unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

vault: wire up ghp secrets engine (backend + role + policies) #121

Merged
benvin merged 3 commits from benvin/ghp-vault-engine into master 2026-08-16 15:55:01 +10:00
Conversation 0 Commits 3 Files Changed 12
+287
unkin-agent commented 2026-08-16 00:13:16 +10:00
Member
Copy Link
Copy Source

Why: final step of the ordered ghp plugin add. Mounts + configures the ghp OpenBao secrets engine and its token-minting role (catalog registration is #123; policies #122).

How: config/ghp_secret_backend/ghp.yaml (mount at ghp; base_url https://ghp.unkin.net; admin_token read from KV kv/service/vault/au/syd1/secret_backend/ghp/config), config/ghp_secret_backend_role/ghp/agent.yaml (agent role), the two vault_cluster submodules, and the config.hcl ghp_secret_backend/role discovery + terragrunt inputs pulling the ghp provider (vault-secrets-ghp v0.1.0).

ORDER — apply in sequence:

  1. puppet-prod#520 — install openbao-plugin-secrets-ghp binary (merged).
  2. terraform-vault#122 — config-write policy (merged).
  3. terraform-vault#123 — register plugin in catalog.
  4. THIS PR — mount + config + role.

Before apply is clean: set the role real ghp App installation_id (currently sentinel 0), and KV dual-seed the ghpsvc_ token (this engine admin_token + the ghp deployment GHP_AUTH_SERVICE_TOKENS).

Why: final step of the ordered ghp plugin add. Mounts + configures the ghp OpenBao secrets engine and its token-minting role (catalog registration is #123; policies #122). How: config/ghp_secret_backend/ghp.yaml (mount at ghp; base_url https://ghp.unkin.net; admin_token read from KV kv/service/vault/au/syd1/secret_backend/ghp/config), config/ghp_secret_backend_role/ghp/agent.yaml (agent role), the two vault_cluster submodules, and the config.hcl ghp_secret_backend/role discovery + terragrunt inputs pulling the ghp provider (vault-secrets-ghp v0.1.0). ORDER — apply in sequence: 1. puppet-prod#520 — install openbao-plugin-secrets-ghp binary (merged). 2. terraform-vault#122 — config-write policy (merged). 3. terraform-vault#123 — register plugin in catalog. 4. THIS PR — mount + config + role. Before apply is clean: set the role real ghp App installation_id (currently sentinel 0), and KV dual-seed the ghpsvc_ token (this engine admin_token + the ghp deployment GHP_AUTH_SERVICE_TOKENS).
unkin-agent added 1 commit 2026-08-16 00:13:16 +10:00
vault: wire up ghp secrets engine (backend + role + policies)
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
7eca2458ab 
Registers the vault-plugin-secrets-ghp catalog entry, mounts the ghp
engine, defines an agent token-minting role, and grants the deployer +
agents AppRole the matching policies. Modeled on the netbox engine,
dropping the rotate/user-management machinery ghp does not have.
unkin-agent added 1 commit 2026-08-16 14:44:37 +10:00
vault: move ghp policies to their own pre-apply PR (#122)
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
0ca7bea6f4 
Ordered plugin add requires the config-write policy to be effective in a prior
apply before this PR writes ghp/config. Policies now live in #122; this PR is
resources-only (catalog entry, backend config, role, modules, config.hcl wiring).
unkin-agent added 1 commit 2026-08-16 15:41:19 +10:00
vault: move ghp plugin-catalog entry to its own PR (#123)
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
724c0da17e 
Ordered add registers the plugin in the catalog (#123) before this PR mounts +
configures the engine. This PR is now mount/config/role + module wiring only.
benvin merged commit 41935d5603 into master 2026-08-16 15:55:01 +10:00
benvin deleted branch benvin/ghp-vault-engine 2026-08-16 15:55:01 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#121
Delete Branch "benvin/ghp-vault-engine"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?