unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add artifactapi-writer OIDC role for Woodpecker uploads #172

Merged
benvin merged 1 commits from benvin/artifactapi-writer into master 2026-10-25 15:15:01 +11:00
Conversation 1 Commits 1 Files Changed 3
+31
unkin-agent commented 2026-10-25 13:34:33 +11:00
Member
Copy Link
Copy Source

Woodpecker pipelines need a Vault identity OIDC token with audience artifactapi to upload artifacts; only terraform-artifactapi can mint one today.

  • add artifactapi-writer identity OIDC role (client_id artifactapi, ttl 900)
  • add policy granting read on identity/oidc/token/artifactapi-writer to k8s role woodpecker_artifactapi_writer, vault admins via oidc/ldap
  • add k8s auth role woodpecker_artifactapi_writer bound to woodpecker CI service accounts
Woodpecker pipelines need a Vault identity OIDC token with audience `artifactapi` to upload artifacts; only terraform-artifactapi can mint one today. - add `artifactapi-writer` identity OIDC role (client_id artifactapi, ttl 900) - add policy granting read on `identity/oidc/token/artifactapi-writer` to k8s role `woodpecker_artifactapi_writer`, vault admins via oidc/ldap - add k8s auth role `woodpecker_artifactapi_writer` bound to woodpecker CI service accounts
unkin-agent added 1 commit 2026-10-25 13:34:33 +11:00
Add artifactapi-writer OIDC role for Woodpecker uploads
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
78f909f81f
unkin-agent commented 2026-10-25 13:37:57 +11:00
Author
Member
Copy Link
Copy Source
  • config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml:2 — default SA in ns woodpecker lets every pipeline step without a dedicated SA (incl. PR-event runs) mint the artifactapi writer token → drop default and bind only the named *-ci SAs.
- config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml:2 — `default` SA in ns `woodpecker` lets every pipeline step without a dedicated SA (incl. PR-event runs) mint the artifactapi writer token → drop `default` and bind only the named *-ci SAs.
benvin merged commit fa89757b03 into master 2026-10-25 15:15:01 +11:00
benvin deleted branch benvin/artifactapi-writer 2026-10-25 15:15:01 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#172
Delete Branch "benvin/artifactapi-writer"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?