Fix: add policy binding for forgebot K8s auth role

Every K8s auth role needs at least one entry in the policy_auth_map. Add a policy granting the forgebot role read access to the namespace- scoped KV path, which the operator SA needs when authenticating with the forgebot role instead of the default role.
Merge branch 'master' into feature/forgebot-vault-access
2026-06-08 23:00:35 +10:00 · 2026-06-08 22:57:54 +10:00 · 2026-06-08 22:54:58 +10:00 · 2026-06-08 22:53:25 +10:00 · 2026-06-08 19:08:12 +10:00 · 2026-06-08 16:17:00 +10:00
29 changed files with 13 additions and 200 deletions
@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true
@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true
@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true
@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true
@@ -1,9 +0,0 @@
-token_ttl: 120
-token_max_ttl: 120
-bind_secret_id: false
-token_bound_cidrs:
-  - "10.10.12.200/32"
-  - "198.18.25.102/32"
-  - "198.18.26.91/32"
-  - "198.18.27.40/32"
-use_deterministic_role_id: true
@@ -1,7 +1,8 @@
 bound_service_account_names:
-  - terraform-sonarr
+  - default
+  - forgebot-operator
 bound_service_account_namespaces:
-  - woodpecker
+  - forgebot
 token_ttl: 600
 token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local
+audience: vault
@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-artifactapi
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local
@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-authentik
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local
@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-prowlarr
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local
@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - terraform-radarr
-bound_service_account_namespaces:
-  - woodpecker
-token_ttl: 600
-token_max_ttl: 600
-audience: https://kubernetes.default.svc.cluster.local
@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-artifactapi
-ttl: 120
-max_ttl: 300
-datacenters: []
@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-authentik
-ttl: 120
-max_ttl: 300
-datacenters: []
@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-prowlarr
-ttl: 120
-max_ttl: 300
-datacenters: []
@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-radarr
-ttl: 120
-max_ttl: 300
-datacenters: []
@@ -1,5 +0,0 @@
-consul_roles:
-  - terraform-sonarr
-ttl: 120
-max_ttl: 300
-datacenters: []
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-artifactapi"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_artifactapi
-  k8s/au/syd1:
-    - woodpecker_terraform_artifactapi
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-authentik"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_authentik
-  k8s/au/syd1:
-    - woodpecker_terraform_authentik
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-prowlarr"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_prowlarr
-  k8s/au/syd1:
-    - woodpecker_terraform_prowlarr
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-radarr"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_radarr
-  k8s/au/syd1:
-    - woodpecker_terraform_radarr
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-sonarr"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_sonarr
-  k8s/au/syd1:
-    - woodpecker_terraform_sonarr
@@ -0,0 +1,9 @@
+---
+rules:
+  - path: "kv/data/kubernetes/namespace/forgebot/*"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - forgebot
@@ -6,8 +6,5 @@ rules:
      - read

 auth:
-  approle:
-    - terraform_prowlarr
  k8s/au/syd1:
    - media-apps
-    - woodpecker_terraform_prowlarr
@@ -6,8 +6,5 @@ rules:
      - read

 auth:
-  approle:
-    - terraform_radarr
  k8s/au/syd1:
    - media-apps
-    - woodpecker_terraform_radarr
@@ -6,8 +6,5 @@ rules:
      - read

 auth:
-  approle:
-    - terraform_sonarr
  k8s/au/syd1:
    - media-apps
-    - woodpecker_terraform_sonarr
@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/artifactapi/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}
@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/authentik/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}
@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/prowlarr/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}
@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/radarr/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}
@@ -1,7 +0,0 @@
-key_prefix "infra/terraform/sonarr/" {
-  policy = "write"
-}
-
-session_prefix "" {
-  policy = "write"
-}
Author	SHA1	Message	Date
unkinben	65f844cbe1	Fix: add policy binding for forgebot K8s auth role ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details Every K8s auth role needs at least one entry in the policy_auth_map. Add a policy granting the forgebot role read access to the namespace- scoped KV path, which the operator SA needs when authenticating with the forgebot role instead of the default role.	2026-06-08 23:00:35 +10:00
benvin	b9632f39e4	Merge branch 'master' into feature/forgebot-vault-access ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline failed Details	2026-06-08 22:57:54 +10:00
unkinben	f5803605d6	Simplify: use default templated policy for forgebot KV access ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline failed Details The default K8s auth policy already provides namespace-scoped access to kv/data/kubernetes/namespace/{namespace}/{sa}/* via identity templating. Forgebot secrets should be stored at kv/kubernetes/namespace/forgebot/default/* instead of kv/service/forgebot/*, eliminating the need for 5 individual policies. The forgebot K8s auth role is kept for the forgebot-operator SA.	2026-06-08 22:54:58 +10:00
unkinben	2c4d0d7f64	Add Vault access for forgebot service ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was canceled Details K8s auth role binding for forgebot namespace (default + forgebot-operator service accounts) and KV read policies for environment config, LiteLLM API key, Gitea token, PostgreSQL credentials, and webhook secret.	2026-06-08 22:53:25 +10:00
unkinben	a29ff9fe6a	fix: use gitadmin woodpecker token path ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details	2026-06-08 19:08:12 +10:00
unkinben	12680f93cd	feat: replace webhook secrets policy with woodpecker token policy ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details Webhook URLs are now managed by the Woodpecker terraform provider instead of being stored in Vault. Add read policy for the Woodpecker API token at kv/data/service/woodpecker/tokens/terraform-git.	2026-06-08 16:17:00 +10:00
unkinben	132e5ea4d9	feat: add vault policy for terraform-git webhook secrets ci/woodpecker/pr/plan Pipeline failed Details ci/woodpecker/pr/pre-commit Pipeline failed Details Allow terraform-git to read webhook URLs stored in kv/data/service/gitea/webhook/* via approle and k8s auth.	2026-06-08 16:11:58 +10:00