unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policies: let terraform-authentik read its provider API token (#82)
ci/woodpecker/push/apply Pipeline was successful
Details

Browse Source 
## Why
terraform-authentik's provider needs an Authentik API token (`TF_VAR_authentik_token`), now sourced from Vault at `kv/service/terraform/authentik` (Makefile wiring in terraform-authentik #2). The CI role needs read access to that path.

## Change
Extend `policies/kv/service/terraform/authentik.yaml` to also grant read on `kv/data/service/terraform/authentik` for the `terraform_authentik` approle + `woodpecker_terraform_authentik` k8s role.

Reviewed-on: #82
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
This commit was merged in pull request #82.
This commit is contained in:
Ben Vincent
2026-07-06 23:41:03 +10:00
committed by BenVincent
parent f2c54888de
commit bbde79d2a6
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
policies/kv/service/terraform/authentik.yaml
+7 -4
View File
@@ -1,9 +1,12 @@
# Allow the Terraform Authentik runner to read OAuth2/OIDC client secrets that
# back authentik providers. Secrets live under each target service's kv
# namespace path (kv/kubernetes/namespace/<ns>/default/oauth-credentials) and
# are read by the module's data.vault_kv_secret_v2 lookups.
# Allow the Terraform Authentik runner to read:
# - its own Authentik API token (provider auth), and
# - OAuth2/OIDC client secrets that back authentik providers (per target
# service's kv namespace path, via the module's data.vault_kv_secret_v2).
---
rules:
- path: "kv/data/service/terraform/authentik"
capabilities:
- read
- path: "kv/data/kubernetes/namespace/+/default/oauth-credentials"
capabilities:
- read