unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

policies: let terraform-git seed the gitea engine admin credential to KV #102

Merged
benvin merged 1 commits from benvin/gitea-kv-writer into master 2026-07-27 20:22:41 +10:00
Conversation 0 Commits 1 Files Changed 1
+20
unkinben commented 2026-07-27 19:29:59 +10:00
Owner
Copy Link
Copy Source

Why

terraform-git now provisions the gitea-vault-admin site-admin bot and writes its generated password to kv/service/vault/au/syd1/secret_backend/gitea/config (as admin_username + admin_password) so the gitea secrets engine can consume it at creation time. The woodpecker_terraform_git / terraform_git identity has no write access to that KV path, so its apply would 403 without this grant.

The deployer that reads the seed already has read access via policies/kv/service/vault/secret_backends_read.yaml (kv/data/service/vault/+/+/secret_backend/*), so only the write side is added here.

Change

  • Add policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml granting create/read/update on the gitea config KV path to the terraform_git approle and woodpecker_terraform_git k8s role.

Ordering

Merge + apply this before the terraform-git benvin/gitea-vault-admin PR applies (which performs the write). Files are disjoint from the other gitea terraform-vault PRs (#100, #101).

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why terraform-git now provisions the `gitea-vault-admin` site-admin bot and writes its generated password to `kv/service/vault/au/syd1/secret_backend/gitea/config` (as `admin_username` + `admin_password`) so the gitea secrets engine can consume it at creation time. The `woodpecker_terraform_git` / `terraform_git` identity has no write access to that KV path, so its apply would 403 without this grant. The deployer that *reads* the seed already has read access via `policies/kv/service/vault/secret_backends_read.yaml` (`kv/data/service/vault/+/+/secret_backend/*`), so only the write side is added here. ## Change - Add `policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml` granting `create`/`read`/`update` on the gitea config KV path to the `terraform_git` approle and `woodpecker_terraform_git` k8s role. ## Ordering Merge + apply this before the terraform-git `benvin/gitea-vault-admin` PR applies (which performs the write). Files are disjoint from the other gitea terraform-vault PRs (#100, #101). https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben added 1 commit 2026-07-27 19:29:59 +10:00
policies: let terraform-git seed the gitea engine admin credential to KV
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
9c35b41ab1 
Why: terraform-git now provisions the gitea-vault-admin site-admin bot and
writes its generated password to kv/service/vault/au/syd1/secret_backend/gitea/config
so the gitea secrets engine can consume it at creation time. The
woodpecker_terraform_git / terraform_git identity has no write access to that
KV path, so its apply would 403 without this grant. The deployer that reads the
seed already has read via policies/kv/service/vault/secret_backends_read.yaml.

Change:
- Add policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
  granting create/read/update on the gitea config KV path to the terraform_git
  approle and woodpecker_terraform_git k8s role.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin merged commit 2c27395613 into master 2026-07-27 20:22:41 +10:00
benvin deleted branch benvin/gitea-kv-writer 2026-07-27 20:22:41 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#102
Delete Branch "benvin/gitea-kv-writer"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?