From d1cb790de8626d7458acf46f217bd7a312718f33 Mon Sep 17 00:00:00 2001 From: Unkin Agent Date: Wed, 19 Aug 2026 23:17:44 +1000 Subject: [PATCH] Grant agents approle write on ghp config KV path (to seed) (#128) ## Why The `terraform-vault` master apply aborts because the KV path `kv/data/service/vault/au/syd1/secret_backend/ghp/config` (key `admin_token`, a `ghpsvc_` service token) is unseeded. The ghp secrets engine reads that value at `ghp/config` creation time, so the ghp data-source read fails and the apply stops. Granting the `agents` AppRole scoped write to just this one KV path lets an agent seed the value so the apply can proceed. ## Changes - Add `policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml`, a `vault_policy` bound to the `agents` AppRole role only. - Grant `create`, `update`, `read` on the kv-v2 data path `kv/data/service/vault/au/syd1/secret_backend/ghp/config`. - Grant `read` on the kv-v2 metadata path `kv/metadata/service/vault/au/syd1/secret_backend/ghp/config` (read on plan/apply). - Scope to this single ghp config path only; no wildcards, no delete, no list, no other `secret_backend` configs (least privilege). ## Caveat This grant is itself a `vault_policy` applied by the master apply, which currently aborts on the ghp data-source read. So the policy likely needs to be applied first (a targeted apply of just this `vault_policy`) before the agent can seed the KV path. The agent also still needs the actual `ghpsvc_` service token value provided out-of-band to write into `admin_token`. --------- Co-authored-by: BenVincent Co-authored-by: unkin-agent Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/128 Co-authored-by: Unkin Agent Co-committed-by: Unkin Agent --- .../syd1/secret_backend/ghp/config_write.yaml | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml diff --git a/policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml b/policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml new file mode 100644 index 0000000..578143b --- /dev/null +++ b/policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml @@ -0,0 +1,24 @@ +# Allow the agents AppRole to seed the ghp secrets engine's admin credentials. +# The ghp engine (managed by the tf_vault deployer) reads its ghpsvc_ service +# token from admin_token at ghp/config creation time; that key is currently +# unseeded, so the master apply aborts on the ghp data-source read. This grants +# the agents AppRole scoped write here so an agent can seed the value. Deployer +# read is already granted via policies/kv/service/vault/secret_backends_read.yaml, +# so this only adds the write side for the agents identity. +--- +rules: + # Seed value: admin_token (a ghpsvc_ service token). create/update to seed, + # read so the agent can verify what it wrote. No delete (least privilege). + - path: "kv/data/service/vault/au/syd1/secret_backend/ghp/config" + capabilities: + - create + - update + - read + # vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply. + - path: "kv/metadata/service/vault/au/syd1/secret_backend/ghp/config" + capabilities: + - read + +auth: + approle: + - agents