unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant the vault deployer read on the Authentik OIDC client secret #146

Merged
benvin merged 1 commits from benvin/oidc-client-read-grant into master 2026-08-30 21:50:58 +10:00
Conversation 0 Commits 1 Files Changed 1
+21
unkin-agent commented 2026-08-30 21:22:24 +10:00
Member
Copy Link
Copy Source

Why: the terraform-vault deployer must read the OpenBao OIDC client credentials that Authentik's provider module generates before it can configure auth/oidc, and AppRole capabilities are fixed at login so the grant has to exist in a prior apply.

How:

  • Add policies/kv/service/authentik/oidc-vault/read.yaml: read on kv/data/service/authentik/oidc-vault for the deployer identities (approle tf_vault, k8s/au/syd1 woodpecker_terraform_vault); terraform_authentik still owns the write side of kv/service/authentik/*.

Merge order: this PR must merge and apply before the follow-up PR that adds the auth/oidc modules. OIDC becomes the default human auth path; approle/k8s (CI and agents) and break-glass are unchanged.

**Why:** the terraform-vault deployer must read the OpenBao OIDC client credentials that Authentik's provider module generates before it can configure `auth/oidc`, and AppRole capabilities are fixed at login so the grant has to exist in a prior apply. **How:** - Add `policies/kv/service/authentik/oidc-vault/read.yaml`: read on `kv/data/service/authentik/oidc-vault` for the deployer identities (approle `tf_vault`, k8s/au/syd1 `woodpecker_terraform_vault`); `terraform_authentik` still owns the write side of `kv/service/authentik/*`. **Merge order:** this PR must merge and apply *before* the follow-up PR that adds the `auth/oidc` modules. OIDC becomes the default human auth path; approle/k8s (CI and agents) and break-glass are unchanged.
unkin-agent added 1 commit 2026-08-30 21:22:24 +10:00
Grant the vault deployer read on the Authentik OIDC client secret
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
594f67f525 
Authentik's provider module generates the OpenBao OIDC client and writes its
credentials to kv/service/authentik/oidc-vault (terraform_authentik owns that
subtree). The terraform-vault deployer needs to read them to configure the
auth/oidc backend, and AppRole capabilities are fixed at login, so the grant
must land in a prior apply.

Add policies/kv/service/authentik/oidc-vault/read.yaml granting read on
kv/data/service/authentik/oidc-vault to the deployer identities (approle
tf_vault and k8s/au/syd1 woodpecker_terraform_vault).
benvin merged commit 67e79e72dc into master 2026-08-30 21:50:58 +10:00
benvin deleted branch benvin/oidc-client-read-grant 2026-08-30 21:50:58 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#146
Delete Branch "benvin/oidc-client-read-grant"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?