vault declares the plugin-catalog entry + ghp_secret_backend/role module instances via this provider.

unkin-agent added 4 commits 2026-08-15 20:26:30 +10:00

Initial commit 4532a24841

Scaffold the ghp Vault secrets engine provider 986aecd28f

Model the provider on terraform-provider-giteavaultsecret, adjusting the
schemas to the ghp engine (vault-plugin-secrets-ghp) so its mount, config,
and roles can be managed declaratively.

- Add provider (local name ghpvaultsecret, source
  git.unkin.net/unkin/ghpvaultsecret) with VAULT_ADDR/VAULT_TOKEN fallback.
- Add ghpvaultsecret_secret_backend: mounts the engine and writes config
  (base_url, write-only admin_token, write-only ca_cert, tls_skip_verify,
  request_timeout_seconds); read never returns the sensitive fields.
- Add ghpvaultsecret_secret_role: token_type, installation_id, app_record_id,
  repositories, scopes, session_prefix, ttl, max_ttl; validate that agent
  roles set installation_id.
- Add unit tests for the value conversions and the role/backend field mapping.
- Mirror the woodpecker pre-commit/build/test (PR) and tag release (package +
  PUT zip to the artifactapi terraform registry) pipelines, Makefile version
  bump/package targets, examples, README, and a Docker e2e harness.

Rename to the vault-secrets-netbox provider convention afa53a3362

Align the provider with unkin/terraform-provider-vault-secrets-netbox: the
Go module becomes terraform-provider-vault-secrets-ghp, the provider source
address vault-secrets-ghp, and the resources ghp_secret_backend /
ghp_secret_role (TypeName ghp).

- main.go: module import, providerserver Address, package doc comment.
- provider.go: TypeName ghp (resources ghp_secret_backend, ghp_secret_role).
- Makefile: BINARY + INSTALL_DIR under vault-secrets-ghp; drop the e2e target
  (netbox has none).
- .woodpecker/release: PUT the zip to the artifactapi vault-secrets-ghp path.
- Restructure examples to netbox's layout (combined examples/main.tf + per
  resource) and rewrite README for the new names; drop the Docker e2e harness
  to mirror netbox exactly.

Engine schema mapping is unchanged. gofmt, go vet, go build ./... and
go test -race ./... all pass.

merge repo-init main (keep scaffold README)

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

e59a04a64e

# Conflicts:
#	README.md

benvin merged commit 05fd9a9369 into main

2026-08-15 22:28:10 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-provider-vault-secrets-ghp#1