3 Commits

Author	SHA1	Message	Date
unkinben	9c35b41ab1	policies: let terraform-git seed the gitea engine admin credential to KV ... Why: terraform-git now provisions the gitea-vault-admin site-admin bot and writes its generated password to kv/service/vault/au/syd1/secret_backend/gitea/config so the gitea secrets engine can consume it at creation time. The woodpecker_terraform_git / terraform_git identity has no write access to that KV path, so its apply would 403 without this grant. The deployer that reads the seed already has read via policies/kv/service/vault/secret_backends_read.yaml. Change: - Add policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml granting create/read/update on the gitea config KV path to the terraform_git approle and woodpecker_terraform_git k8s role. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv	2026-07-27 19:29:41 +10:00
unkinben	9cbac6d3ef	feat: add plan workflow ... - update makefile to enable kubernetes auth or roleid auth - add plan workflow - update all policies to allow the terraform-vault kubernetes role	2026-05-21 23:52:30 +10:00
unkinben	8070b6f66b	feat: major restructuring in migration to terragrunt ... - migrate from individual terraform files to config-driven terragrunt module structure - add vault_cluster module with config discovery system - replace individual .tf files with centralized config.hcl - restructure auth and secret backends as configurable modules - move auth roles and secret backends to yaml-based configuration - convert policies from .hcl to .yaml format, add rules/auth definition - add pre-commit hooks for yaml formatting and file cleanup - add terragrunt cache to gitignore - update makefile with terragrunt commands and format target	2026-01-26 23:02:44 +11:00