Remove ghp agent role (missing installation_id; unblock apply) (#131)

## Why The `ghp` agent role fails at apply with `Code: 400 — installation_id is required for agent tokens`. The role config `config/ghp_secret_backend_role/ghp/agent.yaml` carries only a placeholder `installation_id`, so the role can never be created. This failure blocks the terraform-vault master apply, which in turn blocks the arrstack #127 apply. Remove the ghp role for now so the master apply goes green. The `ghp` secret backend itself is retained (it now mounts and configures cleanly). The role can be re-added once a real `installation_id` is provided. Because the role never successfully created (apply failed on it), removing it is non-destructive — it is not in state, so no destroy is introduced. ## Changes - Delete `config/ghp_secret_backend_role/ghp/agent.yaml`, which empties the `ghp_secret_backend_role` for_each map so no role instance (and no downstream ghp_secret_role) is planned. Backend `config/ghp_secret_backend/ghp.yaml` and all other config are unchanged. Net diff vs master is exactly this one file deletion. --------- Co-authored-by: unkin-agent <unkin-agent@users.noreply.git.unkin.net> Reviewed-on: #131 Co-authored-by: Unkin Agent <unkin-agent@unkin.net> Co-committed-by: Unkin Agent <unkin-agent@unkin.net>
2026-08-20 00:05:13 +10:00
parent 392c5d2ac7
commit 08ec281b1d
1 changed files with 0 additions and 15 deletions
@@ -1,15 +0,0 @@
-# Role minting ephemeral, scoped ghp agent tokens. Reading ghp/creds/agent mints
-# a lease-bound token deleted from ghp on revoke/expiry. token_type "agent" binds
-# the minted token to a ghp App installation, so installation_id is REQUIRED.
-#
-# installation_id below is a PLACEHOLDER (0) and MUST be set to the real ghp App
-# installation id before this role can mint usable tokens. scopes are ghp
-# permission:level pairs; contents:read is the least-privilege default.
---
-token_type: agent
-installation_id: 0 # PLACEHOLDER - set to the real ghp App installation id
-scopes:
-  - contents:read
-session_prefix: vault
-ttl: 3600      # 1h
-max_ttl: 86400 # 24h