feat: add plan workflow

- update makefile to enable kubernetes auth or roleid auth
- add plan workflow
- update all policies to allow the terraform-vault kubernetes role

.woodpecker/plan.yaml

@@ -0,0 +1,21 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: plan
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260308
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make plan
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-vault
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/pre-commit.yaml

@@ -6,3 +6,13 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260308
     commands:
       - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

Makefile

@@ -1,10 +1,19 @@
 .PHONY: init plan apply format
 
+VAULT_AUTH_METHOD ?= approle
+VAULT_K8S_ROLE ?= woodpecker_terraform_vault
+VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
+VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
+
 # Define vault_env function to set up vault environment
 define vault_env
 	@export VAULT_ADDR="https://vault.service.consul:8200" && \
-	export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID) && \
+	if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
-	export CONSUL_HTTP_TOKEN=$$(vault read -format=json consul_root/au/syd1/creds/terraform-vault | jq '.data.token')
+		export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
+	else \
+		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
+	fi && \
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
 endef
 
 init:

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_vault.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-vault
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

policies/auth/approle/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/auth/approle/login.yaml

@@ -8,3 +8,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/auth/k8s/au/syd1/admin.yaml

@@ -21,3 +21,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/auth/ldap/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/auth/token/create.yaml

@@ -15,3 +15,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/auth/token/lookup.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/auth/token/renew.yaml

@@ -8,3 +8,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/auth/token/roles/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/auth/token/self.yaml

@@ -14,3 +14,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/consul_root/au/syd1/config/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/consul_root/au/syd1/creds/terraform-vault.yaml

@@ -8,3 +8,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/consul_root/au/syd1/roles/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kubernetes/au/config_admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kubernetes/au/roles_admin.yaml

@@ -15,3 +15,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kubernetes/au/syd1/creds/media-apps-operator.yaml

@@ -8,3 +8,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kv/config/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kv/service/glauth/services/svc_vault/read.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kv/service/kubernetes/au/syd1/service_account_jwt/read.yaml

@@ -8,3 +8,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kv/service/kubernetes/au/syd1/token_reviewer_jwt/read.yaml

@@ -8,3 +8,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kv/service/vault/auth_approle_roles_read.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kv/service/vault/auth_backends_read.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/kv/service/vault/secret_backends_read.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/pki/au/syd1/config/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/pki/au/syd1/issuer/admin.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/pki/au/syd1/roles/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/pki_int/config/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/pki_int/issuer/admin.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/pki_int/roles/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/pki_root/config/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/pki_root/issuer/admin.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/pki_root/roles/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/rundeck/config/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/sshca/config/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/sshca/roles/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/sys/auth/admin.yaml

@@ -12,3 +12,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/sys/mounts/admin.yaml

@@ -20,3 +20,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/sys/policy/admin.yaml

@@ -16,3 +16,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/transit/keys/admin.yaml

@@ -16,3 +16,5 @@ rules:
 auth:
   approle:
     - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault