From 08ec281b1d79bf38a7f5bde5f7d8aea2a3ae546d Mon Sep 17 00:00:00 2001 From: Unkin Agent Date: Thu, 20 Aug 2026 00:05:13 +1000 Subject: [PATCH] Remove ghp agent role (missing installation_id; unblock apply) (#131) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The `ghp` agent role fails at apply with `Code: 400 — installation_id is required for agent tokens`. The role config `config/ghp_secret_backend_role/ghp/agent.yaml` carries only a placeholder `installation_id`, so the role can never be created. This failure blocks the terraform-vault master apply, which in turn blocks the arrstack #127 apply. Remove the ghp role for now so the master apply goes green. The `ghp` secret backend itself is retained (it now mounts and configures cleanly). The role can be re-added once a real `installation_id` is provided. Because the role never successfully created (apply failed on it), removing it is non-destructive — it is not in state, so no destroy is introduced. ## Changes - Delete `config/ghp_secret_backend_role/ghp/agent.yaml`, which empties the `ghp_secret_backend_role` for_each map so no role instance (and no downstream ghp_secret_role) is planned. Backend `config/ghp_secret_backend/ghp.yaml` and all other config are unchanged. Net diff vs master is exactly this one file deletion. --------- Co-authored-by: unkin-agent Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/131 Co-authored-by: Unkin Agent Co-committed-by: Unkin Agent --- config/ghp_secret_backend_role/ghp/agent.yaml | 15 --------------- 1 file changed, 15 deletions(-) delete mode 100644 config/ghp_secret_backend_role/ghp/agent.yaml diff --git a/config/ghp_secret_backend_role/ghp/agent.yaml b/config/ghp_secret_backend_role/ghp/agent.yaml deleted file mode 100644 index b5653c7..0000000 --- a/config/ghp_secret_backend_role/ghp/agent.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# Role minting ephemeral, scoped ghp agent tokens. Reading ghp/creds/agent mints -# a lease-bound token deleted from ghp on revoke/expiry. token_type "agent" binds -# the minted token to a ghp App installation, so installation_id is REQUIRED. -# -# installation_id below is a PLACEHOLDER (0) and MUST be set to the real ghp App -# installation id before this role can mint usable tokens. scopes are ghp -# permission:level pairs; contents:read is the least-privilege default. ---- -token_type: agent -installation_id: 0 # PLACEHOLDER - set to the real ghp App installation id -scopes: - - contents:read -session_prefix: vault -ttl: 3600 # 1h -max_ttl: 86400 # 24h