From 5c7495aa22cce0032863ab29cd90acbf5311fdea Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Wed, 14 Oct 2026 22:44:25 +1100 Subject: [PATCH] Add identity OIDC token role for terraform-artifactapi --- config/identity_oidc/default.yaml | 2 ++ config/identity_oidc_key/artifactapi.yaml | 2 ++ .../artifactapi/terraform-artifactapi.yaml | 3 +++ .../identity/oidc/token/terraform-artifactapi.yaml | 11 +++++++++++ 4 files changed, 18 insertions(+) create mode 100644 config/identity_oidc/default.yaml create mode 100644 config/identity_oidc_key/artifactapi.yaml create mode 100644 config/identity_oidc_role/artifactapi/terraform-artifactapi.yaml create mode 100644 policies/identity/oidc/token/terraform-artifactapi.yaml diff --git a/config/identity_oidc/default.yaml b/config/identity_oidc/default.yaml new file mode 100644 index 0000000..c861d88 --- /dev/null +++ b/config/identity_oidc/default.yaml @@ -0,0 +1,2 @@ +--- +issuer: https://vault.service.consul:8200 diff --git a/config/identity_oidc_key/artifactapi.yaml b/config/identity_oidc_key/artifactapi.yaml new file mode 100644 index 0000000..f9d88b5 --- /dev/null +++ b/config/identity_oidc_key/artifactapi.yaml @@ -0,0 +1,2 @@ +--- +algorithm: RS256 diff --git a/config/identity_oidc_role/artifactapi/terraform-artifactapi.yaml b/config/identity_oidc_role/artifactapi/terraform-artifactapi.yaml new file mode 100644 index 0000000..8970509 --- /dev/null +++ b/config/identity_oidc_role/artifactapi/terraform-artifactapi.yaml @@ -0,0 +1,3 @@ +--- +client_id: artifactapi +ttl: 900 diff --git a/policies/identity/oidc/token/terraform-artifactapi.yaml b/policies/identity/oidc/token/terraform-artifactapi.yaml new file mode 100644 index 0000000..d659a38 --- /dev/null +++ b/policies/identity/oidc/token/terraform-artifactapi.yaml @@ -0,0 +1,11 @@ +--- +rules: + - path: "identity/oidc/token/terraform-artifactapi" + capabilities: + - read + +auth: + approle: + - terraform_artifactapi + k8s/au/syd1: + - woodpecker_terraform_artifactapi