Grant terraform-authentik write on the kv/service/authentik subtree #140

2026-08-29T22:57:07+10:00

unkin-agent commented

2026-08-29 22:57:07 +10:00

Why

kv/service/authentik/agent-api-token is seeded by hand today. terraform-authentik should own it as IaC (vault_kv_secret_v2), along with any future Authentik automation tokens, but its runner identities only hold read on kv/service/terraform/authentik and the per-namespace oauth-credentials paths.

This must land and apply first: an AppRole/k8s token's capabilities are fixed at login, so the companion terraform-authentik PR would fail its very first plan against a policy that is not yet live.

How

Adds policies/kv/service/authentik/write.yaml, granting:
- kv/data/service/authentik/* — create, read, update, delete
- kv/metadata/service/authentik/* — read, list, delete
Assigned to the same identities that already hold the terraform-authentik read policy: approle terraform_authentik and k8s/au/syd1 role woodpecker_terraform_authentik.
delete is included (unlike the kv/kubernetes agents grant) so terraform destroy and resource replacement clean up both the data and the metadata; metadata read/list is what vault_kv_secret_v2 hits on every plan.
Scope note in the file header: the ask was to scope to *-token paths, but Vault ACL paths only support a trailing glob, so the whole kv/service/authentik/ subtree is granted. terraform-authentik is the owner of everything under that prefix.
Existing policies/kv/service/authentik/agent-api-token/read.yaml (agents approle) is untouched.

Order

Merge + apply this first; the companion terraform-authentik PR merges only afterwards.

## Why `kv/service/authentik/agent-api-token` is seeded by hand today. terraform-authentik should own it as IaC (`vault_kv_secret_v2`), along with any future Authentik automation tokens, but its runner identities only hold read on `kv/service/terraform/authentik` and the per-namespace oauth-credentials paths. This must land and **apply** first: an AppRole/k8s token's capabilities are fixed at login, so the companion terraform-authentik PR would fail its very first plan against a policy that is not yet live. ## How - Adds `policies/kv/service/authentik/write.yaml`, granting: - `kv/data/service/authentik/*` — create, read, update, delete - `kv/metadata/service/authentik/*` — read, list, delete - Assigned to the same identities that already hold the terraform-authentik read policy: approle `terraform_authentik` and `k8s/au/syd1` role `woodpecker_terraform_authentik`. - `delete` is included (unlike the `kv/kubernetes` agents grant) so `terraform destroy` and resource replacement clean up both the data and the metadata; metadata `read`/`list` is what `vault_kv_secret_v2` hits on every plan. - Scope note in the file header: the ask was to scope to `*-token` paths, but Vault ACL paths only support a trailing glob, so the whole `kv/service/authentik/` subtree is granted. terraform-authentik is the owner of everything under that prefix. - Existing `policies/kv/service/authentik/agent-api-token/read.yaml` (agents approle) is untouched. ## Order Merge + apply this first; the companion terraform-authentik PR merges only afterwards.

unkin-agent added 1 commit 2026-08-29 22:57:07 +10:00

Grant terraform-authentik write on kv/service/authentik subtree

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

77db5137b4

Lets terraform-authentik manage Authentik automation tokens as IaC instead of relying on manual operator seeding.

benvin merged commit f3a3e4b874 into master

2026-08-29 23:01:43 +10:00

benvin deleted branch benvin/tf-authentik-kv-write

2026-08-29 23:01:43 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-vault#140