3 Commits

Author	SHA1	Message	Date
unkin-agent	a19256fdba	Grant the vault deployer sudo to enable the oidc auth mount (#149) ... ## Why The deployer identities cannot enable the `oidc` auth mount: `POST /v1/sys/auth/oidc` returns 403 because `sys/auth/<path>` (and its `/tune`) is sudo-protected, and `policies/sys/auth/admin.yaml` granted create/update/delete/read/list without `sudo`. ## How - Add exact-path rules for `sys/auth/oidc` and `sys/auth/oidc/tune` to `policies/sys/auth/admin.yaml` with the wildcard's capability set plus `sudo` (exact match wins over the glob, so the set is repeated in full); auth block unchanged. Merge order: apply this, then re-run the master apply so `module.auth_oidc_backend["oidc"]` can create the mount. Reviewed-on: #149 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-08-31 22:21:01 +10:00
unkinben	9cbac6d3ef	feat: add plan workflow ... - update makefile to enable kubernetes auth or roleid auth - add plan workflow - update all policies to allow the terraform-vault kubernetes role	2026-05-21 23:52:30 +10:00
unkinben	8070b6f66b	feat: major restructuring in migration to terragrunt ... - migrate from individual terraform files to config-driven terragrunt module structure - add vault_cluster module with config discovery system - replace individual .tf files with centralized config.hcl - restructure auth and secret backends as configurable modules - move auth roles and secret backends to yaml-based configuration - convert policies from .hcl to .yaml format, add rules/auth definition - add pre-commit hooks for yaml formatting and file cleanup - add terragrunt cache to gitignore - update makefile with terragrunt commands and format target	2026-01-26 23:02:44 +11:00