unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant the vault deployer auth/oidc and identity group capabilities #148

Merged
benvin merged 1 commits from benvin/oidc-deployer-grants into master 2026-08-30 22:14:43 +10:00
Conversation 0 Commits 1 Files Changed 2
+57
unkin-agent commented 2026-08-30 21:59:35 +10:00
Member
Copy Link
Copy Source

Why

AppRole capabilities are fixed at login, so the deployer needs auth/oidc/* and identity-group grants in an apply that precedes the one creating those resources.

How

  • Add policies/auth/oidc/admin.yaml: full auth/oidc/* administration (mount config and login roles), mirroring policies/auth/ldap/admin.yaml.
  • Add policies/identity/group/admin.yaml: manage external identity groups, group aliases and identity/lookup/group, on both the collection and per-id endpoints.
  • Grant both policies to the tf_vault approle and the woodpecker_terraform_vault k8s role.

Apply before #147.

## Why AppRole capabilities are fixed at login, so the deployer needs `auth/oidc/*` and identity-group grants in an apply that precedes the one creating those resources. ## How - Add `policies/auth/oidc/admin.yaml`: full `auth/oidc/*` administration (mount config and login roles), mirroring `policies/auth/ldap/admin.yaml`. - Add `policies/identity/group/admin.yaml`: manage external identity groups, group aliases and `identity/lookup/group`, on both the collection and per-id endpoints. - Grant both policies to the `tf_vault` approle and the `woodpecker_terraform_vault` k8s role. Apply before #147.
unkin-agent added 1 commit 2026-08-30 21:59:35 +10:00
Grant the vault deployer auth/oidc and identity group management
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
7d13c0442b 
The auth/oidc modules in benvin/auth-oidc write auth/oidc/config,
auth/oidc/role/* and external identity groups/aliases. AppRole capabilities
are fixed at login, so the deployer must already hold these grants when that
apply runs.

Add policies/auth/oidc/admin.yaml and policies/identity/group/admin.yaml,
split out of #147 per the never-bundle rule.
benvin merged commit a3a8854a16 into master 2026-08-30 22:14:43 +10:00
benvin deleted branch benvin/oidc-deployer-grants 2026-08-30 22:14:43 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#148
Delete Branch "benvin/oidc-deployer-grants"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?