Grant agents AppRole read on the Authentik provider token (#137)

A one-off `terragrunt import` in terraform-authentik is needed to reconcile the Authentik resources orphaned by the jellyfin apply failure. The agents AppRole must be able to read the Authentik provider token (`kv/service/terraform/authentik`) to run the import; this grant is read-only on that single path and can be reverted once the import is done. - Add `kv/service/terraform/authentik/read` policy (read on `kv/data/service/terraform/authentik`) bound to the `agents` AppRole Reviewed-on: #137 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
2026-08-23 22:34:31 +10:00
parent 57fe279d7a
commit 9fcd9d7ab5
1 changed files with 14 additions and 0 deletions
@@ -0,0 +1,14 @@
+# Lets the agents AppRole read the Authentik provider API token so a coding
+# agent can run a one-off `terragrunt import` in terraform-authentik to
+# reconcile resources orphaned by the failed jellyfin apply. Read-only on the
+# single token path; revert once the import is done. Mirrors the
+# gitea/creds/unkin-agent binding pattern.
+---
+rules:
+  - path: "kv/data/service/terraform/authentik"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - agents