feat: add vault/consul config for media terraform repos (#79 )

Add Kubernetes auth roles, AppRole configs, Consul secret backend roles, Consul ACL policies, and Vault kv read policies for terraform-sonarr, terraform-radarr, and terraform-prowlarr. Reviewed-on: #79 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
Add auth and state access for terraform-authentik (#78 )
2026-06-28 22:03:25 +10:00 · 2026-06-28 01:17:51 +10:00 · 2026-06-17 21:42:25 +10:00 · 2026-06-08 22:56:30 +10:00 · 2026-06-08 15:17:58 +10:00 · 2026-06-07 20:36:35 +10:00
41 changed files with 296 additions and 4 deletions
@@ -0,0 +1,23 @@
 when:
  - event: push
    branch: master
 steps:
  - name: apply
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
    commands:
      - dnf install vault -y
      - make plan
      - make apply
    backend_options:
      kubernetes:
        serviceAccountName: terraform-vault
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2
@@ -3,10 +3,11 @@ when:
 steps:
  - name: plan
-    image: git.unkin.net/unkin/almalinux9-opentofu:20260308
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
    commands:
      - dnf install vault -y
      - make plan
    backend_options:
      kubernetes:
@@ -3,7 +3,7 @@ when:
 steps:
  - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-opentofu:20260308
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    commands:
      - uvx pre-commit run --all-files
    backend_options:
@@ -13,7 +13,7 @@ define vault_env
 	else \
 		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
 	fi && \
-	export CONSUL_HTTP_TOKEN=$$(vault read -format=json consul_root/au/syd1/creds/terraform-vault | jq '.data.token')
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
 endef
 init:
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-artifactapi
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-authentik
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-git
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-prowlarr
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-radarr
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-sonarr
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -4,4 +4,4 @@ bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
-audience: vault
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-artifactapi
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-authentik
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-git
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-prowlarr
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-radarr
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-sonarr
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -21,3 +21,5 @@ rules:
 auth:
  approle:
    - tf_vault
  k8s/au/syd1:
    - woodpecker_terraform_vault
@@ -0,0 +1,11 @@
 ---
 rules:
  - path: "consul_root/au/syd1/creds/terraform-artifactapi"
    capabilities:
      - read
 auth:
  approle:
    - terraform_artifactapi
  k8s/au/syd1:
    - woodpecker_terraform_artifactapi
@@ -0,0 +1,11 @@
 ---
 rules:
  - path: "consul_root/au/syd1/creds/terraform-authentik"
    capabilities:
      - read
 auth:
  approle:
    - terraform_authentik
  k8s/au/syd1:
    - woodpecker_terraform_authentik
@@ -0,0 +1,11 @@
 ---
 rules:
  - path: "consul_root/au/syd1/creds/terraform-git"
    capabilities:
      - read
 auth:
  approle:
    - terraform_git
  k8s/au/syd1:
    - woodpecker_terraform_git
@@ -0,0 +1,11 @@
 ---
 rules:
  - path: "consul_root/au/syd1/creds/terraform-prowlarr"
    capabilities:
      - read
 auth:
  approle:
    - terraform_prowlarr
  k8s/au/syd1:
    - woodpecker_terraform_prowlarr
@@ -0,0 +1,11 @@
 ---
 rules:
  - path: "consul_root/au/syd1/creds/terraform-radarr"
    capabilities:
      - read
 auth:
  approle:
    - terraform_radarr
  k8s/au/syd1:
    - woodpecker_terraform_radarr
@@ -0,0 +1,11 @@
 ---
 rules:
  - path: "consul_root/au/syd1/creds/terraform-sonarr"
    capabilities:
      - read
 auth:
  approle:
    - terraform_sonarr
  k8s/au/syd1:
    - woodpecker_terraform_sonarr
@@ -0,0 +1,12 @@
 # Allow reading Gitea admin token
 ---
 rules:
  - path: "kv/data/service/gitea/gitadmin/tokens/terraform-git"
    capabilities:
      - read
 auth:
  approle:
    - terraform_git
  k8s/au/syd1:
    - woodpecker_terraform_git
@@ -6,5 +6,8 @@ rules:
      - read
 auth:
  approle:
    - terraform_prowlarr
  k8s/au/syd1:
    - media-apps
    - woodpecker_terraform_prowlarr
@@ -6,5 +6,8 @@ rules:
      - read
 auth:
  approle:
    - terraform_radarr
  k8s/au/syd1:
    - media-apps
    - woodpecker_terraform_radarr
@@ -6,5 +6,8 @@ rules:
      - read
 auth:
  approle:
    - terraform_sonarr
  k8s/au/syd1:
    - media-apps
    - woodpecker_terraform_sonarr
@@ -0,0 +1,11 @@
 ---
 rules:
  - path: "kv/data/service/woodpecker/tokens/gitadmin"
    capabilities:
      - read
 auth:
  approle:
    - terraform_git
  k8s/au/syd1:
    - woodpecker_terraform_git
@@ -0,0 +1,7 @@
 key_prefix "infra/terraform/artifactapi/" {
  policy = "write"
 }
 session_prefix "" {
  policy = "write"
 }
@@ -0,0 +1,7 @@
 key_prefix "infra/terraform/authentik/" {
  policy = "write"
 }
 session_prefix "" {
  policy = "write"
 }
@@ -0,0 +1,7 @@
 key_prefix "infra/terraform/git/" {
  policy = "write"
 }
 session_prefix "" {
  policy = "write"
 }
@@ -0,0 +1,7 @@
 key_prefix "infra/terraform/prowlarr/" {
  policy = "write"
 }
 session_prefix "" {
  policy = "write"
 }
@@ -0,0 +1,7 @@
 key_prefix "infra/terraform/radarr/" {
  policy = "write"
 }
 session_prefix "" {
  policy = "write"
 }
@@ -0,0 +1,7 @@
 key_prefix "infra/terraform/sonarr/" {
  policy = "write"
 }
 session_prefix "" {
  policy = "write"
 }
Author	SHA1	Message	Date
unkinben	36d7afbb65	feat: add vault/consul config for media terraform repos (#79 ) ci/woodpecker/push/apply Pipeline was successful Details Add Kubernetes auth roles, AppRole configs, Consul secret backend roles, Consul ACL policies, and Vault kv read policies for terraform-sonarr, terraform-radarr, and terraform-prowlarr. Reviewed-on: #79 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 22:03:25 +10:00
unkinben	c33dcdc447	Add auth and state access for terraform-authentik (#78 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - K8s auth role for Woodpecker CI (`terraform-authentik` SA in `woodpecker` namespace) - AppRole for local terraform runs - Consul secret backend role (`terraform-authentik`, TTL 120/300) - Consul ACL policy for `infra/terraform/authentik/` key prefix - Vault policy granting both auth methods access to Consul creds Reviewed-on: #78 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 01:17:51 +10:00
benvin	be9bd96cf3	feat: enable consul state store for artifactapi (#77 ) ci/woodpecker/push/apply Pipeline was successful Details enable the terraform-artifactapi system to manage its state in consul using dynamic credentials from kubernetes ci jobs in woodpecker --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #77	2026-06-17 21:42:25 +10:00
unkinben	bb5f6922fa	feat: add vault policy for terraform-git webhook secrets (#75 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - Add read policy for kv/data/service/gitea/webhook/* path - Assigned to terraform_git approle and woodpecker_terraform_git k8s auth role - Webhook URLs are stored in Vault KV and read at plan/apply time ## Test plan - [ ] Verify terragrunt plan succeeds for terraform-git after merge Reviewed-on: #75 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-08 22:56:30 +10:00
benvin	346cf9fa43	feat: manage gitadmin token (#74 ) ci/woodpecker/push/apply Pipeline was successful Details - add approle for terraform-git - add policy to read gitadmin token - update access to the terraform-git consul token --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #74	2026-06-08 15:17:58 +10:00
unkinben	1288057b81	feat: add vault and consul roles for terraform-git (#73 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - Add K8s auth role woodpecker_terraform_git for CI pipeline authentication - Add consul secret backend role terraform-git for consul state storage tokens - Add consul ACL policy granting write access to infra/terraform/git/ key prefix - Add vault policy for reading consul creds at consul_root/au/syd1/creds/terraform-git ## Test plan - [ ] Verify terragrunt plan succeeds - [ ] Verify consul ACL policy is created correctly - [ ] Verify K8s auth role can authenticate from woodpecker namespace Reviewed-on: #73 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-07 20:36:35 +10:00
unkinben	3876fa818d	chore: bump almalinux9 image tags (#72 ) ci/woodpecker/push/apply Pipeline was successful Details Bump almalinux9 image tags to 20260606 Reviewed-on: #72 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-07 00:35:30 +10:00
unkinben	a548bf1cb1	fix: apply requires plan (#71 ) ci/woodpecker/push/apply Pipeline was successful Details - ensure make plan runs before make apply when deploying Reviewed-on: #71	2026-05-22 00:03:08 +10:00
unkinben	93ba86baf3	feat: add apply workflow (#70 ) ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #70	2026-05-21 23:57:25 +10:00
unkinben	098830c10b	Merge pull request 'feat: add plan workflow' (#69 ) from benvin/make-plan-buildwq into master Reviewed-on: #69	2026-05-21 23:54:07 +10:00
unkinben	9cbac6d3ef	feat: add plan workflow ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details - update makefile to enable kubernetes auth or roleid auth - add plan workflow - update all policies to allow the terraform-vault kubernetes role	2026-05-21 23:52:30 +10:00