From 95927202ba030ff61cbf962750f90f8d277cd679 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 6 Aug 2026 22:25:38 +1000 Subject: [PATCH] Rename terraform-ipam CI Vault access -> terraform-infra (#111) Follows the `terraform-ipam` -> `terraform-infra` repo rename. Renames the k8s auth role (`woodpecker_terraform_infra`), consul secret-backend role + ACL policy (`terraform-infra`, state path `infra/terraform/infra/*`), consul creds read policy, and kv read policy (`kv/service/terraform/infra`). https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/111 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- ...rm_ipam.yaml => woodpecker_terraform_infra.yaml} | 2 +- .../{terraform-ipam.yaml => terraform-infra.yaml} | 2 +- .../consul_root/au/syd1/creds/terraform-infra.yaml | 11 +++++++++++ .../consul_root/au/syd1/creds/terraform-ipam.yaml | 11 ----------- policies/kv/service/terraform/infra.yaml | 13 +++++++++++++ policies/kv/service/terraform/ipam.yaml | 13 ------------- .../{terraform-ipam.hcl => terraform-infra.hcl} | 2 +- 7 files changed, 27 insertions(+), 27 deletions(-) rename config/auth_kubernetes_role/k8s/au/syd1/{woodpecker_terraform_ipam.yaml => woodpecker_terraform_infra.yaml} (89%) rename config/consul_secret_backend_role/consul_root/au/syd1/{terraform-ipam.yaml => terraform-infra.yaml} (72%) create mode 100644 policies/consul_root/au/syd1/creds/terraform-infra.yaml delete mode 100644 policies/consul_root/au/syd1/creds/terraform-ipam.yaml create mode 100644 policies/kv/service/terraform/infra.yaml delete mode 100644 policies/kv/service/terraform/ipam.yaml rename resources/secret_backend/consul_root/au/syd1/{terraform-ipam.hcl => terraform-infra.hcl} (62%) diff --git a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_ipam.yaml b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml similarity index 89% rename from config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_ipam.yaml rename to config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml index b2f6011..1beda15 100644 --- a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_ipam.yaml +++ b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml @@ -1,5 +1,5 @@ bound_service_account_names: - - terraform-ipam + - terraform-infra bound_service_account_namespaces: - woodpecker token_ttl: 600 diff --git a/config/consul_secret_backend_role/consul_root/au/syd1/terraform-ipam.yaml b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml similarity index 72% rename from config/consul_secret_backend_role/consul_root/au/syd1/terraform-ipam.yaml rename to config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml index c5d82f8..6d3954d 100644 --- a/config/consul_secret_backend_role/consul_root/au/syd1/terraform-ipam.yaml +++ b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml @@ -1,5 +1,5 @@ consul_roles: - - terraform-ipam + - terraform-infra ttl: 120 max_ttl: 300 datacenters: [] diff --git a/policies/consul_root/au/syd1/creds/terraform-infra.yaml b/policies/consul_root/au/syd1/creds/terraform-infra.yaml new file mode 100644 index 0000000..ecee6a8 --- /dev/null +++ b/policies/consul_root/au/syd1/creds/terraform-infra.yaml @@ -0,0 +1,11 @@ +--- +rules: + - path: "consul_root/au/syd1/creds/terraform-infra" + capabilities: + - read + +auth: + approle: + - terraform_infra + k8s/au/syd1: + - woodpecker_terraform_infra diff --git a/policies/consul_root/au/syd1/creds/terraform-ipam.yaml b/policies/consul_root/au/syd1/creds/terraform-ipam.yaml deleted file mode 100644 index b6e25b6..0000000 --- a/policies/consul_root/au/syd1/creds/terraform-ipam.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -rules: - - path: "consul_root/au/syd1/creds/terraform-ipam" - capabilities: - - read - -auth: - approle: - - terraform_ipam - k8s/au/syd1: - - woodpecker_terraform_ipam diff --git a/policies/kv/service/terraform/infra.yaml b/policies/kv/service/terraform/infra.yaml new file mode 100644 index 0000000..7524228 --- /dev/null +++ b/policies/kv/service/terraform/infra.yaml @@ -0,0 +1,13 @@ +# Allow the terraform-infra runner to read the NetBox + KeaAPI tokens +# (netbox_token / kea_token fields) used by the netbox and kea providers. +--- +rules: + - path: "kv/data/service/terraform/infra" + capabilities: + - read + +auth: + approle: + - terraform_infra + k8s/au/syd1: + - woodpecker_terraform_infra diff --git a/policies/kv/service/terraform/ipam.yaml b/policies/kv/service/terraform/ipam.yaml deleted file mode 100644 index 7572a05..0000000 --- a/policies/kv/service/terraform/ipam.yaml +++ /dev/null @@ -1,13 +0,0 @@ -# Allow the Terraform IPAM runner to read the NetBox + KeaAPI tokens -# (netbox_token / kea_token fields) used by the netbox and kea providers. ---- -rules: - - path: "kv/data/service/terraform/ipam" - capabilities: - - read - -auth: - approle: - - terraform_ipam - k8s/au/syd1: - - woodpecker_terraform_ipam diff --git a/resources/secret_backend/consul_root/au/syd1/terraform-ipam.hcl b/resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl similarity index 62% rename from resources/secret_backend/consul_root/au/syd1/terraform-ipam.hcl rename to resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl index 6f94b75..ff21a9f 100644 --- a/resources/secret_backend/consul_root/au/syd1/terraform-ipam.hcl +++ b/resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl @@ -1,4 +1,4 @@ -key_prefix "infra/terraform/ipam/" { +key_prefix "infra/terraform/infra/" { policy = "write" }