From 7c7826997e0c883f16e51b3a5817debce8a05c41 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 12:56:06 +1000 Subject: [PATCH] Grant agents approle read on kv/service/authentik/agent-api-token (#139) ## Summary - Grants the agents approle read on kv/service/authentik/agent-api-token ## Why Automation seeds oauth client secrets and LDAP outpost tokens; fetching outpost tokens needs a scoped Authentik API token, seeded at this path by the operator. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/139 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- .../kv/service/authentik/agent-api-token/read.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 policies/kv/service/authentik/agent-api-token/read.yaml diff --git a/policies/kv/service/authentik/agent-api-token/read.yaml b/policies/kv/service/authentik/agent-api-token/read.yaml new file mode 100644 index 0000000..51a7a17 --- /dev/null +++ b/policies/kv/service/authentik/agent-api-token/read.yaml @@ -0,0 +1,14 @@ +# Lets the agents AppRole read a dedicated, scoped Authentik API token seeded by +# the operator. Automation seeds OAuth2 client secrets and LDAP outpost tokens as +# part of normal IaC workflows; fetching an outpost token requires calling the +# Authentik API, so a scoped token (not the CI admin credential) is read here. +# Mirrors the gitea/creds/unkin-agent agents-approle read grant pattern. +--- +rules: + - path: "kv/data/service/authentik/agent-api-token" + capabilities: + - read + +auth: + approle: + - agents