From 9c35b41ab1623ba82bc564872ff265a3ea5db756 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 27 Jul 2026 19:29:41 +1000 Subject: [PATCH] policies: let terraform-git seed the gitea engine admin credential to KV Why: terraform-git now provisions the gitea-vault-admin site-admin bot and writes its generated password to kv/service/vault/au/syd1/secret_backend/gitea/config so the gitea secrets engine can consume it at creation time. The woodpecker_terraform_git / terraform_git identity has no write access to that KV path, so its apply would 403 without this grant. The deployer that reads the seed already has read via policies/kv/service/vault/secret_backends_read.yaml. Change: - Add policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml granting create/read/update on the gitea config KV path to the terraform_git approle and woodpecker_terraform_git k8s role. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- .../secret_backend/gitea/config_write.yaml | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml diff --git a/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml b/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml new file mode 100644 index 0000000..8847abe --- /dev/null +++ b/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml @@ -0,0 +1,20 @@ +# Allow terraform-git to seed (write once) the gitea secrets engine's admin +# credentials. terraform-git creates the gitea-vault-admin site-admin bot and +# writes its generated password here as admin_username + admin_password; the +# vault gitea engine (managed by the tf_vault deployer) reads it at gitea/config +# creation time. Read is already granted to the deployer via +# policies/kv/service/vault/secret_backends_read.yaml, so this only adds the +# write side for terraform-git's own identity. +--- +rules: + - path: "kv/data/service/vault/au/syd1/secret_backend/gitea/config" + capabilities: + - create + - read + - update + +auth: + approle: + - terraform_git + k8s/au/syd1: + - woodpecker_terraform_git -- 2.47.3