unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policies: let terraform-authentik read its provider API token #82

Merged
benvin merged 1 commits from benvin/authentik-provider-token into master 2026-07-06 23:41:03 +10:00
Conversation 0 Commits 1 Files Changed 1
+7 -4
unkinben commented 2026-07-06 23:32:51 +10:00
Owner
Copy Link
Copy Source

Why

terraform-authentik's provider needs an Authentik API token (TF_VAR_authentik_token), now sourced from Vault at kv/service/terraform/authentik (Makefile wiring in terraform-authentik #2). The CI role needs read access to that path.

Change

Extend policies/kv/service/terraform/authentik.yaml to also grant read on kv/data/service/terraform/authentik for the terraform_authentik approle + woodpecker_terraform_authentik k8s role.

## Why terraform-authentik's provider needs an Authentik API token (`TF_VAR_authentik_token`), now sourced from Vault at `kv/service/terraform/authentik` (Makefile wiring in terraform-authentik #2). The CI role needs read access to that path. ## Change Extend `policies/kv/service/terraform/authentik.yaml` to also grant read on `kv/data/service/terraform/authentik` for the `terraform_authentik` approle + `woodpecker_terraform_authentik` k8s role.
unkinben added 1 commit 2026-07-06 23:32:51 +10:00
policies: let terraform-authentik read its provider API token
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
d2c8b3d18c 
Grant the terraform_authentik approle / woodpecker_terraform_authentik
k8s role read on kv/data/service/terraform/authentik so the Makefile can
export TF_VAR_authentik_token for the authentik provider.
benvin merged commit bbde79d2a6 into master 2026-07-06 23:41:03 +10:00
benvin deleted branch benvin/authentik-provider-token 2026-07-06 23:41:03 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#82
Delete Branch "benvin/authentik-provider-token"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?