unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add netbox engine admin policy #116

Merged
benvin merged 1 commits from benvin/netbox-admin-policy into master 2026-08-09 12:02:13 +10:00
Conversation 0 Commits 1 Files Changed 1
+42
unkinben commented 2026-08-09 11:29:52 +10:00
Owner
Copy Link
Copy Source

Why

  • The netbox secrets engine mount + roles land in a follow-up PR (#115); its manage policy must exist first so the deployer can create the engine config and roles the moment that PR applies (policy-first split).

How

  • Add policies/netbox/admin.yaml granting the deployer netbox/config, netbox/config/rotate and netbox/roles/* (deliberately excludes netbox/creds/*), bound to the tf_vault AppRole and woodpecker_terraform_vault k8s role, mirroring the gpg/gitea admin policies.

Land this before #115 (the engine mount + roles).

## Why - The netbox secrets engine mount + roles land in a follow-up PR (#115); its manage policy must exist first so the deployer can create the engine config and roles the moment that PR applies (policy-first split). ## How - Add `policies/netbox/admin.yaml` granting the deployer `netbox/config`, `netbox/config/rotate` and `netbox/roles/*` (deliberately excludes `netbox/creds/*`), bound to the `tf_vault` AppRole and `woodpecker_terraform_vault` k8s role, mirroring the gpg/gitea admin policies. Land this before #115 (the engine mount + roles).
unkinben added 1 commit 2026-08-09 11:29:53 +10:00
Add netbox engine admin policy
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
b11a55edd9 
Why:
- The netbox secrets engine mount + roles land in a follow-up PR; its manage
  policy must exist first so the deployer can create the config and roles the
  moment the engine PR applies (policy-first split).

How:
- Add policies/netbox/admin.yaml granting the deployer netbox/config,
  netbox/config/rotate and netbox/roles/* (excludes netbox/creds/*), bound to
  the tf_vault AppRole and woodpecker_terraform_vault k8s role, mirroring the
  gpg/gitea admin policies.
benvin merged commit 03dc436a89 into master 2026-08-09 12:02:13 +10:00
benvin deleted branch benvin/netbox-admin-policy 2026-08-09 12:02:13 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#116
Delete Branch "benvin/netbox-admin-policy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?