unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/terraform-vault:master
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:benvin/litellm-secrets-engine unkin/terraform-vault:feature/forgebot-vault-access
...
compare: unkin/terraform-vault:b9632f39e49c575d5485bf72197361e983bbb828
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:benvin/litellm-secrets-engine unkin/terraform-vault:feature/forgebot-vault-access

6 Commits
master ... b9632f39e4

Author SHA1 Message Date
benvin b9632f39e4 Merge branch 'master' into feature/forgebot-vault-access
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details
2026-06-08 22:57:54 +10:00
unkinben f5803605d6 Simplify: use default templated policy for forgebot KV access
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details 
The default K8s auth policy already provides namespace-scoped access to
kv/data/kubernetes/namespace/{namespace}/{sa}/* via identity templating.
Forgebot secrets should be stored at kv/kubernetes/namespace/forgebot/default/*
instead of kv/service/forgebot/*, eliminating the need for 5 individual
policies. The forgebot K8s auth role is kept for the forgebot-operator SA.
 2026-06-08 22:54:58 +10:00
unkinben 2c4d0d7f64 Add Vault access for forgebot service
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was canceled
Details 
K8s auth role binding for forgebot namespace (default + forgebot-operator
service accounts) and KV read policies for environment config, LiteLLM
API key, Gitea token, PostgreSQL credentials, and webhook secret.
 2026-06-08 22:53:25 +10:00
unkinben a29ff9fe6a fix: use gitadmin woodpecker token path
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
2026-06-08 19:08:12 +10:00
unkinben 12680f93cd feat: replace webhook secrets policy with woodpecker token policy
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details 
Webhook URLs are now managed by the Woodpecker terraform provider
instead of being stored in Vault. Add read policy for the Woodpecker
API token at kv/data/service/woodpecker/tokens/terraform-git.
 2026-06-08 16:17:00 +10:00
unkinben 132e5ea4d9 feat: add vault policy for terraform-git webhook secrets
ci/woodpecker/pr/plan Pipeline failed
Details
ci/woodpecker/pr/pre-commit Pipeline failed
Details 
Allow terraform-git to read webhook URLs stored in
kv/data/service/gitea/webhook/* via approle and k8s auth.
 2026-06-08 16:11:58 +10:00
1 changed files with 8 additions and 0 deletions
Expand all files Collapse all files
config/auth_kubernetes_role/k8s/au/syd1/forgebot.yaml
+8
View File
@@ -0,0 +1,8 @@
bound_service_account_names:
- default
- forgebot-operator
bound_service_account_namespaces:
- forgebot
token_ttl: 600
token_max_ttl: 600
audience: vault