Add auth and state access for terraform-authentik

- K8s auth role for Woodpecker CI (terraform-authentik SA) - AppRole for local runs - Consul secret backend role for state storage - Consul ACL policy for infra/terraform/authentik/ key prefix - Vault policy granting creds access to both auth methods
2026-06-28 01:04:40 +10:00
18 changed files with 0 additions and 126 deletions
@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true
@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true
@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true
@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-prowlarr
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local
@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-radarr
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local
@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-sonarr
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local
@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-prowlarr
-ttl: 120
-max_ttl: 300
-datacenters: []
@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-radarr
-ttl: 120
-max_ttl: 300
-datacenters: []
@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-sonarr
-ttl: 120
-max_ttl: 300
-datacenters: []
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-prowlarr"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_prowlarr
-  k8s/au/syd1:
-    - woodpecker_terraform_prowlarr
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-radarr"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_radarr
-  k8s/au/syd1:
-    - woodpecker_terraform_radarr
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-sonarr"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_sonarr
-  k8s/au/syd1:
-    - woodpecker_terraform_sonarr
@@ -6,8 +6,5 @@ rules:
      - read

 auth:
-  approle:
-    - terraform_prowlarr
  k8s/au/syd1:
    - media-apps
-    - woodpecker_terraform_prowlarr
@@ -6,8 +6,5 @@ rules:
      - read

 auth:
-  approle:
-    - terraform_radarr
  k8s/au/syd1:
    - media-apps
-    - woodpecker_terraform_radarr
@@ -6,8 +6,5 @@ rules:
      - read

 auth:
-  approle:
-    - terraform_sonarr
  k8s/au/syd1:
    - media-apps
-    - woodpecker_terraform_sonarr
@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/prowlarr/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}
@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/radarr/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}
@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/sonarr/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}