From 59c42993bcdbe56775d164b4d53e5128063ce046 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 16 Oct 2026 22:09:20 +1100 Subject: [PATCH] Add identity OIDC token role for terraform-artifactapi (#167) terraform-artifactapi CI needs a Vault-signed identity token that artifactapi can verify, so the issuer must be a fixed address reachable from pods rather than per-node api_addr. - set the identity token issuer to https://vault.service.consul:8200 - add RS256 named key artifactapi - add role terraform-artifactapi (aud artifactapi, 15m ttl) - grant read on identity/oidc/token/terraform-artifactapi to the terraform_artifactapi approle and woodpecker_terraform_artifactapi k8s role Requires terraform-vault #165 and #166. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/167 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- config/identity_oidc/default.yaml | 2 ++ config/identity_oidc_key/artifactapi.yaml | 2 ++ .../artifactapi/terraform-artifactapi.yaml | 3 +++ .../identity/oidc/token/terraform-artifactapi.yaml | 11 +++++++++++ 4 files changed, 18 insertions(+) create mode 100644 config/identity_oidc/default.yaml create mode 100644 config/identity_oidc_key/artifactapi.yaml create mode 100644 config/identity_oidc_role/artifactapi/terraform-artifactapi.yaml create mode 100644 policies/identity/oidc/token/terraform-artifactapi.yaml diff --git a/config/identity_oidc/default.yaml b/config/identity_oidc/default.yaml new file mode 100644 index 0000000..c861d88 --- /dev/null +++ b/config/identity_oidc/default.yaml @@ -0,0 +1,2 @@ +--- +issuer: https://vault.service.consul:8200 diff --git a/config/identity_oidc_key/artifactapi.yaml b/config/identity_oidc_key/artifactapi.yaml new file mode 100644 index 0000000..f9d88b5 --- /dev/null +++ b/config/identity_oidc_key/artifactapi.yaml @@ -0,0 +1,2 @@ +--- +algorithm: RS256 diff --git a/config/identity_oidc_role/artifactapi/terraform-artifactapi.yaml b/config/identity_oidc_role/artifactapi/terraform-artifactapi.yaml new file mode 100644 index 0000000..8970509 --- /dev/null +++ b/config/identity_oidc_role/artifactapi/terraform-artifactapi.yaml @@ -0,0 +1,3 @@ +--- +client_id: artifactapi +ttl: 900 diff --git a/policies/identity/oidc/token/terraform-artifactapi.yaml b/policies/identity/oidc/token/terraform-artifactapi.yaml new file mode 100644 index 0000000..d659a38 --- /dev/null +++ b/policies/identity/oidc/token/terraform-artifactapi.yaml @@ -0,0 +1,11 @@ +--- +rules: + - path: "identity/oidc/token/terraform-artifactapi" + capabilities: + - read + +auth: + approle: + - terraform_artifactapi + k8s/au/syd1: + - woodpecker_terraform_artifactapi