unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policies: let terraform-authentik read oauth client secrets from kv #81

Merged
benvin merged 1 commits from benvin/authentik-oauth-kv into master 2026-07-06 23:05:21 +10:00
Conversation 0 Commits 1 Files Changed 1
+15
unkinben commented 2026-07-06 22:20:42 +10:00
Owner
Copy Link
Copy Source

Why

terraform-authentik now reads OAuth2 client secrets from Vault (data.vault_kv_secret_v2) rather than committing them (terraform-authentik #2). But the terraform_authentik approle / woodpecker_terraform_authentik k8s role only had the consul-creds policy, so plan fails with permission denied on the grafana oauth path.

Change

Add policies/kv/service/terraform/authentik.yaml granting read on kv/data/kubernetes/namespace/+/default/oauth-credentials for both the approle and the woodpecker k8s role.

## Why terraform-authentik now reads OAuth2 client secrets from Vault (`data.vault_kv_secret_v2`) rather than committing them (terraform-authentik #2). But the `terraform_authentik` approle / `woodpecker_terraform_authentik` k8s role only had the consul-creds policy, so `plan` fails with permission denied on the grafana oauth path. ## Change Add `policies/kv/service/terraform/authentik.yaml` granting read on `kv/data/kubernetes/namespace/+/default/oauth-credentials` for both the approle and the woodpecker k8s role.
unkinben added 1 commit 2026-07-06 22:20:42 +10:00
policies: let terraform-authentik read oauth client secrets from kv
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
e01deb13d6 
The terraform-authentik module now reads OAuth2 client secrets from Vault
(data.vault_kv_secret_v2) instead of committing them, but the
terraform_authentik approle / woodpecker_terraform_authentik k8s role only
had the consul creds policy, so plan failed with permission denied.

Grant read on kv/data/kubernetes/namespace/+/default/oauth-credentials so
the runner can read the client secret for any namespace's OIDC provider
(e.g. grafana).
benvin merged commit f2c54888de into master 2026-07-06 23:05:21 +10:00
benvin deleted branch benvin/authentik-oauth-kv 2026-07-06 23:05:21 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#81
Delete Branch "benvin/authentik-oauth-kv"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?