unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add terraform-enc Vault/Consul plumbing + encapi token grant #98

Merged
benvin merged 1 commits from benvin/terragrunt-enc-vault into master 2026-07-24 23:18:56 +10:00
Conversation 0 Commits 1 Files Changed 6
+56
unkinben commented 2026-07-24 23:06:26 +10:00
Owner
Copy Link
Copy Source

The new terragrunt-enc repo manages all encapi ENC data (statuses, roles, node classifications) via Terraform/Terragrunt and needs its own Vault/Consul plumbing, mirroring terraform-git and terraform-incus. This supersedes the dual-write approach in terraform-incus PR #39; the equivalent terraform-incus grant (PR #97) is being closed, so the encapi-token grant is created fresh here for the new approle.

Changes:

  • Add approle role terraform_enc and k8s auth role woodpecker_terraform_enc (bound to the terraform-enc ServiceAccount in the woodpecker namespace) for CI auth.
  • Add consul secret backend role terraform-enc plus its ACL rules granting write on infra/terraform/enc/ (its terragrunt state prefix), and a policy letting both auth roles read consul_root/au/syd1/creds/terraform-enc.
  • Grant both auth roles read on kv/data/kubernetes/namespace/encapi/default/environment (the ENCAPI_WRITE_TOKEN) so make apply can write to encapi via the encapi provider.
The new **terragrunt-enc** repo manages all encapi ENC data (statuses, roles, node classifications) via Terraform/Terragrunt and needs its own Vault/Consul plumbing, mirroring terraform-git and terraform-incus. This supersedes the dual-write approach in terraform-incus PR #39; the equivalent terraform-incus grant (PR #97) is being closed, so the encapi-token grant is created fresh here for the new approle. Changes: - Add approle role `terraform_enc` and k8s auth role `woodpecker_terraform_enc` (bound to the `terraform-enc` ServiceAccount in the `woodpecker` namespace) for CI auth. - Add consul secret backend role `terraform-enc` plus its ACL rules granting `write` on `infra/terraform/enc/` (its terragrunt state prefix), and a policy letting both auth roles read `consul_root/au/syd1/creds/terraform-enc`. - Grant both auth roles read on `kv/data/kubernetes/namespace/encapi/default/environment` (the ENCAPI_WRITE_TOKEN) so `make apply` can write to encapi via the encapi provider.
unkinben added 1 commit 2026-07-24 23:06:27 +10:00
Add terraform-enc auth, consul state role, and encapi token grant
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
6d90d90b66 
The new terragrunt-enc repo manages all encapi ENC data via Terraform and
needs its own Vault/Consul plumbing, mirroring terraform-git/terraform-incus:
CI auth, isolated consul state, and read access to the ENCAPI_WRITE_TOKEN.

- Add approle role terraform_enc and k8s auth role woodpecker_terraform_enc
  (bound to the terraform-enc SA in the woodpecker namespace).
- Add consul secret backend role + ACL rules granting write on
  infra/terraform/enc/ for its terragrunt state, plus a policy letting both
  auth roles read consul_root/au/syd1/creds/terraform-enc.
- Grant both auth roles read on
  kv/data/kubernetes/namespace/encapi/default/environment (ENCAPI_WRITE_TOKEN).
benvin merged commit 1fa5900787 into master 2026-07-24 23:18:56 +10:00
benvin deleted branch benvin/terragrunt-enc-vault 2026-07-24 23:18:56 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#98
Delete Branch "benvin/terragrunt-enc-vault"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?