From 1f03bcdc672235cdef15e3d26019b08fbc447f90 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 30 Aug 2026 18:19:04 +1000 Subject: [PATCH] Bump vault-secrets-arrstack provider to 0.2.0 and plumb methods (#145) ## Why Engine plugin v0.2.0 (catalog bumped in #144) added a `methods` field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can hold a key that cannot write. Provider v0.2.0 (just published to the `terraform-unkin` registry) exposes it as an optional set attribute, but the module had no input for it, so no role yaml could use it. ## How - Bumps the `vault-secrets-arrstack` provider pin from 0.1.1 to 0.2.0 in `environments/root.hcl` and both arrstack modules. - Adds an optional `methods` input to `modules/vault_cluster/modules/arrstack_secret_backend_role` and passes it through to the resource. - Threads `methods` through the `vault_cluster` `arrstack_secret_backend_role` object type, so a role yaml may now carry a `methods:` list and it flows via the existing config.hcl merge with no discovery change. `methods` defaults to `null` rather than `[]`: the provider reads an unrestricted role back as null, so a null default keeps a role yaml that omits the field drift-free. An empty-set default would plan `null -> []` on every existing role. **Expected plan: no resource changes.** No role yaml changes here, so the plan should be a provider-version-only diff (provider upgrade, zero add/change/destroy). Follow-up PR scopes the mediamark role to GET/HEAD. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/145 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- environments/root.hcl | 2 +- modules/vault_cluster/main.tf | 1 + .../modules/arrstack_secret_backend/terraform.tf | 2 +- .../modules/arrstack_secret_backend_role/main.tf | 1 + .../modules/arrstack_secret_backend_role/terraform.tf | 2 +- .../modules/arrstack_secret_backend_role/variables.tf | 7 +++++++ modules/vault_cluster/variables.tf | 1 + 7 files changed, 13 insertions(+), 3 deletions(-) diff --git a/environments/root.hcl b/environments/root.hcl index dcc54c5..0233a7f 100644 --- a/environments/root.hcl +++ b/environments/root.hcl @@ -67,7 +67,7 @@ terraform { } arrstack = { source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack" - version = "0.1.1" + version = "0.2.0" } } } diff --git a/modules/vault_cluster/main.tf b/modules/vault_cluster/main.tf index 0ac715f..d31e35c 100644 --- a/modules/vault_cluster/main.tf +++ b/modules/vault_cluster/main.tf @@ -370,6 +370,7 @@ module "arrstack_secret_backend_role" { name = each.value.name backend = each.value.backend apps = each.value.apps + methods = each.value.methods ttl = each.value.ttl max_ttl = each.value.max_ttl diff --git a/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf b/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf index a16f196..6ab0265 100644 --- a/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf +++ b/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf @@ -7,7 +7,7 @@ terraform { } arrstack = { source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack" - version = "0.1.1" + version = "0.2.0" } } } diff --git a/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf b/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf index 17bc124..90d93c9 100644 --- a/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf +++ b/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf @@ -2,6 +2,7 @@ resource "arrstack_secret_backend_role" "this" { backend = var.backend name = var.name apps = var.apps + methods = var.methods ttl = var.ttl max_ttl = var.max_ttl } diff --git a/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf b/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf index b158d4b..cb0e7c0 100644 --- a/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf +++ b/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf @@ -3,7 +3,7 @@ terraform { required_providers { arrstack = { source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack" - version = "0.1.1" + version = "0.2.0" } } } diff --git a/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf b/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf index 022e978..c79ebd7 100644 --- a/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf +++ b/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf @@ -13,6 +13,13 @@ variable "apps" { type = list(string) } +variable "methods" { + description = "HTTP methods a generated key is limited to (subset of GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS). Null leaves the role unrestricted" + type = set(string) + # null, not [], so a role yaml that omits methods matches the provider's null read-back and shows no drift. + default = null +} + variable "ttl" { description = "Default lease TTL in seconds for keys generated from this role" type = number diff --git a/modules/vault_cluster/variables.tf b/modules/vault_cluster/variables.tf index 9b59df5..9fc6f2f 100644 --- a/modules/vault_cluster/variables.tf +++ b/modules/vault_cluster/variables.tf @@ -334,6 +334,7 @@ variable "arrstack_secret_backend_role" { name = string backend = string apps = list(string) + methods = optional(set(string)) ttl = optional(number) max_ttl = optional(number) }))