From d2c8b3d18c15fcb249c42b29e2b5ef33a0f6cb41 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 6 Jul 2026 23:32:49 +1000 Subject: [PATCH] policies: let terraform-authentik read its provider API token Grant the terraform_authentik approle / woodpecker_terraform_authentik k8s role read on kv/data/service/terraform/authentik so the Makefile can export TF_VAR_authentik_token for the authentik provider. --- policies/kv/service/terraform/authentik.yaml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/policies/kv/service/terraform/authentik.yaml b/policies/kv/service/terraform/authentik.yaml index 29adda4..466d4a6 100644 --- a/policies/kv/service/terraform/authentik.yaml +++ b/policies/kv/service/terraform/authentik.yaml @@ -1,9 +1,12 @@ -# Allow the Terraform Authentik runner to read OAuth2/OIDC client secrets that -# back authentik providers. Secrets live under each target service's kv -# namespace path (kv/kubernetes/namespace//default/oauth-credentials) and -# are read by the module's data.vault_kv_secret_v2 lookups. +# Allow the Terraform Authentik runner to read: +# - its own Authentik API token (provider auth), and +# - OAuth2/OIDC client secrets that back authentik providers (per target +# service's kv namespace path, via the module's data.vault_kv_secret_v2). --- rules: + - path: "kv/data/service/terraform/authentik" + capabilities: + - read - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials" capabilities: - read