unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

vault: ghp engine config-write + consumer policies (apply before #121) #122

Merged
benvin merged 1 commits from benvin/ghp-vault-policy into master 2026-08-16 14:49:35 +10:00
Conversation 0 Commits 1 Files Changed 2
+50
unkin-agent commented 2026-08-16 14:44:16 +10:00
Member
Copy Link
Copy Source

Why: step 2 of the ordered ghp plugin add (install via puppet -> this policy -> resources). The terraform apply identities (tf_vault / woodpecker_terraform_vault) need create/update on ghp/config + ghp/roles/* BEFORE the engine resources are applied — an approle token capability set is fixed at login, so the grant must be effective in a prior apply or writing ghp/config is permission-denied.

How: split out of #121 — policies/ghp/admin.yaml (deployer: ghp/config + ghp/roles/*) and policies/ghp/creds/agent.yaml (agents approle: read ghp/creds/agent).

Order: puppet-prod#520 (install plugin) -> this -> #121 (resources).

Why: step 2 of the ordered ghp plugin add (install via puppet -> **this policy** -> resources). The terraform apply identities (tf_vault / woodpecker_terraform_vault) need create/update on ghp/config + ghp/roles/* BEFORE the engine resources are applied — an approle token capability set is fixed at login, so the grant must be effective in a prior apply or writing ghp/config is permission-denied. How: split out of #121 — policies/ghp/admin.yaml (deployer: ghp/config + ghp/roles/*) and policies/ghp/creds/agent.yaml (agents approle: read ghp/creds/agent). Order: puppet-prod#520 (install plugin) -> **this** -> #121 (resources).
unkin-agent added 1 commit 2026-08-16 14:44:17 +10:00
vault: add ghp engine config-write + consumer policies (pre-step)
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
a962a22416 
Step 2 of the ordered ghp plugin add. policies/ghp/admin.yaml grants the
terraform apply identities (tf_vault approle, woodpecker_terraform_vault k8s
role) create/update on ghp/config and ghp/roles/*; policies/ghp/creds/agent.yaml
grants the agents approle read on ghp/creds/agent.

Must merge + apply BEFORE the engine resources (terraform-vault#121): an approle
token's capabilities are fixed at login, so the deployer needs this policy active
in a prior apply before it can write ghp/config.
benvin merged commit 600a7747b0 into master 2026-08-16 14:49:35 +10:00
benvin deleted branch benvin/ghp-vault-policy 2026-08-16 14:49:35 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#122
Delete Branch "benvin/ghp-vault-policy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?