From 7a6aa7e2ecd0520d06ce793437c3dab4cd726893 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 12:08:26 +1000 Subject: [PATCH] Grant agents approle read on kv/service/authentik/agent-api-token Automation seeds oauth client secrets and LDAP outpost tokens; fetching outpost tokens needs a scoped Authentik API token, seeded at this path by the operator. --- .../kv/service/authentik/agent-api-token/read.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 policies/kv/service/authentik/agent-api-token/read.yaml diff --git a/policies/kv/service/authentik/agent-api-token/read.yaml b/policies/kv/service/authentik/agent-api-token/read.yaml new file mode 100644 index 0000000..51a7a17 --- /dev/null +++ b/policies/kv/service/authentik/agent-api-token/read.yaml @@ -0,0 +1,14 @@ +# Lets the agents AppRole read a dedicated, scoped Authentik API token seeded by +# the operator. Automation seeds OAuth2 client secrets and LDAP outpost tokens as +# part of normal IaC workflows; fetching an outpost token requires calling the +# Authentik API, so a scoped token (not the CI admin credential) is read here. +# Mirrors the gitea/creds/unkin-agent agents-approle read grant pattern. +--- +rules: + - path: "kv/data/service/authentik/agent-api-token" + capabilities: + - read + +auth: + approle: + - agents