unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

policies: let terraform-git seed the gitea engine admin credential to KV #102

Merged
benvin merged 1 commits from benvin/gitea-kv-writer into master 2026-07-27 20:22:41 +10:00
Conversation 0 Commits 1 Files Changed 1
+20

1 Commits

Author SHA1 Message Date
unkinben 9c35b41ab1 policies: let terraform-git seed the gitea engine admin credential to KV
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details 
Why: terraform-git now provisions the gitea-vault-admin site-admin bot and
writes its generated password to kv/service/vault/au/syd1/secret_backend/gitea/config
so the gitea secrets engine can consume it at creation time. The
woodpecker_terraform_git / terraform_git identity has no write access to that
KV path, so its apply would 403 without this grant. The deployer that reads the
seed already has read via policies/kv/service/vault/secret_backends_read.yaml.

Change:
- Add policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
  granting create/read/update on the gitea config KV path to the terraform_git
  approle and woodpecker_terraform_git k8s role.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
 2026-07-27 19:29:41 +10:00