From fc1c7121eeb26af24af4b8dffe08b8a7f26a87bd Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 30 Aug 2026 17:33:47 +1000 Subject: [PATCH] Bump vault-secrets-arrstack provider to 0.2.0 and plumb methods Engine plugin v0.2.0 (catalog bumped in #144) added a methods field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods. Provider v0.2.0 exposes it as an optional set attribute, but the module had no input for it, so no role yaml could use it. - Bumps the vault-secrets-arrstack provider pin from 0.1.1 to 0.2.0 in root.hcl and both arrstack modules - Adds an optional methods input to arrstack_secret_backend_role and passes it through to the resource - Threads methods through the vault_cluster arrstack_secret_backend_role object type so a role yaml may carry a methods: list methods defaults to null rather than [], matching the provider's null read-back for an unrestricted role, so existing role yamls need no change and plan stays a provider-version-only diff. --- environments/root.hcl | 2 +- modules/vault_cluster/main.tf | 1 + .../modules/arrstack_secret_backend/terraform.tf | 2 +- .../modules/arrstack_secret_backend_role/main.tf | 1 + .../modules/arrstack_secret_backend_role/terraform.tf | 2 +- .../modules/arrstack_secret_backend_role/variables.tf | 7 +++++++ modules/vault_cluster/variables.tf | 1 + 7 files changed, 13 insertions(+), 3 deletions(-) diff --git a/environments/root.hcl b/environments/root.hcl index dcc54c5..0233a7f 100644 --- a/environments/root.hcl +++ b/environments/root.hcl @@ -67,7 +67,7 @@ terraform { } arrstack = { source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack" - version = "0.1.1" + version = "0.2.0" } } } diff --git a/modules/vault_cluster/main.tf b/modules/vault_cluster/main.tf index 0ac715f..d31e35c 100644 --- a/modules/vault_cluster/main.tf +++ b/modules/vault_cluster/main.tf @@ -370,6 +370,7 @@ module "arrstack_secret_backend_role" { name = each.value.name backend = each.value.backend apps = each.value.apps + methods = each.value.methods ttl = each.value.ttl max_ttl = each.value.max_ttl diff --git a/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf b/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf index a16f196..6ab0265 100644 --- a/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf +++ b/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf @@ -7,7 +7,7 @@ terraform { } arrstack = { source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack" - version = "0.1.1" + version = "0.2.0" } } } diff --git a/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf b/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf index 17bc124..90d93c9 100644 --- a/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf +++ b/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf @@ -2,6 +2,7 @@ resource "arrstack_secret_backend_role" "this" { backend = var.backend name = var.name apps = var.apps + methods = var.methods ttl = var.ttl max_ttl = var.max_ttl } diff --git a/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf b/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf index b158d4b..cb0e7c0 100644 --- a/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf +++ b/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf @@ -3,7 +3,7 @@ terraform { required_providers { arrstack = { source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack" - version = "0.1.1" + version = "0.2.0" } } } diff --git a/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf b/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf index 022e978..c79ebd7 100644 --- a/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf +++ b/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf @@ -13,6 +13,13 @@ variable "apps" { type = list(string) } +variable "methods" { + description = "HTTP methods a generated key is limited to (subset of GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS). Null leaves the role unrestricted" + type = set(string) + # null, not [], so a role yaml that omits methods matches the provider's null read-back and shows no drift. + default = null +} + variable "ttl" { description = "Default lease TTL in seconds for keys generated from this role" type = number diff --git a/modules/vault_cluster/variables.tf b/modules/vault_cluster/variables.tf index 9b59df5..9fc6f2f 100644 --- a/modules/vault_cluster/variables.tf +++ b/modules/vault_cluster/variables.tf @@ -334,6 +334,7 @@ variable "arrstack_secret_backend_role" { name = string backend = string apps = list(string) + methods = optional(set(string)) ttl = optional(number) max_ttl = optional(number) }))