From fa89757b03a97b9f88842aa31f8fc126b269c599 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 25 Oct 2026 15:15:01 +1100
Subject: [PATCH] Add artifactapi-writer OIDC role for Woodpecker uploads
 (#172)

Woodpecker pipelines need a Vault identity OIDC token with audience `artifactapi` to upload artifacts; only terraform-artifactapi can mint one today.

- add `artifactapi-writer` identity OIDC role (client_id artifactapi, ttl 900)
- add policy granting read on `identity/oidc/token/artifactapi-writer` to k8s role `woodpecker_artifactapi_writer`, vault admins via oidc/ldap
- add k8s auth role `woodpecker_artifactapi_writer` bound to woodpecker CI service accounts

Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/172
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 .../au/syd1/woodpecker_artifactapi_writer.yaml    | 15 +++++++++++++++
 .../artifactapi/artifactapi-writer.yaml           |  3 +++
 .../identity/oidc/token/artifactapi-writer.yaml   | 13 +++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml
 create mode 100644 config/identity_oidc_role/artifactapi/artifactapi-writer.yaml
 create mode 100644 policies/identity/oidc/token/artifactapi-writer.yaml

diff --git a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml
new file mode 100644
index 0000000..e34a967
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml
@@ -0,0 +1,15 @@
+bound_service_account_names:
+  - default
+  - arrproxy-ci
+  - autobackup-operator-ci
+  - ghp
+  - jellyfin-plugin-sso
+  - kea-operator-ci
+  - mediamark-ci
+  - plugin-docker-buildx
+  - repospawner-ci
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
diff --git a/config/identity_oidc_role/artifactapi/artifactapi-writer.yaml b/config/identity_oidc_role/artifactapi/artifactapi-writer.yaml
new file mode 100644
index 0000000..8970509
--- /dev/null
+++ b/config/identity_oidc_role/artifactapi/artifactapi-writer.yaml
@@ -0,0 +1,3 @@
+---
+client_id: artifactapi
+ttl: 900
diff --git a/policies/identity/oidc/token/artifactapi-writer.yaml b/policies/identity/oidc/token/artifactapi-writer.yaml
new file mode 100644
index 0000000..91f213f
--- /dev/null
+++ b/policies/identity/oidc/token/artifactapi-writer.yaml
@@ -0,0 +1,13 @@
+---
+rules:
+  - path: "identity/oidc/token/artifactapi-writer"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - woodpecker_artifactapi_writer
+  ldap:
+    - vault_admin
+  oidc:
+    - akP-vault-admin