2026-07-27 20:22:41 +10:00
1 changed files with 20 additions and 0 deletions
@@ -0,0 +1,20 @@
 # Allow terraform-git to seed (write once) the gitea secrets engine's admin
 # credentials. terraform-git creates the gitea-vault-admin site-admin bot and
 # writes its generated password here as admin_username + admin_password; the
 # vault gitea engine (managed by the tf_vault deployer) reads it at gitea/config
 # creation time. Read is already granted to the deployer via
 # policies/kv/service/vault/secret_backends_read.yaml, so this only adds the
 # write side for terraform-git's own identity.
 ---
 rules:
  - path: "kv/data/service/vault/au/syd1/secret_backend/gitea/config"
    capabilities:
      - create
      - read
      - update
 auth:
  approle:
    - terraform_git
  k8s/au/syd1:
    - woodpecker_terraform_git