From 4ec2f92ca54bcf0e9895074da24b6269f63fbe1e Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Fri, 24 Jul 2026 22:55:09 +1000
Subject: [PATCH] Grant terraform-incus approle read on encapi environment
 secret

terraform-incus dual-writes ENC data to encapi and needs the
ENCAPI_WRITE_TOKEN from Vault at apply time. Add a policy granting the
terraform_incus approle read on kv/data/kubernetes/namespace/encapi/default/environment.

Prerequisite for terraform-incus PR #39.
---
 .../service/terraform/incus-encapi-environment.yaml  | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 policies/kv/service/terraform/incus-encapi-environment.yaml

diff --git a/policies/kv/service/terraform/incus-encapi-environment.yaml b/policies/kv/service/terraform/incus-encapi-environment.yaml
new file mode 100644
index 0000000..b9375d0
--- /dev/null
+++ b/policies/kv/service/terraform/incus-encapi-environment.yaml
@@ -0,0 +1,12 @@
+# Allow the Terraform Incus runner to read the encapi environment secret
+# (ENCAPI_WRITE_TOKEN), so `make apply` can dual-write ENC data to encapi via
+# the encapi Terraform provider.
+---
+rules:
+  - path: "kv/data/kubernetes/namespace/encapi/default/environment"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_incus