From f3a3e4b8744070efce9a89b0ddd188818c41f92c Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 23:01:43 +1000 Subject: [PATCH] Grant terraform-authentik write on the kv/service/authentik subtree (#140) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why `kv/service/authentik/agent-api-token` is seeded by hand today. terraform-authentik should own it as IaC (`vault_kv_secret_v2`), along with any future Authentik automation tokens, but its runner identities only hold read on `kv/service/terraform/authentik` and the per-namespace oauth-credentials paths. This must land and **apply** first: an AppRole/k8s token's capabilities are fixed at login, so the companion terraform-authentik PR would fail its very first plan against a policy that is not yet live. ## How - Adds `policies/kv/service/authentik/write.yaml`, granting: - `kv/data/service/authentik/*` — create, read, update, delete - `kv/metadata/service/authentik/*` — read, list, delete - Assigned to the same identities that already hold the terraform-authentik read policy: approle `terraform_authentik` and `k8s/au/syd1` role `woodpecker_terraform_authentik`. - `delete` is included (unlike the `kv/kubernetes` agents grant) so `terraform destroy` and resource replacement clean up both the data and the metadata; metadata `read`/`list` is what `vault_kv_secret_v2` hits on every plan. - Scope note in the file header: the ask was to scope to `*-token` paths, but Vault ACL paths only support a trailing glob, so the whole `kv/service/authentik/` subtree is granted. terraform-authentik is the owner of everything under that prefix. - Existing `policies/kv/service/authentik/agent-api-token/read.yaml` (agents approle) is untouched. ## Order Merge + apply this first; the companion terraform-authentik PR merges only afterwards. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/140 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- policies/kv/service/authentik/write.yaml | 32 ++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 policies/kv/service/authentik/write.yaml diff --git a/policies/kv/service/authentik/write.yaml b/policies/kv/service/authentik/write.yaml new file mode 100644 index 0000000..5f9ee36 --- /dev/null +++ b/policies/kv/service/authentik/write.yaml @@ -0,0 +1,32 @@ +# Let the terraform-authentik runner manage the Authentik service KV subtree as +# IaC (vault_kv_secret_v2), starting with kv/service/authentik/agent-api-token, +# which is currently seeded by hand. +# +# Scoping: the ask was to grant only *-token paths, but Vault ACL paths support +# a trailing glob only (no infix/suffix wildcards), so the grant is the whole +# kv/service/authentik/ subtree. That is acceptable because terraform-authentik +# is the owner of every secret under kv/service/authentik/. +# +# delete is included (unlike the agents kv/kubernetes grant) so `terraform +# destroy` and resource replacement can remove a secret and its metadata +# cleanly; vault_kv_secret_v2 also reads the kv-v2 metadata path on every +# plan/apply, so metadata read/list is required for the plan to succeed. +--- +rules: + - path: "kv/data/service/authentik/*" + capabilities: + - create + - read + - update + - delete + - path: "kv/metadata/service/authentik/*" + capabilities: + - read + - list + - delete + +auth: + approle: + - terraform_authentik + k8s/au/syd1: + - woodpecker_terraform_authentik