Add auth and state access for terraform-rancher (#86 )

## Why The new `terraform-rancher` repo (manages Rancher's Authentik OIDC auth via the rancher2 provider) needs Vault auth + Consul state, mirroring the terraform-authentik runner (#78/#81/#82). ## Change - `AppRole/terraform_rancher` + k8s auth role `woodpecker_terraform_rancher` (SA terraform-rancher in the woodpecker ns). - Consul secret-backend role + ACL policy (`resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl`) granting write to the `infra/terraform/rancher/` state prefix. - Vault policies: read the Rancher admin API token (`kv/service/terraform/rancher`) and the keycloakoidc client secret (`kv/kubernetes/namespace/cattle-system/default/oauth-credentials`), plus the consul_root state creds. Scoped the OAuth read to the `cattle-system` path specifically (rather than the `+` wildcard the authentik policy uses) since the Rancher runner only needs its own app's secret. ## Validation pre-commit (terragrunt-hcl-fmt + yamllint) passed. CI plan will confirm. Reviewed-on: #86 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
chore: update litellm address (#85 )
2026-07-15 21:37:45 +10:00 · 2026-07-09 23:47:32 +10:00 · 2026-07-07 20:10:43 +10:00 · 2026-07-07 00:18:29 +10:00 · 2026-07-06 23:41:03 +10:00 · 2026-07-06 23:05:20 +10:00
168 changed files with 1175 additions and 66 deletions
@@ -0,0 +1,23 @@
 when:
  - event: push
    branch: master
 steps:
  - name: apply
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
    commands:
      - dnf install vault -y
      - make plan
      - make apply
    backend_options:
      kubernetes:
        serviceAccountName: terraform-vault
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2
@@ -0,0 +1,21 @@
 when:
  - event: pull_request
 steps:
  - name: plan
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
    commands:
      - dnf install vault -y
      - make plan
    backend_options:
      kubernetes:
        serviceAccountName: terraform-vault
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2
@@ -0,0 +1,18 @@
 when:
  - event: pull_request
 steps:
  - name: pre-commit
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    commands:
      - uvx pre-commit run --all-files
    backend_options:
      kubernetes:
        serviceAccountName: default
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2
@@ -1,10 +1,19 @@
 .PHONY: init plan apply format
 VAULT_AUTH_METHOD ?= approle
 VAULT_K8S_ROLE ?= woodpecker_terraform_vault
 VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
 VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
 # Define vault_env function to set up vault environment
 define vault_env
 	@export VAULT_ADDR="https://vault.service.consul:8200" && \
-	export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID) && \
+	if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
-	export CONSUL_HTTP_TOKEN=$$(vault read -format=json consul_root/au/syd1/creds/terraform-vault | jq '.data.token')
+		export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
 	else \
 		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
 	fi && \
 	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
 endef
 init:
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -1,5 +1,5 @@
 kubernetes_host: https://api-k8s.service.consul:6443
 disable_iss_validation: true
-use_annotations_as_alias_metadata: true
+use_annotations_as_alias_metadata: false # doesnt work with openbao yet
 default_lease_ttl: 1h
 max_lease_ttl: 24h
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - artifactapi
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -4,5 +4,6 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - csi-cephrbd
  - csi-cephfs
-token_ttl: 60
+token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,5 +2,6 @@ bound_service_account_names:
  - cert-manager-vault-issuer
 bound_service_account_namespaces:
  - cert-manager
-token_ttl: 60
+token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -0,0 +1,6 @@
 bound_service_account_names:
  - default
 bound_service_account_namespaces: ['*']
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,5 +2,6 @@ bound_service_account_names:
  - externaldns
 bound_service_account_namespaces:
  - externaldns
-token_ttl: 60
+token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,5 +2,5 @@ bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - huntarr
-token_ttl: 60
+token_ttl: 600
 audience: vault
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - identity
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,5 +2,6 @@ bound_service_account_names:
  - media-apps-vault-reader
 bound_service_account_namespaces:
  - media-apps
-token_ttl: 60
+token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,5 +2,6 @@ bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - puppet
-token_ttl: 60
+token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,5 +2,6 @@ bound_service_account_names:
  - rancher
 bound_service_account_namespaces:
  - cattle-system
-token_ttl: 60
+token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,5 +2,6 @@ bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - repoflow
-token_ttl: 60
+token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -0,0 +1,8 @@
 # rpmbuilder is deployed in woodpeckerci
 bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-artifactapi
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-authentik
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-git
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-prowlarr
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-radarr
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-rancher
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-sonarr
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-vault
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,3 @@
 ---
 # this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
 description: foo
@@ -0,0 +1,3 @@
 ---
 # this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
 description: foo
@@ -0,0 +1,3 @@
 ---
 # this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
 description: foo
@@ -185,5 +185,18 @@ locals {
      trimsuffix(basename(file_path), ".yaml") => content
      if startswith(file_path, "pki_mount_only/")
    }
    litellm_secret_backend = {
      for file_path, content in local.all_configs :
      trimsuffix(basename(file_path), ".yaml") => content
      if startswith(file_path, "litellm_secret_backend/")
    }
    litellm_secret_backend_role = {
      for file_path, content in local.all_configs :
      trimsuffix(replace(file_path, "litellm_secret_backend_role/", ""), ".yaml") => merge(content, {
        name    = trimsuffix(basename(file_path), ".yaml")
        backend = dirname(replace(file_path, "litellm_secret_backend_role/", ""))
      })
      if startswith(file_path, "litellm_secret_backend_role/")
    }
  }
 }
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-artifactapi
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-authentik
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-git
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-ldap
 ttl: 60
 max_ttl: 60
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-prowlarr
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-radarr
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-rancher
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-sonarr
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,6 @@
 # Mounts the LiteLLM dynamic secrets engine at "litellm" and writes its config.
 # The master key is sensitive and read from KV, not stored here:
 #   kv/service/vault/au/syd1/secret_backend/litellm -> key "master_key"
 description: "LiteLLM dynamic virtual keys"
 base_url: "https://litellm.k8s.syd1.au.unkin.net"
 request_timeout_seconds: 30
@@ -0,0 +1,9 @@
 ---
 models:
  - claude-opus-4-7
 max_budget: 5
 ttl: 3600      # seconds (1h)
 max_ttl: 86400 # seconds (24h)
 metadata:
  team: testuser
  env: prod
@@ -0,0 +1,10 @@
 ---
 models:
  - claude-haiku-4-5
  - claude-sonnet-4-6
 max_budget: 50
 ttl: 3600      # seconds (1h)
 max_ttl: 86400 # seconds (24h)
 metadata:
  team: mailfiltering
  env: prod
@@ -68,6 +68,8 @@ inputs = {
  kubernetes_secret_backend      = local.config.kubernetes_secret_backend
  kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role
  pki_mount_only                 = local.config.pki_mount_only
  litellm_secret_backend         = local.config.litellm_secret_backend
  litellm_secret_backend_role    = local.config.litellm_secret_backend_role
  # Pass policy maps to vault_cluster module
  policy_auth_map  = local.policies.policy_auth_map
@@ -11,6 +11,12 @@ provider "vault" {
  address = local.vault_addr
 }
 # The LiteLLM secrets engine is managed through its own provider, which talks to
 # the same Vault server. Token falls back to the VAULT_TOKEN environment variable.
 provider "litellm" {
  address = local.vault_addr
 }
 terraform {
  backend "consul" {
    address = "https://consul.service.consul"
@@ -29,6 +35,10 @@ terraform {
      source  = "hashicorp/consul"
      version = "2.23.0"
    }
    litellm = {
      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
      version = "0.1.0"
    }
  }
 }
 EOF
@@ -0,0 +1,11 @@
 rule "terraform_required_providers" {
  enabled = false
 }
 rule "terraform_required_version" {
  enabled = false
 }
 rule "terraform_unused_declarations" {
  enabled = false
 }
@@ -3,8 +3,6 @@ module "auth_approle_backend" {
  for_each = var.auth_approle_backend
  country            = var.country
  region             = var.region
  path               = each.key
  listing_visibility = each.value.listing_visibility
  default_lease_ttl  = each.value.default_lease_ttl
@@ -92,6 +90,7 @@ module "auth_kubernetes_role" {
  bound_service_account_names      = each.value.bound_service_account_names
  bound_service_account_namespaces = each.value.bound_service_account_namespaces
  token_ttl                        = each.value.token_ttl
  token_max_ttl                    = each.value.token_max_ttl
  token_policies                   = var.policy_auth_map[each.value.backend][each.value.role_name]
  audience                         = each.value.audience
@@ -185,7 +184,6 @@ module "pki_secret_backend" {
  crl_distribution_points       = each.value.crl_distribution_points
  ocsp_servers                  = each.value.ocsp_servers
  enable_templating             = each.value.enable_templating
  default_issuer_ref            = each.value.default_issuer_ref
  default_follows_latest_issuer = each.value.default_follows_latest_issuer
  crl_expiry                    = each.value.crl_expiry
  crl_disable                   = each.value.crl_disable
@@ -267,7 +265,6 @@ module "consul_secret_backend_role" {
  name    = each.value.name
  backend = each.value.backend
  consul_roles = each.value.consul_roles
  ttl     = each.value.ttl
  max_ttl = each.value.max_ttl
  local   = each.value.local
@@ -306,6 +303,37 @@ module "kubernetes_secret_backend_role" {
  depends_on = [module.kubernetes_secret_backend]
 }
 module "litellm_secret_backend" {
  source = "./modules/litellm_secret_backend"
  for_each = var.litellm_secret_backend
  country                 = var.country
  region                  = var.region
  path                    = each.key
  plugin                  = each.value.plugin
  description             = each.value.description
  base_url                = each.value.base_url
  request_timeout_seconds = each.value.request_timeout_seconds
 }
 module "litellm_secret_backend_role" {
  source = "./modules/litellm_secret_backend_role"
  for_each = var.litellm_secret_backend_role
  name             = each.value.name
  backend          = each.value.backend
  models           = each.value.models
  max_budget       = each.value.max_budget
  key_alias_prefix = each.value.key_alias_prefix
  ttl              = each.value.ttl
  max_ttl          = each.value.max_ttl
  metadata         = each.value.metadata
  depends_on = [module.litellm_secret_backend]
 }
 module "vault_policy" {
  source = "./modules/vault_policy"
@@ -323,7 +351,6 @@ module "pki_mount_only" {
  path                          = each.key
  description                   = each.value.description
  max_lease_ttl_seconds         = each.value.max_lease_ttl_seconds
  issuer_ref                    = each.value.issuer_ref
  issuing_certificates          = each.value.issuing_certificates
  crl_distribution_points       = each.value.crl_distribution_points
  ocsp_servers                  = each.value.ocsp_servers
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -1,13 +1,3 @@
 variable "country" {
  description = "Country identifier"
  type        = string
 }
 variable "region" {
  description = "Region identifier"
  type        = string
 }
 variable "path" {
  description = "Mount path of the AppRole auth backend"
  type        = string
@@ -16,7 +16,7 @@ data "vault_kv_secret_v2" "role_config" {
 locals {
  salt                  = data.vault_kv_secret_v2.salt_config.data["salt"]
  role_id_input         = "${local.salt}-${var.approle_name}-${var.mount_path}"
-  deterministic_role_id = uuidv5("dns", "${local.role_id_input}")
+  deterministic_role_id = uuidv5("dns", local.role_id_input)
  # Use deterministic role-id by default, or read from KV if specified
  role_id = var.use_deterministic_role_id ? local.deterministic_role_id : data.vault_kv_secret_v2.role_config[0].data["role_id"]
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -4,6 +4,7 @@ resource "vault_kubernetes_auth_backend_role" "role" {
  bound_service_account_names      = var.bound_service_account_names
  bound_service_account_namespaces = var.bound_service_account_namespaces
  token_ttl                        = var.token_ttl
  token_max_ttl                    = var.token_max_ttl
  token_policies                   = var.token_policies
  audience                         = var.audience
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -24,6 +24,12 @@ variable "token_ttl" {
  default     = 3600
 }
 variable "token_max_ttl" {
  description = "The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time."
  type        = number
  default     = 86400
 }
 variable "token_policies" {
  description = "List of policies to assign to the role (passed from policy_auth_map)"
  type        = list(string)
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,13 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
    consul = {
      source  = "hashicorp/consul"
      version = "2.23.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -9,12 +9,6 @@ variable "name" {
 }
 variable "consul_roles" {
  description = "List of Consul roles to attach to tokens"
  type        = list(string)
  default     = []
 }
 variable "ttl" {
  description = "TTL for generated tokens"
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,14 @@
 # Expected keys in KV secret: master_key
 data "vault_kv_secret_v2" "secret_backend_config" {
  mount = "kv"
  name  = "service/vault/${var.country}/${var.region}/secret_backend/${var.path}"
 }
 resource "litellm_secret_backend" "this" {
  path                    = var.path
  plugin                  = var.plugin
  description             = var.description
  base_url                = var.base_url
  master_key              = data.vault_kv_secret_v2.secret_backend_config.data["master_key"]
  request_timeout_seconds = var.request_timeout_seconds
 }
@@ -0,0 +1,13 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
    litellm = {
      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
      version = "0.1.0"
    }
  }
 }
@@ -0,0 +1,37 @@
 variable "country" {
  description = "Country identifier (used to locate the KV secret holding the master key)"
  type        = string
 }
 variable "region" {
  description = "Region identifier (used to locate the KV secret holding the master key)"
  type        = string
 }
 variable "path" {
  description = "Mount path of the LiteLLM secrets engine"
  type        = string
 }
 variable "plugin" {
  description = "Registered plugin name/type to mount"
  type        = string
  default     = "vault-plugin-secrets-litellm"
 }
 variable "description" {
  description = "Human-friendly description of the mount"
  type        = string
  default     = null
 }
 variable "base_url" {
  description = "Base URL of the LiteLLM proxy (e.g. http://litellm.litellm.svc:4000)"
  type        = string
 }
 variable "request_timeout_seconds" {
  description = "HTTP timeout in seconds for calls from the plugin to the LiteLLM proxy"
  type        = number
  default     = 30
 }
@@ -0,0 +1,10 @@
 resource "litellm_secret_backend_role" "this" {
  backend          = var.backend
  name             = var.name
  models           = var.models
  max_budget       = var.max_budget
  key_alias_prefix = var.key_alias_prefix
  ttl              = var.ttl
  max_ttl          = var.max_ttl
  metadata         = var.metadata
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    litellm = {
      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
      version = "0.1.0"
    }
  }
 }
@@ -0,0 +1,45 @@
 variable "name" {
  description = "Name of the role"
  type        = string
 }
 variable "backend" {
  description = "Mount path of the LiteLLM secrets engine this role belongs to"
  type        = string
 }
 variable "models" {
  description = "Models a generated key may access. Empty means unrestricted"
  type        = list(string)
  default     = null
 }
 variable "max_budget" {
  description = "Spending limit applied to each generated key. 0 means unlimited"
  type        = number
  default     = null
 }
 variable "key_alias_prefix" {
  description = "Prefix for the auto-generated key alias"
  type        = string
  default     = null
 }
 variable "ttl" {
  description = "Default lease TTL in seconds for keys generated from this role"
  type        = number
  default     = null
 }
 variable "max_ttl" {
  description = "Maximum lease TTL in seconds for keys generated from this role"
  type        = number
  default     = null
 }
 variable "metadata" {
  description = "Metadata attached to each generated key"
  type        = map(string)
  default     = null
 }
@@ -5,11 +5,6 @@ resource "vault_mount" "pki" {
  max_lease_ttl_seconds = var.max_lease_ttl_seconds
 }
 data "vault_pki_secret_backend_issuer" "issuer" {
  backend    = vault_mount.pki.path
  issuer_ref = var.issuer_ref
 }
 resource "vault_pki_secret_backend_config_urls" "config_urls" {
  backend = vault_mount.pki.path
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -13,11 +13,6 @@ variable "max_lease_ttl_seconds" {
  type        = number
 }
 variable "issuer_ref" {
  description = "Reference to the PKI issuer (default, or issuer ID/name)"
  type        = string
  default     = "default"
 }
 variable "issuing_certificates" {
  description = "List of URLs for issuing certificates"
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -61,12 +61,6 @@ variable "enable_templating" {
  default     = false
 }
 variable "default_issuer_ref" {
  description = "Reference to the default issuer"
  type        = string
  default     = null
 }
 variable "default_follows_latest_issuer" {
  description = "Whether the default issuer should follow the latest issuer"
  type        = bool
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -83,6 +83,7 @@ variable "auth_kubernetes_role" {
    bound_service_account_names      = list(string)
    bound_service_account_namespaces = list(string)
    token_ttl                        = optional(number, 3600)
    token_max_ttl                    = optional(number, 86400)
    audience                         = optional(string, "vault")
  }))
  default = {}
@@ -165,7 +166,6 @@ variable "pki_secret_backend" {
    crl_distribution_points       = optional(list(string), [])
    ocsp_servers                  = optional(list(string), [])
    enable_templating             = optional(bool, false)
    default_issuer_ref            = optional(string)
    default_follows_latest_issuer = optional(bool, false)
    crl_expiry                    = optional(string, "72h")
    crl_disable                   = optional(bool, false)
@@ -203,7 +203,6 @@ variable "pki_mount_only" {
  type = map(object({
    description                   = optional(string)
    max_lease_ttl_seconds         = optional(number, 315360000)
    issuer_ref                    = optional(string, "default")
    issuing_certificates          = optional(list(string), [])
    crl_distribution_points       = optional(list(string), [])
    ocsp_servers                  = optional(list(string), [])
@@ -290,6 +289,32 @@ variable "kubernetes_secret_backend_role" {
  default = {}
 }
 variable "litellm_secret_backend" {
  description = "Map of LiteLLM secret engines to create (mount + config). The master key is read from KV"
  type = map(object({
    plugin                  = optional(string, "vault-plugin-secrets-litellm")
    description             = optional(string)
    base_url                = string
    request_timeout_seconds = optional(number, 30)
  }))
  default = {}
 }
 variable "litellm_secret_backend_role" {
  description = "Map of LiteLLM roles to create"
  type = map(object({
    name             = string
    backend          = string
    models           = optional(list(string))
    max_budget       = optional(number)
    key_alias_prefix = optional(string)
    ttl              = optional(number)
    max_ttl          = optional(number)
    metadata         = optional(map(string))
  }))
  default = {}
 }
 variable "policy_auth_map" {
  description = "Map of auth mounts -> auth roles -> policy names"
  type        = map(map(list(string)))
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -8,3 +8,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -21,3 +21,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -15,3 +15,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -9,3 +9,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -8,3 +8,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -14,3 +14,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -0,0 +1,11 @@
 ---
 rules:
  - path: "consul_root/au/syd1/creds/terraform-artifactapi"
    capabilities:
      - read
 auth:
  approle:
    - terraform_artifactapi
  k8s/au/syd1:
    - woodpecker_terraform_artifactapi
@@ -0,0 +1,11 @@
 ---
 rules:
  - path: "consul_root/au/syd1/creds/terraform-authentik"
    capabilities:
      - read
 auth:
  approle:
    - terraform_authentik
  k8s/au/syd1:
    - woodpecker_terraform_authentik
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
unkinben	8bb071ae46	Add auth and state access for terraform-rancher (#86 ) ci/woodpecker/push/apply Pipeline was successful Details ## Why The new `terraform-rancher` repo (manages Rancher's Authentik OIDC auth via the rancher2 provider) needs Vault auth + Consul state, mirroring the terraform-authentik runner (#78/#81/#82). ## Change - `AppRole/terraform_rancher` + k8s auth role `woodpecker_terraform_rancher` (SA terraform-rancher in the woodpecker ns). - Consul secret-backend role + ACL policy (`resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl`) granting write to the `infra/terraform/rancher/` state prefix. - Vault policies: read the Rancher admin API token (`kv/service/terraform/rancher`) and the keycloakoidc client secret (`kv/kubernetes/namespace/cattle-system/default/oauth-credentials`), plus the consul_root state creds. Scoped the OAuth read to the `cattle-system` path specifically (rather than the `+` wildcard the authentik policy uses) since the Rancher runner only needs its own app's secret. ## Validation pre-commit (terragrunt-hcl-fmt + yamllint) passed. CI plan will confirm. Reviewed-on: #86 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-15 21:37:45 +10:00
benvin	0dba5e00a6	chore: update litellm address (#85 ) ci/woodpecker/push/apply Pipeline was successful Details - update litellm address - add a test role --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #85	2026-07-09 23:47:32 +10:00
unkinben	a400e5dc7e	fix: grant vault deployer access to manage the litellm engine (#84 ) ci/woodpecker/push/apply Pipeline was successful Details ## Why Applying the newly-merged litellm mount (#83) failed at apply time with: ``` Error: failed to write litellm config URL: PUT https://vault.service.consul:8200/v1/litellm/config Code: 403. * permission denied ``` The deployer identity (`tf_vault` approle / `woodpecker_terraform_vault` k8s role) can enable the mount via `sys/mounts/admin`, but no policy grants it access to the engine's own data paths, so writing the config and roles is denied. ## Changes - Add `policies/litellm/admin.yaml` granting `create`/`read`/`update`/`delete` on `litellm/config` and `litellm/roles/*` (plus `read`/`list` on `litellm/roles`), assigned to the same auth roles as the other secret-engine admin policies (`tf_vault`, `woodpecker_terraform_vault`). ## Note The policy attaches to the deployer's auth roles, so it takes effect on the next token issuance — a re-run of the apply (fresh Vault login) will have the permission and can write `litellm/config` and the roles. Reviewed-on: #84 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-07 20:10:43 +10:00
unkinben	95e7a81b2e	feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret (#83 ) ci/woodpecker/push/apply Pipeline failed Details ## Why The `vault-plugin-secrets-litellm` engine (mints LiteLLM virtual keys) is registered in Vault, but nothing in this repo declared its mount, config, or roles. This wires in the companion `litellm` provider (`git.unkin.net/unkin/litellmvaultsecret`) so the mount is managed as code alongside the other secret backends. ## Changes - Add `litellm_secret_backend` module that mounts the engine and writes its config (`base_url`, `request_timeout_seconds`); reads the sensitive `master_key` from KV at `kv/service/vault/<country>/<region>/secret_backend/<path>`, matching the consul/kubernetes backend convention. - Add `litellm_secret_backend_role` module that manages roles (`models`, `max_budget`, `key_alias_prefix`, `ttl`/`max_ttl` in seconds, `metadata`). - Register both modules in `vault_cluster` `main.tf` and add typed variables in `variables.tf`. - Discover `litellm_secret_backend[_role]` YAML in `config.hcl` and pass the maps through the terragrunt inputs. - Declare the `litellm` provider (pinned `0.1.0`) and a `provider "litellm"` block in the generated root `backend.tf`. - Add example config for the `litellm` mount and a sample `team-a` role. ## Notes - Requires the `master_key` KV secret to exist at `kv/service/vault/au/syd1/secret_backend/litellm` before apply (the module reads it, does not create it). - Assumes provider `git.unkin.net/unkin/litellmvaultsecret` `0.1.0` is published to the artifactapi `terraform-unkin` registry. Reviewed-on: #83 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-07 00:18:29 +10:00
unkinben	bbde79d2a6	policies: let terraform-authentik read its provider API token (#82 ) ci/woodpecker/push/apply Pipeline was successful Details ## Why terraform-authentik's provider needs an Authentik API token (`TF_VAR_authentik_token`), now sourced from Vault at `kv/service/terraform/authentik` (Makefile wiring in terraform-authentik #2). The CI role needs read access to that path. ## Change Extend `policies/kv/service/terraform/authentik.yaml` to also grant read on `kv/data/service/terraform/authentik` for the `terraform_authentik` approle + `woodpecker_terraform_authentik` k8s role. Reviewed-on: #82 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-06 23:41:03 +10:00
unkinben	f2c54888de	policies: let terraform-authentik read oauth client secrets from kv (#81 ) ci/woodpecker/push/apply Pipeline was successful Details ## Why terraform-authentik now reads OAuth2 client secrets from Vault (`data.vault_kv_secret_v2`) rather than committing them (terraform-authentik #2). But the `terraform_authentik` approle / `woodpecker_terraform_authentik` k8s role only had the consul-creds policy, so `plan` fails with permission denied on the grafana oauth path. ## Change Add `policies/kv/service/terraform/authentik.yaml` granting read on `kv/data/kubernetes/namespace/+/default/oauth-credentials` for both the approle and the woodpecker k8s role. Reviewed-on: #81 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-06 23:05:20 +10:00
unkinben	36d7afbb65	feat: add vault/consul config for media terraform repos (#79 ) ci/woodpecker/push/apply Pipeline was successful Details Add Kubernetes auth roles, AppRole configs, Consul secret backend roles, Consul ACL policies, and Vault kv read policies for terraform-sonarr, terraform-radarr, and terraform-prowlarr. Reviewed-on: #79 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 22:03:25 +10:00
unkinben	c33dcdc447	Add auth and state access for terraform-authentik (#78 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - K8s auth role for Woodpecker CI (`terraform-authentik` SA in `woodpecker` namespace) - AppRole for local terraform runs - Consul secret backend role (`terraform-authentik`, TTL 120/300) - Consul ACL policy for `infra/terraform/authentik/` key prefix - Vault policy granting both auth methods access to Consul creds Reviewed-on: #78 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 01:17:51 +10:00
benvin	be9bd96cf3	feat: enable consul state store for artifactapi (#77 ) ci/woodpecker/push/apply Pipeline was successful Details enable the terraform-artifactapi system to manage its state in consul using dynamic credentials from kubernetes ci jobs in woodpecker --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #77	2026-06-17 21:42:25 +10:00
unkinben	bb5f6922fa	feat: add vault policy for terraform-git webhook secrets (#75 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - Add read policy for kv/data/service/gitea/webhook/* path - Assigned to terraform_git approle and woodpecker_terraform_git k8s auth role - Webhook URLs are stored in Vault KV and read at plan/apply time ## Test plan - [ ] Verify terragrunt plan succeeds for terraform-git after merge Reviewed-on: #75 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-08 22:56:30 +10:00
benvin	346cf9fa43	feat: manage gitadmin token (#74 ) ci/woodpecker/push/apply Pipeline was successful Details - add approle for terraform-git - add policy to read gitadmin token - update access to the terraform-git consul token --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #74	2026-06-08 15:17:58 +10:00
unkinben	1288057b81	feat: add vault and consul roles for terraform-git (#73 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - Add K8s auth role woodpecker_terraform_git for CI pipeline authentication - Add consul secret backend role terraform-git for consul state storage tokens - Add consul ACL policy granting write access to infra/terraform/git/ key prefix - Add vault policy for reading consul creds at consul_root/au/syd1/creds/terraform-git ## Test plan - [ ] Verify terragrunt plan succeeds - [ ] Verify consul ACL policy is created correctly - [ ] Verify K8s auth role can authenticate from woodpecker namespace Reviewed-on: #73 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-07 20:36:35 +10:00
unkinben	3876fa818d	chore: bump almalinux9 image tags (#72 ) ci/woodpecker/push/apply Pipeline was successful Details Bump almalinux9 image tags to 20260606 Reviewed-on: #72 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-07 00:35:30 +10:00
unkinben	a548bf1cb1	fix: apply requires plan (#71 ) ci/woodpecker/push/apply Pipeline was successful Details - ensure make plan runs before make apply when deploying Reviewed-on: #71	2026-05-22 00:03:08 +10:00
unkinben	93ba86baf3	feat: add apply workflow (#70 ) ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #70	2026-05-21 23:57:25 +10:00
unkinben	098830c10b	Merge pull request 'feat: add plan workflow' (#69 ) from benvin/make-plan-buildwq into master Reviewed-on: #69	2026-05-21 23:54:07 +10:00
unkinben	9cbac6d3ef	feat: add plan workflow ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details - update makefile to enable kubernetes auth or roleid auth - add plan workflow - update all policies to allow the terraform-vault kubernetes role	2026-05-21 23:52:30 +10:00
unkinben	73aaaaeb99	Merge pull request 'chore: enable access to gateway.networking.k8s.io' (#68 ) from benvin/gatewayapi into master Reviewed-on: #68	2026-05-21 22:42:28 +10:00
unkinben	7c60a5fd53	chore: enable access to gateway.networking.k8s.io ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-05-21 22:39:57 +10:00
unkinben	27f12f183e	Merge pull request 'chore: change to specific ci image' (#67 ) from benvin/ci_image into master Reviewed-on: #67	2026-03-09 01:16:59 +11:00
unkinben	c61434b692	chore: change to specific ci image ci/woodpecker/pr/pre-commit Pipeline was successful Details - almalinux9-opentofu image contains all required tools	2026-03-09 01:14:41 +11:00
unkinben	172ceac2fc	Merge pull request 'feat: add templated policies for kubernetes' (#66 ) from benvin/kubernetes_structured_paths into master Reviewed-on: #66	2026-03-08 12:57:58 +11:00
unkinben	48a4fd0dd1	feat: add templated policies for kubernetes ci/woodpecker/pr/pre-commit Pipeline was successful Details - add default kubernetes auth role - add templated access kv/kubernetes/*	2026-03-08 12:48:08 +11:00
unkinben	4dc09547ef	Merge pull request 'fix: update audience for rpmbuilder' (#65 ) from benvin/default_aud into master Reviewed-on: #65	2026-03-08 12:29:43 +11:00
unkinben	546a9efe44	fix: update audience for rpmbuilder ci/woodpecker/pr/pre-commit Pipeline was successful Details when using using the service account jwt directly, the default audience is the api servers url	2026-03-07 11:31:36 +11:00
unkinben	679cec4bc1	Merge pull request 'feat: add rpmbuilder k8s role' (#64 ) from benvin/rpmbuilder-in-k8s into master Reviewed-on: #64	2026-03-07 11:11:23 +11:00
unkinben	71789f9f32	feat: add rpmbuilder k8s role ci/woodpecker/pr/pre-commit Pipeline was successful Details - create rpmbuilder role - enable access to gitea/github ro-tokens - enable access to rpmbuilder role from woodpeckerci	2026-03-07 11:06:27 +11:00
unkinben	4cbcec58d3	Merge pull request 'feat: enable woodpecker access to ro tokens' (#63 ) from benvin/woodpecker_task_access into master Reviewed-on: #63	2026-03-07 10:52:38 +11:00
unkinben	9c93e185f8	feat: enable woodpecker access to ro tokens ci/woodpecker/pr/pre-commit Pipeline was successful Details - enable woodpecker tasks to access gitea/github read-only tokens	2026-03-07 10:49:39 +11:00
unkinben	d6c8474bd3	Merge pull request 'chore: move pgsql password to vault' (#62 ) from benvin/artifactapi_postgrespassword into master Reviewed-on: #62	2026-03-06 19:51:25 +11:00
unkinben	42351000ee	chore: move pgsql password to vault ci/woodpecker/pr/pre-commit Pipeline was successful Details - no more storing secrets in configmaps	2026-03-06 19:39:36 +11:00
unkinben	f7d1330c37	Merge pull request 'chore: add artifactapi k8s role' (#61 ) from benvin/artifactapi into master Reviewed-on: #61	2026-03-06 18:57:05 +11:00
unkinben	d9e07e432e	chore: add artifactapi k8s role ci/woodpecker/pr/pre-commit Pipeline was successful Details - enable access to read artifactapi secrets	2026-03-06 18:53:42 +11:00
unkinben	14a258de7d	Merge pull request 'chore: enable access woodpecker-agent-secret' (#60 ) from benvin/woodpecker_agent_secret into master Reviewed-on: #60	2026-03-03 23:34:32 +11:00
unkinben	be8bcc3743	chore: enable access woodpecker-agent-secret ci/woodpecker/pr/pre-commit Pipeline was successful Details - add policy to access woodpecker-agent-secret	2026-03-03 23:30:49 +11:00
unkinben	dc257b1bcd	Merge pull request 'feat: add pre-commit check in ci' (#59 ) from benvin/woodpecker_integration into master Reviewed-on: #59	2026-02-28 22:28:21 +11:00
unkinben	66119e5207	feat: add pre-commit check in ci ci/woodpecker/pr/pre-commit Pipeline was successful Details - add a ci workflow to verify pre-commit passes - fix pre-commit errors/warnings: - missing required_version - missing required_providers - fixed terraform_deprecated_interpolation - removed terraform_unused_declarations	2026-02-28 21:42:47 +11:00
unkinben	9e6de4dc32	Merge pull request 'feat: set max token life for auth_kubernetes_role' (#58 ) from benvin/token_max_ttl into master Reviewed-on: #58	2026-02-22 22:30:18 +11:00
unkinben	7cafafd483	feat: set max token life for auth_kubernetes_role found kubernetes vaultauth resources never picking up new policies, because they would infinitely renew their token. - set default max token length for roles to 1 day - changed all existing role token_max_ttl to match their token_ttl	2026-02-22 22:28:21 +11:00
unkinben	c94b2af196	Merge pull request 'feat: add woodpecker secrets' (#57 ) from benvin/woodpecker into master Reviewed-on: #57	2026-02-22 22:27:50 +11:00
unkinben	dd44146d88	feat: add woodpecker secrets - add secrets required to integrate woodpecker into gitea/pgsql	2026-02-22 22:27:30 +11:00
unkinben	18a62332f6	Merge pull request 'chore: enable access to openldap admin creds' (#56 ) from benvin/ldap_admin_pass_terraform_ldap into master Reviewed-on: #56	2026-02-15 20:17:35 +11:00
unkinben	8fa68e2670	chore: enable access to openldap admin creds - ensure terraform_ldap can read ldap admin credentials	2026-02-15 20:16:58 +11:00
unkinben	4cad39989f	Merge pull request 'chore: add default_user_password credentials policy' (#55 ) from benvin/openldap_default_pass into master Reviewed-on: #55	2026-02-15 13:45:45 +11:00
unkinben	c825962490	chore: add default_user_password credentials policy - fix the comment for ldap_admin_password - add policy to read default_user_password	2026-02-15 13:43:02 +11:00
unkinben	51bc3fffc0	Merge pull request 'feat: add terraform-ldap service' (#54 ) from benvin/terraform-ldap into master Reviewed-on: #54	2026-02-15 13:40:32 +11:00
unkinben	dca26029c0	feat: add terraform-ldap service - add consul role/policy/acls to allow terraform-ldap state management - add approle to generate tokens for consul	2026-02-15 13:38:31 +11:00
unkinben	d398911108	Merge pull request 'fix: kubernetes auth fixes' (#53 ) from benvin/kubernetes_fixes into master Reviewed-on: #53	2026-02-15 13:08:43 +11:00
unkinben	c093d5830d	fix: kubernetes auth fixes - annotations as alias metadata does not work with openbao (idempotency issue) - set token_ttl to be 600 for all auth roles for kubernetes (min)	2026-02-15 13:06:08 +11:00
unkinben	4b176846f2	Merge pull request 'feat: add identity secrets' (#52 ) from benvin/identity into master Reviewed-on: #52	2026-02-15 13:02:01 +11:00
unkinben	90b765d713	feat: add identity secrets - add kubernetes auth role for identity namespace - add policy to access openldap bootstrap credentials	2026-02-15 13:01:06 +11:00
unkinben	3fb5a64a17	Merge pull request 'feat: add kubernetes ldap groups' (#51 ) from benvin/kubernetes_ldap_groups into master Reviewed-on: #51	2026-02-14 19:48:56 +11:00
unkinben	33a746e545	feat: add kubernetes ldap groups vault's terraform approle doesnt need to access all of these kubernetes roles, it was just added as a placeholder and access to the kubernetes roles was via the `vault_admin` to-much-access account. this is an effort to roll back that and make access more targeted. - add kubernetes* ldap groups for specific cluster/role combinations - remove tf_vault from kubernetes* roles	2026-02-14 19:46:39 +11:00