Grant terraform-incus approle read on encapi environment secret

terraform-incus dual-writes ENC data to encapi and needs the ENCAPI_WRITE_TOKEN from Vault at apply time. Add a policy granting the terraform_incus approle read on kv/data/kubernetes/namespace/encapi/default/environment. Prerequisite for terraform-incus PR #39.
2026-07-24 22:55:09 +10:00
1 changed files with 12 additions and 0 deletions
@@ -0,0 +1,12 @@
+# Allow the Terraform Incus runner to read the encapi environment secret
+# (ENCAPI_WRITE_TOKEN), so `make apply` can dual-write ENC data to encapi via
+# the encapi Terraform provider.
+---
+rules:
+  - path: "kv/data/kubernetes/namespace/encapi/default/environment"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_incus