unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/terraform-vault:f5803605d61e68781c6f806cdef439b31fbc725c
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:benvin/litellm-secrets-engine unkin/terraform-vault:feature/forgebot-vault-access
...
compare: unkin/terraform-vault:feature/forgebot-vault-access
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:benvin/litellm-secrets-engine unkin/terraform-vault:feature/forgebot-vault-access

3 Commits
f5803605d6 ... feature/forgebot-vault-access

Author SHA1 Message Date
unkinben 65f844cbe1 Fix: add policy binding for forgebot K8s auth role
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details 
Every K8s auth role needs at least one entry in the policy_auth_map.
Add a policy granting the forgebot role read access to the namespace-
scoped KV path, which the operator SA needs when authenticating with
the forgebot role instead of the default role.
 2026-06-08 23:00:35 +10:00
benvin b9632f39e4 Merge branch 'master' into feature/forgebot-vault-access
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details
2026-06-08 22:57:54 +10:00
unkinben bb5f6922fa feat: add vault policy for terraform-git webhook secrets (#75)
ci/woodpecker/push/apply Pipeline was successful
Details 
## Summary
- Add read policy for kv/data/service/gitea/webhook/* path
- Assigned to terraform_git approle and woodpecker_terraform_git k8s auth role
- Webhook URLs are stored in Vault KV and read at plan/apply time

## Test plan
- [ ] Verify terragrunt plan succeeds for terraform-git after merge

Reviewed-on: #75
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
 2026-06-08 22:56:30 +10:00
1 changed files with 9 additions and 0 deletions
Expand all files Collapse all files
policies/kv/service/forgebot/config/read.yaml
+9
View File
@@ -0,0 +1,9 @@
---
rules:
- path: "kv/data/kubernetes/namespace/forgebot/*"
capabilities:
- read
auth:
k8s/au/syd1:
- forgebot