unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant terraform-infra kv metadata read #113

Merged
benvin merged 1 commits from benvin/infra-kv-metadata into master 2026-08-06 23:17:35 +10:00
Conversation 0 Commits 1 Files Changed 1
+5
unkinben commented 2026-08-06 23:12:29 +10:00
Owner
Copy Link
Copy Source

Follow-up to the merged #111 (which shipped kv/data/service/terraform/infra read only).

terraform-infra's providers.tf uses a vault_kv_secret_v2 data source, which reads the kv-v2 metadata path on every plan/apply (same behaviour that 403'd a prior terraform-git apply — see policies/kv/service/vault/.../gitea/config_write.yaml). Add kv/metadata/service/terraform/infra read so the plan doesn't 403 once the secret is seeded.

Verified against terraform-infra PR #5: skip_child_token cleared the child-token 403 and the data-read policy works (plan now reaches "no secret found"); metadata read is the remaining policy gap before a seeded plan can pass.

https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

Follow-up to the merged #111 (which shipped `kv/data/service/terraform/infra` read only). `terraform-infra`'s providers.tf uses a `vault_kv_secret_v2` **data source**, which reads the kv-v2 **metadata** path on every plan/apply (same behaviour that 403'd a prior terraform-git apply — see `policies/kv/service/vault/.../gitea/config_write.yaml`). Add `kv/metadata/service/terraform/infra` read so the plan doesn't 403 once the secret is seeded. Verified against terraform-infra PR #5: `skip_child_token` cleared the child-token 403 and the data-read policy works (plan now reaches "no secret found"); metadata read is the remaining policy gap before a seeded plan can pass. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkinben added 1 commit 2026-08-06 23:12:29 +10:00
Grant terraform-infra kv metadata read
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
f5a18325b6 
vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
metadata path on every plan/apply once the secret is seeded; grant read on
kv/metadata/service/terraform/infra so the plan doesn't 403 (mirrors the
terraform-git gitea config policy pattern). Follow-up to the merged #111 which
shipped data-read only.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
benvin merged commit aac651a5e4 into master 2026-08-06 23:17:35 +10:00
benvin deleted branch benvin/infra-kv-metadata 2026-08-06 23:17:35 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#113
Delete Branch "benvin/infra-kv-metadata"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?