2026-08-01 - 2026-09-01
Overview
38 Pull requests merged by 2 users
Merged
#149 Grant the vault deployer sudo to enable the oidc auth mount
Merged
#147 Add Authentik OIDC SSO as the default human login for OpenBao
Merged
#148 Grant the vault deployer auth/oidc and identity group capabilities
Merged
#146 Grant the vault deployer read on the Authentik OIDC client secret
Merged
#145 Bump vault-secrets-arrstack provider to 0.2.0 and plumb methods
Merged
#144 Bump arrstack plugin catalog to v0.2.0
Merged
#143 Grant terraform-rancher read on rancher/creds/ci
Merged
#141 Add arrstack creds role and k8s auth for mediamark
Merged
#142 Add ephemeral Gitea creds for repospawner
Merged
#140 Grant terraform-authentik write on the kv/service/authentik subtree
Merged
#139 Grant agents approle read on kv/service/authentik/agent-api-token
Merged
#138 Revert temporary agents read grant on Authentik provider token
Merged
#137 Grant agents AppRole read on the Authentik provider token
Merged
#136 Run plan without acquiring the Consul state lock
Merged
#135 operator RO creds: read operator CRD API groups
Merged
#134 Bump vault-secrets-arrstack provider to 0.1.1
Merged
#133 Sort arrstack role apps alphabetically
Merged
#132 Allow CSI auth to read ceph-mediafs-secret KV
Merged
#127 vault: mount arrstack engine + config + roles (3/3)
Merged
#131 Remove ghp agent role (missing installation_id; unblock apply)
Merged
#130 Restore ghp secret backend + roles (config now seeded)
Merged
#128 Grant agents approle write on ghp config KV path (to seed)
Merged
#126 vault: add arrstack policies (deployer + KV read + creds) (2/3)
Merged
#129 Temporarily remove ghp secret backend + roles (unblock apply)
Merged
#125 vault: register vault-plugin-secrets-arrstack in the catalog (1/3)
Merged
#121 vault: wire up ghp secrets engine (backend + role + policies)
Merged
#123 vault: register ghp plugin in the catalog (config/plugins only)
Merged
#122 vault: ghp engine config-write + consumer policies (apply before #121)
Merged
#119 Mint the netbox user-management credential dynamically from the single admin token
Merged
#117 Add the netbox backend and terraform-infra role
Merged
#115 Add the netbox secrets engine modules and wiring
Merged
#118 Register the netbox secrets plugin in the catalog
Merged
#116 Add netbox engine admin policy
Merged
#114 Let the agents AppRole mint unkin-agent Gitea tokens
Merged
#113 Grant terraform-infra kv metadata read
Merged
#111 Rename terraform-ipam CI Vault access -> terraform-infra
Merged
#110 Add terraform-ipam CI Vault access
Merged
#109 Add Vault-scoped agent kubernetes roles + agents AppRole
2 Issues created by 1 user
Opened
#107 Harden seed modules: ignore_changes on rancher/litellm engine seed credentials
Opened
#112 terraform-vault plan CI broken: litellm secret backend returns 500 (blocks all PRs)