policies: let terraform-authentik read its provider API token (#82 )

## Why terraform-authentik's provider needs an Authentik API token (`TF_VAR_authentik_token`), now sourced from Vault at `kv/service/terraform/authentik` (Makefile wiring in terraform-authentik #2). The CI role needs read access to that path. ## Change Extend `policies/kv/service/terraform/authentik.yaml` to also grant read on `kv/data/service/terraform/authentik` for the `terraform_authentik` approle + `woodpecker_terraform_authentik` k8s role. Reviewed-on: #82 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
policies: let terraform-authentik read oauth client secrets from kv (#81 )
2026-07-06 23:41:03 +10:00 · 2026-07-06 23:05:20 +10:00 · 2026-06-28 22:03:25 +10:00 · 2026-06-28 01:17:51 +10:00 · 2026-06-17 21:42:25 +10:00
29 changed files with 222 additions and 0 deletions
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-artifactapi
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-authentik
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-prowlarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-radarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-sonarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-artifactapi
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-authentik
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-prowlarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-radarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-sonarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-artifactapi"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_artifactapi
+  k8s/au/syd1:
+    - woodpecker_terraform_artifactapi
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-authentik"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_authentik
+  k8s/au/syd1:
+    - woodpecker_terraform_authentik
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-prowlarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_prowlarr
+  k8s/au/syd1:
+    - woodpecker_terraform_prowlarr
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-radarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_radarr
+  k8s/au/syd1:
+    - woodpecker_terraform_radarr
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-sonarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_sonarr
+  k8s/au/syd1:
+    - woodpecker_terraform_sonarr
@@ -6,5 +6,8 @@ rules:
      - read

 auth:
+  approle:
+    - terraform_prowlarr
  k8s/au/syd1:
    - media-apps
+    - woodpecker_terraform_prowlarr
@@ -6,5 +6,8 @@ rules:
      - read

 auth:
+  approle:
+    - terraform_radarr
  k8s/au/syd1:
    - media-apps
+    - woodpecker_terraform_radarr
@@ -6,5 +6,8 @@ rules:
      - read

 auth:
+  approle:
+    - terraform_sonarr
  k8s/au/syd1:
    - media-apps
+    - woodpecker_terraform_sonarr
@@ -0,0 +1,18 @@
+# Allow the Terraform Authentik runner to read:
+#  - its own Authentik API token (provider auth), and
+#  - OAuth2/OIDC client secrets that back authentik providers (per target
+#    service's kv namespace path, via the module's data.vault_kv_secret_v2).
+---
+rules:
+  - path: "kv/data/service/terraform/authentik"
+    capabilities:
+      - read
+  - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_authentik
+  k8s/au/syd1:
+    - woodpecker_terraform_authentik
@@ -0,0 +1,7 @@
+key_prefix "infra/terraform/artifactapi/" {
+  policy = "write"
+}
+
+session_prefix "" {
+  policy = "write"
+}
@@ -0,0 +1,7 @@
+key_prefix "infra/terraform/authentik/" {
+  policy = "write"
+}
+
+session_prefix "" {
+  policy = "write"
+}
@@ -0,0 +1,7 @@
+key_prefix "infra/terraform/prowlarr/" {
+  policy = "write"
+}
+
+session_prefix "" {
+  policy = "write"
+}
@@ -0,0 +1,7 @@
+key_prefix "infra/terraform/radarr/" {
+  policy = "write"
+}
+
+session_prefix "" {
+  policy = "write"
+}
@@ -0,0 +1,7 @@
+key_prefix "infra/terraform/sonarr/" {
+  policy = "write"
+}
+
+session_prefix "" {
+  policy = "write"
+}
Author	SHA1	Message	Date
unkinben	bbde79d2a6	policies: let terraform-authentik read its provider API token (#82 ) ci/woodpecker/push/apply Pipeline was successful Details ## Why terraform-authentik's provider needs an Authentik API token (`TF_VAR_authentik_token`), now sourced from Vault at `kv/service/terraform/authentik` (Makefile wiring in terraform-authentik #2). The CI role needs read access to that path. ## Change Extend `policies/kv/service/terraform/authentik.yaml` to also grant read on `kv/data/service/terraform/authentik` for the `terraform_authentik` approle + `woodpecker_terraform_authentik` k8s role. Reviewed-on: #82 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-06 23:41:03 +10:00
unkinben	f2c54888de	policies: let terraform-authentik read oauth client secrets from kv (#81 ) ci/woodpecker/push/apply Pipeline was successful Details ## Why terraform-authentik now reads OAuth2 client secrets from Vault (`data.vault_kv_secret_v2`) rather than committing them (terraform-authentik #2). But the `terraform_authentik` approle / `woodpecker_terraform_authentik` k8s role only had the consul-creds policy, so `plan` fails with permission denied on the grafana oauth path. ## Change Add `policies/kv/service/terraform/authentik.yaml` granting read on `kv/data/kubernetes/namespace/+/default/oauth-credentials` for both the approle and the woodpecker k8s role. Reviewed-on: #81 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-06 23:05:20 +10:00
unkinben	36d7afbb65	feat: add vault/consul config for media terraform repos (#79 ) ci/woodpecker/push/apply Pipeline was successful Details Add Kubernetes auth roles, AppRole configs, Consul secret backend roles, Consul ACL policies, and Vault kv read policies for terraform-sonarr, terraform-radarr, and terraform-prowlarr. Reviewed-on: #79 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 22:03:25 +10:00
unkinben	c33dcdc447	Add auth and state access for terraform-authentik (#78 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - K8s auth role for Woodpecker CI (`terraform-authentik` SA in `woodpecker` namespace) - AppRole for local terraform runs - Consul secret backend role (`terraform-authentik`, TTL 120/300) - Consul ACL policy for `infra/terraform/authentik/` key prefix - Vault policy granting both auth methods access to Consul creds Reviewed-on: #78 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 01:17:51 +10:00
benvin	be9bd96cf3	feat: enable consul state store for artifactapi (#77 ) ci/woodpecker/push/apply Pipeline was successful Details enable the terraform-artifactapi system to manage its state in consul using dynamic credentials from kubernetes ci jobs in woodpecker --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #77	2026-06-17 21:42:25 +10:00