From d82580f1af241a02a341f13d5b1489043b46a393 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 27 Jul 2026 23:21:43 +1000 Subject: [PATCH] policies: grant terraform-git read on the gitea config KV metadata path (#103) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit terraform-git's main apply still fails after the skip_child_token fix (tfgit #48): the vault_kv_secret_v2 seed resource reads the kv-v2 metadata path during plan/apply, and the grant added in #102 covered kv/data only — Vault returns 403 on GET kv/metadata/.../secret_backend/gitea/config (terraform-git pipeline 107). This is the last blocker before the KV seed lands and terraform-vault #101 can apply. - add read on kv/metadata/service/vault/au/syd1/secret_backend/gitea/config to the terraform-git seed policy Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/103 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../vault/au/syd1/secret_backend/gitea/config_write.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml b/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml index 8847abe..d325a0b 100644 --- a/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml +++ b/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml @@ -12,6 +12,11 @@ rules: - create - read - update + # vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply + # (403 here broke the terraform-git main apply, pipeline 107). + - path: "kv/metadata/service/vault/au/syd1/secret_backend/gitea/config" + capabilities: + - read auth: approle: