From 67e79e72dcb3895516f288c216d5b8959a49d4af Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 30 Aug 2026 21:50:57 +1000 Subject: [PATCH] Grant the vault deployer read on the Authentik OIDC client secret (#146) **Why:** the terraform-vault deployer must read the OpenBao OIDC client credentials that Authentik's provider module generates before it can configure `auth/oidc`, and AppRole capabilities are fixed at login so the grant has to exist in a prior apply. **How:** - Add `policies/kv/service/authentik/oidc-vault/read.yaml`: read on `kv/data/service/authentik/oidc-vault` for the deployer identities (approle `tf_vault`, k8s/au/syd1 `woodpecker_terraform_vault`); `terraform_authentik` still owns the write side of `kv/service/authentik/*`. **Merge order:** this PR must merge and apply *before* the follow-up PR that adds the `auth/oidc` modules. OIDC becomes the default human auth path; approle/k8s (CI and agents) and break-glass are unchanged. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/146 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- .../kv/service/authentik/oidc-vault/read.yaml | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 policies/kv/service/authentik/oidc-vault/read.yaml diff --git a/policies/kv/service/authentik/oidc-vault/read.yaml b/policies/kv/service/authentik/oidc-vault/read.yaml new file mode 100644 index 0000000..df475d4 --- /dev/null +++ b/policies/kv/service/authentik/oidc-vault/read.yaml @@ -0,0 +1,21 @@ +# Let the terraform-vault deployer read the OpenBao OIDC client credentials that +# Authentik's provider module generates and writes here (terraform_authentik owns +# kv/service/authentik/* — see policies/kv/service/authentik/write.yaml). The +# deployer consumes client_id/client_secret to configure the auth/oidc backend. +# +# OIDC becomes the default human auth path; approle and k8s (CI and agents) plus +# the break-glass root path are unchanged. +# +# AppRole capabilities are fixed at login, so this grant must be applied before +# the PR that adds the auth/oidc modules. +--- +rules: + - path: "kv/data/service/authentik/oidc-vault" + capabilities: + - read + +auth: + approle: + - tf_vault + k8s/au/syd1: + - woodpecker_terraform_vault