From 563b2164c7f10475780014fa97e9dc6f308dd921 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 27 Sep 2026 10:35:05 +1000 Subject: [PATCH] Let terraform-authentik read the vlogs OIDC client secret (#157) vlogs is the first app needing a second OIDC secret in a namespace that already has one, so the one-per-namespace `oauth-credentials` wildcard does not cover it and the terraform-authentik plan fails on a denied kv read. - grant the runner read on `kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials` Unblocks terraform-authentik #40. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/157 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- policies/kv/service/terraform/authentik.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/policies/kv/service/terraform/authentik.yaml b/policies/kv/service/terraform/authentik.yaml index 466d4a6..09ba06a 100644 --- a/policies/kv/service/terraform/authentik.yaml +++ b/policies/kv/service/terraform/authentik.yaml @@ -10,6 +10,11 @@ rules: - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials" capabilities: - read + # Second OIDC client in an already-onboarded namespace, so it cannot use the + # one-per-namespace oauth-credentials path above. + - path: "kv/data/kubernetes/namespace/logging/default/vlogs-oauth-credentials" + capabilities: + - read auth: approle: