18a62332f6
Merge pull request 'chore: enable access to openldap admin creds' ( #56 ) from benvin/ldap_admin_pass_terraform_ldap into master
...
Reviewed-on: #56
2026-02-15 20:17:35 +11:00
8fa68e2670
chore: enable access to openldap admin creds
...
- ensure terraform_ldap can read ldap admin credentials
2026-02-15 20:16:58 +11:00
4cad39989f
Merge pull request 'chore: add default_user_password credentials policy' ( #55 ) from benvin/openldap_default_pass into master
...
Reviewed-on: #55
2026-02-15 13:45:45 +11:00
c825962490
chore: add default_user_password credentials policy
...
- fix the comment for ldap_admin_password
- add policy to read default_user_password
2026-02-15 13:43:02 +11:00
51bc3fffc0
Merge pull request 'feat: add terraform-ldap service' ( #54 ) from benvin/terraform-ldap into master
...
Reviewed-on: #54
2026-02-15 13:40:32 +11:00
dca26029c0
feat: add terraform-ldap service
...
- add consul role/policy/acls to allow terraform-ldap state management
- add approle to generate tokens for consul
2026-02-15 13:38:31 +11:00
d398911108
Merge pull request 'fix: kubernetes auth fixes' ( #53 ) from benvin/kubernetes_fixes into master
...
Reviewed-on: #53
2026-02-15 13:08:43 +11:00
c093d5830d
fix: kubernetes auth fixes
...
- annotations as alias metadata does not work with openbao (idempotency issue)
- set token_ttl to be 600 for all auth roles for kubernetes (min)
2026-02-15 13:06:08 +11:00
4b176846f2
Merge pull request 'feat: add identity secrets' ( #52 ) from benvin/identity into master
...
Reviewed-on: #52
2026-02-15 13:02:01 +11:00
90b765d713
feat: add identity secrets
...
- add kubernetes auth role for identity namespace
- add policy to access openldap bootstrap credentials
2026-02-15 13:01:06 +11:00
3fb5a64a17
Merge pull request 'feat: add kubernetes ldap groups' ( #51 ) from benvin/kubernetes_ldap_groups into master
...
Reviewed-on: #51
2026-02-14 19:48:56 +11:00
33a746e545
feat: add kubernetes ldap groups
...
vault's terraform approle doesnt need to access all of these kubernetes
roles, it was just added as a placeholder and access to the kubernetes
roles was via the `vault_admin` to-much-access account. this is an
effort to roll back that and make access more targeted.
- add kubernetes* ldap groups for specific cluster/role combinations
- remove tf_vault from kubernetes* roles
2026-02-14 19:46:39 +11:00
4fe0e0de73
Merge pull request 'feat: add terraform_k8s approle' ( #50 ) from benvin/terraform_k8s_approle into master
...
Reviewed-on: #50
2026-02-14 19:38:46 +11:00
a47f841028
feat: add terraform_k8s approle
...
- add approle for kubernetes terraform
- ensure it can access consul token for state storage
- ensure it can generate root token for managing kubernetes
2026-02-14 19:37:22 +11:00
9192879c03
Merge pull request 'feat: use ephemeral consul token' ( #49 ) from benvin/use_consul_creds into master
...
Reviewed-on: #49
2026-02-14 18:59:56 +11:00
5cdf6b410d
feat: use ephemeral consul token
...
- add vault_env to makefile
- retrieve a consul_http_token on demand from vault
2026-02-14 18:59:05 +11:00
b51617c009
Merge pull request 'feat: implement consul ACL management with provider aliases' ( #48 ) from benvin/consul_backend into master
...
Reviewed-on: #48
2026-02-14 18:41:49 +11:00
66ee6430fa
Merge pull request 'feat: add tf_vault required policies' ( #47 ) from benvin/tf-vault-policy-updates into master
...
Reviewed-on: #47
2026-02-14 18:41:33 +11:00
fd03727ec2
feat: add tf_vault required policies
...
move management of Vault back to tf_vault approle. for this, we need to
create a number of policies that are missing.
- add policies to manage consul secret engines
- add policies to manage pki secret engines
- add policies to manage kv secret engines
- add policies to manage ssh secret engines
2026-02-14 18:39:21 +11:00
5536869a38
feat: implement consul ACL management with provider aliases
...
This commit message captures the major architectural change of implementing Consul ACL management
with proper provider aliasing, along with the supporting configuration files and policy definitions
for various terraform services.
- add consul_acl_management module to manage consul acl policies and roles
- add consul backend roles and policies for terraform services (incus, k8s, nomad, repoflow, vault)
- add consul provider configuration to root.hcl
- add policies to generate credentials for each role
- simplify consul_secret_backend_role module to reference acl-managed roles
- switch to opentofu for provider foreach support
- update terragrunt configuration to support consul backend aliases
- update pre-commit hooks to use opentofu instead of terraform
- configure tflint exceptions for consul acl management module
2026-02-14 18:13:50 +11:00
f8f1185b42
Merge pull request 'chore: add puppet k8s role' ( #46 ) from benvin/puppet_secrets into master
...
Reviewed-on: #46
2026-02-01 14:54:45 +11:00
75e9db1aa6
chore: add puppet k8s role
...
- add role and policies
2026-02-01 14:54:23 +11:00
f47804ffdf
Merge pull request 'chore: rancher pods use rancher service account' ( #45 ) from benvin/rancher_role into master
...
Reviewed-on: #45
2026-01-30 22:11:53 +11:00
24c124d6eb
chore: rancher pods use rancher service account
...
- update bound service account names to be `rancher`
- update namespace to cattle-system (do not run rancher in another namespace)
2026-01-30 22:11:08 +11:00
9d54b4cfcc
Merge pull request 'chore: add rancher role' ( #44 ) from benvin/rancher_role into master
...
Reviewed-on: #44
2026-01-30 19:46:19 +11:00
33af7010fb
chore: add rancher role
...
- add kubernetes role for rancher
- add policy to enable access to bootstrap-password
2026-01-30 19:43:06 +11:00
cb1b383035
Merge pull request 'feat: major restructuring in migration to terragrunt' ( #43 ) from benvin/vault_terragrunt into master
...
Reviewed-on: #43
2026-01-26 23:53:35 +11:00
f6d06cb319
chore: cleanup unused config data
...
- remove token_policies from roles config data, this comes from policies.hcl inputs
- remove policies from ldap groups
- remove backend data from roles, this comes from config.hcl inputs
2026-01-26 23:51:50 +11:00
1c9e063310
Merge branch 'master' into benvin/vault_terragrunt
2026-01-26 23:07:13 +11:00
8070b6f66b
feat: major restructuring in migration to terragrunt
...
- migrate from individual terraform files to config-driven terragrunt module structure
- add vault_cluster module with config discovery system
- replace individual .tf files with centralized config.hcl
- restructure auth and secret backends as configurable modules
- move auth roles and secret backends to yaml-based configuration
- convert policies from .hcl to .yaml format, add rules/auth definition
- add pre-commit hooks for yaml formatting and file cleanup
- add terragrunt cache to gitignore
- update makefile with terragrunt commands and format target
2026-01-26 23:02:44 +11:00
b115b7d28a
Merge pull request 'chore: add nzbget secrets' ( #42 ) from benvin/nzbget into master
...
Reviewed-on: #42
2026-01-26 18:31:48 +11:00
25e3d48337
chore: add nzbget secrets
...
- add policy for nzbget secrets
- enable the media-apps kubernetes role to use policy
2026-01-26 18:30:49 +11:00
fdc801739f
Merge pull request 'feat: add prowlarr access' ( #41 ) from benvin/prowlarr_policy into master
...
Reviewed-on: #41
2026-01-04 23:37:23 +11:00
56d858f900
feat: add prowlarr access
...
- enable kubernetes access to prowlarr secrets
2026-01-04 23:36:43 +11:00
bd112181f5
Merge pull request 'feat: add policy to read terraform vars' ( #40 ) from benvin/repoflow_terraform into master
...
Reviewed-on: #40
2025-12-13 10:57:33 +11:00
4f185d5e28
feat: add policy to read terraform vars
...
- read variables required for terraform-repoflow
2025-12-13 10:56:58 +11:00
65ad53e24c
Merge pull request 'feat: add repoflow service vault configuration' ( #39 ) from benvin/repoflow into master
...
Reviewed-on: #39
2025-12-13 10:13:33 +11:00
d217f6e42d
Merge pull request 'feat: add repoflow tokens' ( #38 ) from benvin/repoflow_tokens into master
...
Reviewed-on: #38
2025-12-13 10:10:07 +11:00
9814b8fc1a
feat: add repoflow tokens
...
- add approle for terraform-repoflow
- add policies to access repoflow tokens
2025-12-13 10:09:29 +11:00
7b81abfa9e
feat: add repoflow service vault configuration
...
- add secrets for s3, elasticsearch, hasura, postgres and repoflow
2025-12-13 09:20:58 +11:00
2466a6fe5c
Merge pull request 'feat: label kubernetes ephemeral serviceaccounts' ( #37 ) from benvin/k8s_roles_labelling into master
...
Reviewed-on: #37
2025-12-07 12:42:45 +11:00
c88b19a216
feat: label kubernetes ephemeral serviceaccounts
...
- ensure all service accounts are labelled with role/cluster
- add additional api endpoints to cluster roles
2025-12-07 12:41:37 +11:00
3bada72838
Merge pull request 'chore: allow long lines in yamllint' ( #36 ) from benvin/yamlint-args into master
...
Reviewed-on: #36
2025-12-01 21:51:11 +11:00
8961ba3748
chore: allow long lines in yamllint
2025-12-01 21:50:49 +11:00
26b3ee84d6
Merge pull request 'chore: fix policies for rpmbuilder' ( #35 ) from benvin/fix_rpmbuilder into master
...
Reviewed-on: #35
2025-11-30 21:24:52 +11:00
0776fac6eb
chore: fix policies for rpmbuilder
...
- missed the `/read` on the end
2025-11-30 21:24:06 +11:00
3a2ecc9b23
Merge pull request 'feat: add rpmbuilder approle' ( #34 ) from benvin/rpmbuilder into master
...
Reviewed-on: #34
2025-11-29 18:01:37 +11:00
5afd1ad9c1
feat: add rpmbuilder approle
...
- add rpmbuilder approle
- add policies to acces gitea/github read-only tokens
2025-11-29 18:00:20 +11:00
756286c231
chore: update name, role type for k8s
...
- ensure cluster roles are able to be created as ClusterRole
- prefix all vault managed roles with `vault-`
2025-11-29 00:09:57 +11:00
9cc482d471
Merge pull request 'feat: add kubernetes secrets engine with RBAC roles for au-syd1 cluster' ( #33 ) from benvin/au-syd1-k8s-roles into master
...
Reviewed-on: #33
2025-11-27 23:31:04 +11:00
