unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Harden seed modules: ignore_changes on rancher/litellm engine seed credentials #107

New Issue
Open
opened 2026-08-02 16:24:32 +10:00 by unkinben · 0 comments
unkinben commented 2026-08-02 16:24:32 +10:00
Owner
Copy Link
Copy Source

Problem
The gitea engine's seed module was fixed to consume the seeded admin credential only at create time (lifecycle ignore_changes), so rotate-root cannot be clobbered by a re-apply. The rancher and litellm seed modules have the same shape but LACK ignore_changes — a re-apply would push the stale seed back over rotated live credentials.

Proposal

  • add lifecycle ignore_changes on the seeded credential attributes of the rancher and litellm secret-engine config resources (mirror the gitea engine fix)

Acceptance

  • a re-apply after rotate-root does not revert the rancher/litellm engine admin credentials; plan shows no drift on the seed.
**Problem** The gitea engine's seed module was fixed to consume the seeded admin credential only at create time (lifecycle ignore_changes), so rotate-root cannot be clobbered by a re-apply. The rancher and litellm seed modules have the same shape but LACK ignore_changes — a re-apply would push the stale seed back over rotated live credentials. **Proposal** - add lifecycle ignore_changes on the seeded credential attributes of the rancher and litellm secret-engine config resources (mirror the gitea engine fix) **Acceptance** - a re-apply after rotate-root does not revert the rancher/litellm engine admin credentials; plan shows no drift on the seed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#107
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?