modules/vault_cluster/modules/gitea_secret_backend/main.tf

@@ -20,4 +20,15 @@ resource "gitea_secret_backend" "this" {
   ca_cert                 = var.ca_cert
   tls_skip_verify         = var.tls_skip_verify
   request_timeout_seconds = var.request_timeout_seconds
+
+  lifecycle {
+    # The KV seed is a bootstrap credential: it is consumed only when the engine
+    # config is first created. After creation the live admin password is rotated
+    # in place (vault write -f gitea/config/rotate-root) and diverges from the
+    # seed, so re-reading the (possibly stale) KV value must never push it back.
+    # Ignoring the credential attributes makes this module create-only for them.
+    # (The sibling rancher/litellm seed modules do not yet do this and would
+    # re-push their seed on a subsequent apply.)
+    ignore_changes = [admin_username, admin_password]
+  }
 }