unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add identity OIDC token role for terraform-artifactapi #167

Merged
benvin merged 4 commits from benvin/identity-oidc-artifactapi into master 2026-10-16 22:09:22 +11:00
Conversation 1 Commits 4 Files Changed 4
+18
unkin-agent commented 2026-10-14 22:44:27 +11:00
Member
Copy Link
Copy Source

terraform-artifactapi CI needs a Vault-signed identity token that artifactapi can verify, so the issuer must be a fixed address reachable from pods rather than per-node api_addr.

  • set the identity token issuer to https://vault.service.consul:8200
  • add RS256 named key artifactapi
  • add role terraform-artifactapi (aud artifactapi, 15m ttl)
  • grant read on identity/oidc/token/terraform-artifactapi to the terraform_artifactapi approle and woodpecker_terraform_artifactapi k8s role

Requires terraform-vault #165 and #166.

terraform-artifactapi CI needs a Vault-signed identity token that artifactapi can verify, so the issuer must be a fixed address reachable from pods rather than per-node api_addr. - set the identity token issuer to https://vault.service.consul:8200 - add RS256 named key artifactapi - add role terraform-artifactapi (aud artifactapi, 15m ttl) - grant read on identity/oidc/token/terraform-artifactapi to the terraform_artifactapi approle and woodpecker_terraform_artifactapi k8s role Requires terraform-vault #165 and #166.
unkin-agent commented 2026-10-14 22:46:37 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin changed target branch from benvin/identity-oidc-engine to master 2026-10-16 22:00:26 +11:00
benvin added 3 commits 2026-10-16 22:00:26 +11:00
Add identity OIDC modules and YAML discovery
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
f9f242e67a
Validate identity OIDC cross-references and order resources after issuer config
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
b175c2f5c0
Add identity OIDC token role for terraform-artifactapi
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
5c7495aa22
unkin-agent added 1 commit 2026-10-16 22:01:47 +11:00
Merge remote-tracking branch 'origin/master' into benvin/identity-oidc-artifactapi
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
c2ab0e48c1
benvin merged commit 59c42993bc into master 2026-10-16 22:09:22 +11:00
benvin deleted branch benvin/identity-oidc-artifactapi 2026-10-16 22:09:23 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#167
Delete Branch "benvin/identity-oidc-artifactapi"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?