From 9e18627567b6d8f689553d93a9fa594290b5f773 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 12 Sep 2026 13:19:56 +1000 Subject: [PATCH] Grant the agents approle read+write on the woodpecker agent token (#151) Agents query the Woodpecker API to inspect pipeline runs and failing steps while reviewing PRs. That token is currently pasted into agent config by hand, so it lives in plaintext on disk instead of in Vault. - add `policies/kv/service/woodpecker/tokens/agents.yaml` - grant the `agents` approle create/read/update on `kv/data/service/woodpecker/tokens/agents` - grant read/list on the matching metadata path; no delete, mirroring the `kv/kubernetes/*` grant Token seeding follows once this is applied. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/151 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- .../kv/service/woodpecker/tokens/agents.yaml | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 policies/kv/service/woodpecker/tokens/agents.yaml diff --git a/policies/kv/service/woodpecker/tokens/agents.yaml b/policies/kv/service/woodpecker/tokens/agents.yaml new file mode 100644 index 0000000..f083f8c --- /dev/null +++ b/policies/kv/service/woodpecker/tokens/agents.yaml @@ -0,0 +1,21 @@ +# Lets the agents AppRole read and maintain a dedicated Woodpecker API token. +# Agents query the Woodpecker API to inspect pipeline runs and failing steps when +# reviewing PRs; today that token is pasted into agent config by hand. Granting +# create/update as well as read lets automation seed and rotate it in place, +# mirroring the agents-approle grant on kv/kubernetes/*. delete is excluded, as +# it is there. +--- +rules: + - path: "kv/data/service/woodpecker/tokens/agents" + capabilities: + - create + - read + - update + - path: "kv/metadata/service/woodpecker/tokens/agents" + capabilities: + - read + - list + +auth: + approle: + - agents