Grant agents approle read on kv/service/authentik/agent-api-token (#139)

## Summary - Grants the agents approle read on kv/service/authentik/agent-api-token ## Why Automation seeds oauth client secrets and LDAP outpost tokens; fetching outpost tokens needs a scoped Authentik API token, seeded at this path by the operator. Reviewed-on: #139 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
2026-08-29 12:56:06 +10:00
parent 36d2b99255
commit 7c7826997e
1 changed files with 14 additions and 0 deletions
@@ -0,0 +1,14 @@
+# Lets the agents AppRole read a dedicated, scoped Authentik API token seeded by
+# the operator. Automation seeds OAuth2 client secrets and LDAP outpost tokens as
+# part of normal IaC workflows; fetching an outpost token requires calling the
+# Authentik API, so a scoped token (not the CI admin credential) is read here.
+# Mirrors the gitea/creds/unkin-agent agents-approle read grant pattern.
+---
+rules:
+  - path: "kv/data/service/authentik/agent-api-token"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - agents