feat: add vault/consul config for media terraform repos (#79 )

Add Kubernetes auth roles, AppRole configs, Consul secret backend roles, Consul ACL policies, and Vault kv read policies for terraform-sonarr, terraform-radarr, and terraform-prowlarr. Reviewed-on: #79 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
Add auth and state access for terraform-authentik (#78 )
2026-06-28 22:03:25 +10:00 · 2026-06-28 01:17:51 +10:00 · 2026-06-17 21:42:25 +10:00 · 2026-06-08 22:56:30 +10:00
24 changed files with 176 additions and 0 deletions
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-authentik
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-prowlarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-radarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-sonarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-authentik
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-prowlarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-radarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-sonarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-authentik"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_authentik
+  k8s/au/syd1:
+    - woodpecker_terraform_authentik
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-prowlarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_prowlarr
+  k8s/au/syd1:
+    - woodpecker_terraform_prowlarr
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-radarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_radarr
+  k8s/au/syd1:
+    - woodpecker_terraform_radarr
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-sonarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_sonarr
+  k8s/au/syd1:
+    - woodpecker_terraform_sonarr
@@ -6,5 +6,8 @@ rules:
      - read

 auth:
+  approle:
+    - terraform_prowlarr
  k8s/au/syd1:
    - media-apps
+    - woodpecker_terraform_prowlarr
@@ -6,5 +6,8 @@ rules:
      - read

 auth:
+  approle:
+    - terraform_radarr
  k8s/au/syd1:
    - media-apps
+    - woodpecker_terraform_radarr
@@ -6,5 +6,8 @@ rules:
      - read

 auth:
+  approle:
+    - terraform_sonarr
  k8s/au/syd1:
    - media-apps
+    - woodpecker_terraform_sonarr
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "kv/data/service/woodpecker/tokens/gitadmin"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_git
+  k8s/au/syd1:
+    - woodpecker_terraform_git
@@ -0,0 +1,7 @@
+key_prefix "infra/terraform/authentik/" {
+  policy = "write"
+}
+
+session_prefix "" {
+  policy = "write"
+}
@@ -0,0 +1,7 @@
+key_prefix "infra/terraform/prowlarr/" {
+  policy = "write"
+}
+
+session_prefix "" {
+  policy = "write"
+}
@@ -0,0 +1,7 @@
+key_prefix "infra/terraform/radarr/" {
+  policy = "write"
+}
+
+session_prefix "" {
+  policy = "write"
+}
@@ -0,0 +1,7 @@
+key_prefix "infra/terraform/sonarr/" {
+  policy = "write"
+}
+
+session_prefix "" {
+  policy = "write"
+}
Author	SHA1	Message	Date
unkinben	36d7afbb65	feat: add vault/consul config for media terraform repos (#79 ) ci/woodpecker/push/apply Pipeline was successful Details Add Kubernetes auth roles, AppRole configs, Consul secret backend roles, Consul ACL policies, and Vault kv read policies for terraform-sonarr, terraform-radarr, and terraform-prowlarr. Reviewed-on: #79 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 22:03:25 +10:00
unkinben	c33dcdc447	Add auth and state access for terraform-authentik (#78 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - K8s auth role for Woodpecker CI (`terraform-authentik` SA in `woodpecker` namespace) - AppRole for local terraform runs - Consul secret backend role (`terraform-authentik`, TTL 120/300) - Consul ACL policy for `infra/terraform/authentik/` key prefix - Vault policy granting both auth methods access to Consul creds Reviewed-on: #78 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 01:17:51 +10:00
benvin	be9bd96cf3	feat: enable consul state store for artifactapi (#77 ) ci/woodpecker/push/apply Pipeline was successful Details enable the terraform-artifactapi system to manage its state in consul using dynamic credentials from kubernetes ci jobs in woodpecker --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #77	2026-06-17 21:42:25 +10:00
unkinben	bb5f6922fa	feat: add vault policy for terraform-git webhook secrets (#75 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - Add read policy for kv/data/service/gitea/webhook/* path - Assigned to terraform_git approle and woodpecker_terraform_git k8s auth role - Webhook URLs are stored in Vault KV and read at plan/apply time ## Test plan - [ ] Verify terragrunt plan succeeds for terraform-git after merge Reviewed-on: #75 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-08 22:56:30 +10:00