2026-07-19 - 2026-10-19
Overview
65 Pull requests merged by 3 users
Merged
#169 Grant agents read on BinaryLane WireGuard keys
Merged
#168 Sort kubernetes role allowed namespaces
Merged
#167 Add identity OIDC token role for terraform-artifactapi
Merged
#166 Add identity OIDC modules and YAML discovery
Merged
#165 Add deployer policy for identity OIDC objects
Merged
#164 Add Vault/Consul access for terraform-binarylane
Merged
#163 feat: litellm creds for mail/rspamd
Merged
#162 ci: use container-opentofu image
Merged
#161 Replace the terraform-infra Vault identity with terraform-netbox
Merged
#160 Remove the vlogs one-off oauth-credentials policy
Merged
#158 Keep policy rule paths within their own directory
Merged
#156 Add agent-observability kubernetes creds role and policy
Merged
#157 Let terraform-authentik read the vlogs OIDC client secret
Merged
#155 Accept IP and short-hostname principals on sshca/signhost
Merged
#153 Fix SSH host certificate signing for the sshca role
Merged
#152 Add kubernetes auth roles for the puppet compilers
Merged
#151 Grant the agents approle read+write on the woodpecker agent token
Merged
#150 chore: extend oidc login to 1 day
Merged
#149 Grant the vault deployer sudo to enable the oidc auth mount
Merged
#147 Add Authentik OIDC SSO as the default human login for OpenBao
Merged
#148 Grant the vault deployer auth/oidc and identity group capabilities
Merged
#146 Grant the vault deployer read on the Authentik OIDC client secret
Merged
#145 Bump vault-secrets-arrstack provider to 0.2.0 and plumb methods
Merged
#144 Bump arrstack plugin catalog to v0.2.0
Merged
#143 Grant terraform-rancher read on rancher/creds/ci
Merged
#141 Add arrstack creds role and k8s auth for mediamark
Merged
#142 Add ephemeral Gitea creds for repospawner
Merged
#140 Grant terraform-authentik write on the kv/service/authentik subtree
Merged
#139 Grant agents approle read on kv/service/authentik/agent-api-token
Merged
#138 Revert temporary agents read grant on Authentik provider token
Merged
#137 Grant agents AppRole read on the Authentik provider token
Merged
#136 Run plan without acquiring the Consul state lock
Merged
#135 operator RO creds: read operator CRD API groups
Merged
#134 Bump vault-secrets-arrstack provider to 0.1.1
Merged
#133 Sort arrstack role apps alphabetically
Merged
#132 Allow CSI auth to read ceph-mediafs-secret KV
Merged
#127 vault: mount arrstack engine + config + roles (3/3)
Merged
#131 Remove ghp agent role (missing installation_id; unblock apply)
Merged
#130 Restore ghp secret backend + roles (config now seeded)
Merged
#128 Grant agents approle write on ghp config KV path (to seed)
Merged
#126 vault: add arrstack policies (deployer + KV read + creds) (2/3)
Merged
#129 Temporarily remove ghp secret backend + roles (unblock apply)
Merged
#125 vault: register vault-plugin-secrets-arrstack in the catalog (1/3)
Merged
#121 vault: wire up ghp secrets engine (backend + role + policies)
Merged
#123 vault: register ghp plugin in the catalog (config/plugins only)
Merged
#122 vault: ghp engine config-write + consumer policies (apply before #121)
Merged
#119 Mint the netbox user-management credential dynamically from the single admin token
Merged
#117 Add the netbox backend and terraform-infra role
Merged
#115 Add the netbox secrets engine modules and wiring
Merged
#118 Register the netbox secrets plugin in the catalog
Merged
#116 Add netbox engine admin policy
Merged
#114 Let the agents AppRole mint unkin-agent Gitea tokens
Merged
#113 Grant terraform-infra kv metadata read
Merged
#111 Rename terraform-ipam CI Vault access -> terraform-infra
Merged
#110 Add terraform-ipam CI Vault access
Merged
#109 Add Vault-scoped agent kubernetes roles + agents AppRole
Merged
#106 Add logarchive gpg key + logging_logarchiver read access
Merged
#105 gitea roles: add read:user scope for API login validation
Merged
#101 gitea: add the gitea token secrets engine (mount, config, teabot roles)
Merged
#104 policies: allow terraform-git to delete the gitea config seed for taint recovery
Merged
#103 policies: grant terraform-git read on the gitea config KV metadata path
Merged
#102 policies: let terraform-git seed the gitea engine admin credential to KV
Merged
#100 policies: grant the vault deployer access to the gitea secrets engine
Merged
#99 ci: fetch vault from artifactapi instead of dnf install
Merged
#98 Add terraform-enc Vault/Consul plumbing + encapi token grant
2 Issues created by 1 user
Opened
#107 Harden seed modules: ignore_changes on rancher/litellm engine seed credentials
Opened
#112 terraform-vault plan CI broken: litellm secret backend returns 500 (blocks all PRs)