policies: allow terraform-git to delete the gitea config seed for taint recovery

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
2026-07-27 23:26:18 +10:00
parent d82580f1af
commit 1f060bd9b0
1 changed files with 6 additions and 0 deletions
@@ -7,16 +7,22 @@
 # write side for terraform-git's own identity.
 ---
 rules:
  # delete is required for taint recovery and destroy (the resource got tainted
  # by pipeline 107's failed post-create read and replace = delete+create).
  # The seed's write-once semantics are enforced by lifecycle ignore_changes in
  # terraform-git, not by withholding delete here.
  - path: "kv/data/service/vault/au/syd1/secret_backend/gitea/config"
    capabilities:
      - create
      - read
      - update
      - delete
  # vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply
  # (403 here broke the terraform-git main apply, pipeline 107).
  - path: "kv/metadata/service/vault/au/syd1/secret_backend/gitea/config"
    capabilities:
      - read
      - delete
 auth:
  approle: