From 36d2b99255a685bdacae79905b98ccc0961512d3 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 25 Aug 2026 21:35:57 +1000 Subject: [PATCH] Revert temporary agents read grant on Authentik provider token (#138) ## Why The one-off terragrunt import in terraform-authentik that required this grant is complete (jellyfin provider, groups, application, and policy bindings are all reconciled into state; apply pipeline is green). Per the recovery plan the temporary read grant is removed again. ## Changes - Reverts de9d6e5: removes policies/kv/service/terraform/authentik/read.yaml (agents AppRole read on kv/data/service/terraform/authentik) Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/138 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- policies/kv/service/terraform/authentik/read.yaml | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 policies/kv/service/terraform/authentik/read.yaml diff --git a/policies/kv/service/terraform/authentik/read.yaml b/policies/kv/service/terraform/authentik/read.yaml deleted file mode 100644 index 655de85..0000000 --- a/policies/kv/service/terraform/authentik/read.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Lets the agents AppRole read the Authentik provider API token so a coding -# agent can run a one-off `terragrunt import` in terraform-authentik to -# reconcile resources orphaned by the failed jellyfin apply. Read-only on the -# single token path; revert once the import is done. Mirrors the -# gitea/creds/unkin-agent binding pattern. ---- -rules: - - path: "kv/data/service/terraform/authentik" - capabilities: - - read - -auth: - approle: - - agents