feat: add plan workflow

- update makefile to enable kubernetes auth or roleid auth - add plan workflow - update all policies to allow the terraform-vault kubernetes role
2026-05-21 23:48:01 +10:00
12 changed files with 2 additions and 104 deletions
@@ -1,23 +0,0 @@
-when:
-  - event: push
-    branch: master
-
-steps:
-  - name: apply
-    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
-    environment:
-      VAULT_AUTH_METHOD: kubernetes
-    commands:
-      - dnf install vault -y
-      - make plan
-      - make apply
-    backend_options:
-      kubernetes:
-        serviceAccountName: terraform-vault
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2
@@ -3,7 +3,7 @@ when:

 steps:
  - name: plan
-    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260308
    environment:
      VAULT_AUTH_METHOD: kubernetes
    commands:
@@ -3,7 +3,7 @@ when:

 steps:
  - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260308
    commands:
      - uvx pre-commit run --all-files
    backend_options:
@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true
@@ -1,8 +0,0 @@
-bound_service_account_names:
-  - default
-  - forgebot-operator
-bound_service_account_namespaces:
-  - forgebot
-token_ttl: 600
-token_max_ttl: 600
-audience: vault
@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-git
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local
@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-git
-ttl: 120
-max_ttl: 300
-datacenters: []
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-git"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_git
-  k8s/au/syd1:
-    - woodpecker_terraform_git
@@ -1,9 +0,0 @@
---
-rules:
-  - path: "kv/data/kubernetes/namespace/forgebot/*"
-    capabilities:
-      - read
-
-auth:
-  k8s/au/syd1:
-    - forgebot
@@ -1,12 +0,0 @@
-# Allow reading Gitea admin token
---
-rules:
-  - path: "kv/data/service/gitea/gitadmin/tokens/terraform-git"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_git
-  k8s/au/syd1:
-    - woodpecker_terraform_git
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "kv/data/service/woodpecker/tokens/gitadmin"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_git
-  k8s/au/syd1:
-    - woodpecker_terraform_git
@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/git/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}