Grant agents approle write on ghp config KV path (to seed) #128

2026-08-19T22:28:03+10:00

unkin-agent commented

2026-08-19 22:28:03 +10:00

Why

The terraform-vault master apply aborts because the KV path kv/data/service/vault/au/syd1/secret_backend/ghp/config (key admin_token, a ghpsvc_ service token) is unseeded. The ghp secrets engine reads that value at ghp/config creation time, so the ghp data-source read fails and the apply stops. Granting the agents AppRole scoped write to just this one KV path lets an agent seed the value so the apply can proceed.

Changes

Add policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml, a vault_policy bound to the agents AppRole role only.
Grant create, update, read on the kv-v2 data path kv/data/service/vault/au/syd1/secret_backend/ghp/config.
Grant read on the kv-v2 metadata path kv/metadata/service/vault/au/syd1/secret_backend/ghp/config (read on plan/apply).
Scope to this single ghp config path only; no wildcards, no delete, no list, no other secret_backend configs (least privilege).

Caveat

This grant is itself a vault_policy applied by the master apply, which currently aborts on the ghp data-source read. So the policy likely needs to be applied first (a targeted apply of just this vault_policy) before the agent can seed the KV path. The agent also still needs the actual ghpsvc_ service token value provided out-of-band to write into admin_token.

## Why The `terraform-vault` master apply aborts because the KV path `kv/data/service/vault/au/syd1/secret_backend/ghp/config` (key `admin_token`, a `ghpsvc_` service token) is unseeded. The ghp secrets engine reads that value at `ghp/config` creation time, so the ghp data-source read fails and the apply stops. Granting the `agents` AppRole scoped write to just this one KV path lets an agent seed the value so the apply can proceed. ## Changes - Add `policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml`, a `vault_policy` bound to the `agents` AppRole role only. - Grant `create`, `update`, `read` on the kv-v2 data path `kv/data/service/vault/au/syd1/secret_backend/ghp/config`. - Grant `read` on the kv-v2 metadata path `kv/metadata/service/vault/au/syd1/secret_backend/ghp/config` (read on plan/apply). - Scope to this single ghp config path only; no wildcards, no delete, no list, no other `secret_backend` configs (least privilege). ## Caveat This grant is itself a `vault_policy` applied by the master apply, which currently aborts on the ghp data-source read. So the policy likely needs to be applied first (a targeted apply of just this `vault_policy`) before the agent can seed the KV path. The agent also still needs the actual `ghpsvc_` service token value provided out-of-band to write into `admin_token`.

unkin-agent added 1 commit 2026-08-19 22:28:03 +10:00

Grant agents approle write on ghp config KV path (to seed)

ci/woodpecker/pr/plan Pipeline failed

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

5f1394a2dc

benvin added 1 commit 2026-08-19 22:56:10 +10:00

Merge branch 'master' into benvin/grant-agents-ghp-config-write

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful