Commit Graph

Select branches

Hide Pull Requests

benvin/arrstack-secret-engine

benvin/certmanager-clouddns-kv

benvin/ghp-vault

benvin/litellm-secrets-engine

benvin/rename-terraform-infra

benvin/terraform-incus-encapi-token

feature/forgebot-vault-access

master

#1

#10

#100

#101

#102

#103

#104

#105

#106

#108

#109

#11

#110

#111

#113

#114

#115

#116

#117

#118

#119

#12

#120

#121

#122

#123

#124

#125

#126

#127

#128

#129

#13

#130

#131

#132

#133

#134

#135

#136

#137

#138

#139

#14

#140

#141

#142

#143

#144

#145

#146

#147

#148

#149

#15

#16

#17

#18

#19

#2

#20

#21

#22

#23

#24

#25

#26

#27

#28

#29

#3

#30

#31

#32

#33

#34

#35

#36

#37

#38

#39

#4

#40

#41

#42

#43

#44

#45

#46

#47

#48

#49

#5

#50

#51

#52

#53

#54

#55

#56

#57

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#67

#68

#69

#7

#70

#71

#72

#73

#74

#75

#76

#77

#78

#79

#8

#80

#81

#82

#83

#84

#85

#86

#87

#88

#89

#9

#90

#91

#92

#93

#94

#95

#96

#97

#98

#99

Mono Color

• a19256fdba Grant the vault deployer sudo to enable the oidc auth mount (#149) master unkin-agent 2026-08-31 22:21:01 +10:00
• a1e7029615 Add Authentik OIDC SSO as the default human login for OpenBao (#147) unkin-agent 2026-08-30 22:38:05 +10:00
• a3a8854a16 Grant the vault deployer auth/oidc and identity group capabilities (#148) unkin-agent 2026-08-30 22:14:41 +10:00
• 67e79e72dc Grant the vault deployer read on the Authentik OIDC client secret (#146) unkin-agent 2026-08-30 21:50:57 +10:00
• 1f03bcdc67 Bump vault-secrets-arrstack provider to 0.2.0 and plumb methods (#145) unkin-agent 2026-08-30 18:19:04 +10:00
• 6c489c6003 Bump arrstack plugin catalog to v0.2.0 (#144) unkin-agent 2026-08-30 17:07:28 +10:00
• bcbf121818 Grant terraform-rancher read on rancher/creds/ci (#143) unkin-agent 2026-08-30 09:42:00 +10:00
• 9fa51f401a Add arrstack creds role and k8s auth for mediamark (#141) unkin-agent 2026-08-30 09:40:26 +10:00
• 5879fbd2d8 Add ephemeral Gitea creds for repospawner (#142) unkin-agent 2026-08-30 09:29:26 +10:00
• f3a3e4b874 Grant terraform-authentik write on the kv/service/authentik subtree (#140) unkin-agent 2026-08-29 23:01:43 +10:00
• 7c7826997e Grant agents approle read on kv/service/authentik/agent-api-token (#139) unkin-agent 2026-08-29 12:56:06 +10:00
• 36d2b99255 Revert temporary agents read grant on Authentik provider token (#138) unkin-agent 2026-08-25 21:35:57 +10:00
• 9fcd9d7ab5 Grant agents AppRole read on the Authentik provider token (#137) unkin-agent 2026-08-23 22:34:31 +10:00
• 57fe279d7a Run plan without acquiring the Consul state lock (#136) unkin-agent 2026-08-23 22:31:58 +10:00
• 6c68057e73 operator RO creds: read operator CRD API groups (#135) unkin-agent 2026-08-23 12:29:02 +10:00
• aa8d41a7bb Bump vault-secrets-arrstack provider to 0.1.1 (#134) unkin-agent 2026-08-23 11:30:21 +10:00
• 36fbfb86bc Sort arrstack role apps alphabetically (#133) unkin-agent 2026-08-22 23:25:44 +10:00
• a33fc2b42f Allow CSI auth to read ceph-mediafs-secret KV (#132) unkin-agent 2026-08-22 23:17:18 +10:00
• 0e82cda02d vault: mount arrstack engine + config + roles (3/3) (#127) unkin-agent 2026-08-21 00:09:47 +10:00
• 08ec281b1d Remove ghp agent role (missing installation_id; unblock apply) (#131) unkin-agent 2026-08-20 00:05:13 +10:00
• 392c5d2ac7 Restore ghp secret backend + roles (config now seeded) (#130) unkin-agent 2026-08-19 23:47:32 +10:00
• d1cb790de8 Grant agents approle write on ghp config KV path (to seed) (#128) unkin-agent 2026-08-19 23:17:44 +10:00
• 31a7abec99 vault: add arrstack policies (deployer + KV read + creds) (2/3) (#126) unkin-agent 2026-08-19 22:54:13 +10:00
• 2525bae1d7 Temporarily remove ghp secret backend + roles (unblock apply) (#129) unkin-agent 2026-08-19 22:51:55 +10:00
• df0510e33b vault: register vault-plugin-secrets-arrstack in the catalog (1/3) (#125) unkin-agent 2026-08-19 21:50:55 +10:00
• 5567bd6dac Add arrstack secrets engine (mount, roles, config, policies) benvin/arrstack-secret-engine unkin-agent 2026-08-18 23:22:08 +10:00
• 41935d5603 vault: wire up ghp secrets engine (backend + role + policies) (#121) unkin-agent 2026-08-16 15:55:01 +10:00
• 5084a53015 vault: register ghp plugin in the catalog (config/plugins only) (#123) unkin-agent 2026-08-16 15:43:18 +10:00
• 600a7747b0 vault: ghp engine config-write + consumer policies (apply before #121) (#122) unkin-agent 2026-08-16 14:49:33 +10:00
• 1dace21b37 vault: add ghp k8s auth role + kv read policy benvin/ghp-vault unkin-agent 2026-08-13 19:31:46 +10:00
• 9e7687fccb Mint the netbox user-management credential dynamically from the single admin token (#119) unkinben 2026-08-12 00:03:13 +10:00
• 8ccc5f1393 Add the netbox backend and terraform-infra role (#117) unkinben 2026-08-11 20:43:04 +10:00
• 521ef4f0f3 Add the netbox secrets engine modules and wiring (#115) unkinben 2026-08-09 16:36:18 +10:00
• d080279728 Register the netbox secrets plugin in the catalog (#118) unkinben 2026-08-09 16:30:06 +10:00
• 03dc436a89 Add netbox engine admin policy (#116) unkinben 2026-08-09 12:02:13 +10:00
• c20e7e4664 Let the agents AppRole mint unkin-agent Gitea tokens (#114) unkinben 2026-08-08 23:41:53 +10:00
• aac651a5e4 Grant terraform-infra kv metadata read (#113) unkinben 2026-08-06 23:17:35 +10:00
• 6e7a052293 Grant terraform-infra kv metadata read benvin/rename-terraform-infra unkinben 2026-08-06 23:09:13 +10:00
• 95927202ba Rename terraform-ipam CI Vault access -> terraform-infra (#111) unkinben 2026-08-06 22:25:38 +10:00
• ba5f49f358 ci: re-run (litellm provider transient 500 on prior plan) unkinben 2026-08-05 00:57:52 +10:00
• 92b8fdd0dd Rename terraform-ipam CI Vault access -> terraform-infra unkinben 2026-08-05 00:52:10 +10:00
• d61e985ef2 Add terraform-ipam CI Vault access (#110) unkinben 2026-08-03 00:16:34 +10:00
• 0e6da5cdd3 Add Vault-scoped agent kubernetes roles + agents AppRole (#109) unkinben 2026-08-02 21:55:05 +10:00
• ea380b9417 Add cert-manager clouddns KV read access for VSO benvin/certmanager-clouddns-kv unkinben 2026-08-02 17:04:32 +10:00
• c0cc74927c Add logarchive gpg key + logging_logarchiver read access (#106) unkinben 2026-07-29 20:39:41 +10:00
• 31f32aba0f gitea roles: add read:user scope for API login validation (#105) unkinben 2026-07-28 18:07:29 +10:00
• 96a6a7d728 gitea: add the gitea token secrets engine (mount, config, teabot roles) (#101) unkinben 2026-07-27 23:42:13 +10:00
• bf9c785281 policies: allow terraform-git to delete the gitea config seed for taint recovery (#104) unkinben 2026-07-27 23:36:53 +10:00
• d82580f1af policies: grant terraform-git read on the gitea config KV metadata path (#103) unkinben 2026-07-27 23:21:43 +10:00
• 2c27395613 policies: let terraform-git seed the gitea engine admin credential to KV (#102) unkinben 2026-07-27 20:22:40 +10:00
• d289775e38 policies: grant the vault deployer access to the gitea secrets engine (#100) unkinben 2026-07-27 19:10:21 +10:00
• 31424ea6ff ci: fetch vault from artifactapi instead of dnf install (#99) unkinben 2026-07-25 09:47:34 +10:00
• 1fa5900787 Add terraform-enc Vault/Consul plumbing + encapi token grant (#98) unkinben 2026-07-24 23:18:56 +10:00
• 4ec2f92ca5 Grant terraform-incus approle read on encapi environment secret benvin/terraform-incus-encapi-token unkinben 2026-07-24 22:55:09 +10:00
• dcc73131a4 Bump rancher plugin catalog to v0.1.1 (bearerToken fix) (#96) unkinben 2026-07-18 22:59:35 +10:00
• 87e3ada14f Mount the rancher secrets engine + seed a service account + roles (#93) unkinben 2026-07-18 16:16:54 +10:00
• 193c17d1bc Manage the litellm plugin via config/plugins (import existing registration) (#90) unkinben 2026-07-18 14:55:33 +10:00
• 03e9baf17f Register the rancher plugin in the catalog (import) (#92) unkinben 2026-07-18 14:47:08 +10:00
• b825fdebf7 chore: setup access to enable all plugins, designated to tf-vault user (#94) benvin 2026-07-18 14:42:02 +10:00
• 7da23d47fe Grant vault deployer access to import + manage the rancher engine (#91) unkinben 2026-07-18 14:34:54 +10:00
• 933de177fa Register + mount the GPG secrets engine at gpg/ (#87) unkinben 2026-07-17 23:19:38 +10:00
• ce1185deba Grant vault deployer access to import + manage the gpg engine (#88) unkinben 2026-07-17 23:09:31 +10:00
• 3d59758324 Add a plugin-import module + config/plugins for catalog registration (#89) unkinben 2026-07-17 23:08:04 +10:00
• 8bb071ae46 Add auth and state access for terraform-rancher (#86) unkinben 2026-07-15 21:37:45 +10:00
• 0dba5e00a6 chore: update litellm address (#85) benvin 2026-07-09 23:47:32 +10:00
• a400e5dc7e fix: grant vault deployer access to manage the litellm engine (#84) unkinben 2026-07-07 20:10:43 +10:00
• ecee4b4432 fix: grant vault deployer access to manage the litellm engine benvin/litellm-secrets-engine unkinben 2026-07-07 00:23:20 +10:00
• 95e7a81b2e feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret (#83) unkinben 2026-07-07 00:18:29 +10:00
• 9e2c21131f feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret unkinben 2026-07-07 00:00:43 +10:00
• bbde79d2a6 policies: let terraform-authentik read its provider API token (#82) unkinben 2026-07-06 23:41:03 +10:00
• f2c54888de policies: let terraform-authentik read oauth client secrets from kv (#81) unkinben 2026-07-06 23:05:20 +10:00
• 36d7afbb65 feat: add vault/consul config for media terraform repos (#79) unkinben 2026-06-28 22:03:25 +10:00
• c33dcdc447 Add auth and state access for terraform-authentik (#78) unkinben 2026-06-28 01:17:51 +10:00
• be9bd96cf3 feat: enable consul state store for artifactapi (#77) benvin 2026-06-17 21:42:25 +10:00
• 65f844cbe1 Fix: add policy binding for forgebot K8s auth role feature/forgebot-vault-access unkinben 2026-06-08 23:00:22 +10:00
• b9632f39e4 Merge branch 'master' into feature/forgebot-vault-access benvin 2026-06-08 22:57:54 +10:00
• bb5f6922fa feat: add vault policy for terraform-git webhook secrets (#75) unkinben 2026-06-08 22:56:30 +10:00
• f5803605d6 Simplify: use default templated policy for forgebot KV access unkinben 2026-06-08 22:54:58 +10:00
• 2c4d0d7f64 Add Vault access for forgebot service unkinben 2026-06-08 22:53:25 +10:00
• a29ff9fe6a fix: use gitadmin woodpecker token path unkinben 2026-06-08 19:08:12 +10:00
• 12680f93cd feat: replace webhook secrets policy with woodpecker token policy unkinben 2026-06-08 16:17:00 +10:00
• 132e5ea4d9 feat: add vault policy for terraform-git webhook secrets unkinben 2026-06-08 16:11:58 +10:00
• 346cf9fa43 feat: manage gitadmin token (#74) benvin 2026-06-08 15:17:58 +10:00
• 1288057b81 feat: add vault and consul roles for terraform-git (#73) unkinben 2026-06-07 20:36:35 +10:00
• 3876fa818d chore: bump almalinux9 image tags (#72) unkinben 2026-06-07 00:35:30 +10:00
• a548bf1cb1 fix: apply requires plan (#71) unkinben 2026-05-22 00:03:08 +10:00
• 93ba86baf3 feat: add apply workflow (#70) unkinben 2026-05-21 23:57:25 +10:00
• 098830c10b Merge pull request 'feat: add plan workflow' (#69) from benvin/make-plan-buildwq into master unkinben 2026-05-21 23:54:07 +10:00
• 9cbac6d3ef feat: add plan workflow unkinben 2026-05-21 23:20:07 +10:00
• 73aaaaeb99 Merge pull request 'chore: enable access to gateway.networking.k8s.io' (#68) from benvin/gatewayapi into master unkinben 2026-05-21 22:42:28 +10:00
• 7c60a5fd53 chore: enable access to gateway.networking.k8s.io unkinben 2026-05-21 22:39:57 +10:00
• 27f12f183e Merge pull request 'chore: change to specific ci image' (#67) from benvin/ci_image into master unkinben 2026-03-09 01:16:59 +11:00
• c61434b692 chore: change to specific ci image unkinben 2026-03-09 01:14:41 +11:00
• 172ceac2fc Merge pull request 'feat: add templated policies for kubernetes' (#66) from benvin/kubernetes_structured_paths into master unkinben 2026-03-08 12:57:58 +11:00
• 48a4fd0dd1 feat: add templated policies for kubernetes unkinben 2026-03-08 12:44:17 +11:00
• 4dc09547ef Merge pull request 'fix: update audience for rpmbuilder' (#65) from benvin/default_aud into master unkinben 2026-03-08 12:29:43 +11:00
• 546a9efe44 fix: update audience for rpmbuilder unkinben 2026-03-07 11:31:36 +11:00
• 679cec4bc1 Merge pull request 'feat: add rpmbuilder k8s role' (#64) from benvin/rpmbuilder-in-k8s into master unkinben 2026-03-07 11:11:23 +11:00
• 71789f9f32 feat: add rpmbuilder k8s role unkinben 2026-03-07 11:06:27 +11:00
• 4cbcec58d3 Merge pull request 'feat: enable woodpecker access to ro tokens' (#63) from benvin/woodpecker_task_access into master unkinben 2026-03-07 10:52:38 +11:00