unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policies: allow terraform-git to delete the gitea config seed for taint recovery #104

Merged
benvin merged 1 commits from benvin/gitea-kv-delete into master 2026-07-27 23:36:54 +10:00
Conversation 0 Commits 1 Files Changed 1
+6
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
+6
View File
@@ -7,16 +7,22 @@
# write side for terraform-git's own identity. # write side for terraform-git's own identity.
--- ---
rules: rules:
# delete is required for taint recovery and destroy (the resource got tainted
# by pipeline 107's failed post-create read and replace = delete+create).
# The seed's write-once semantics are enforced by lifecycle ignore_changes in
# terraform-git, not by withholding delete here.
- path: "kv/data/service/vault/au/syd1/secret_backend/gitea/config" - path: "kv/data/service/vault/au/syd1/secret_backend/gitea/config"
capabilities: capabilities:
- create - create
- read - read
- update - update
- delete
# vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply # vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply
# (403 here broke the terraform-git main apply, pipeline 107). # (403 here broke the terraform-git main apply, pipeline 107).
- path: "kv/metadata/service/vault/au/syd1/secret_backend/gitea/config" - path: "kv/metadata/service/vault/au/syd1/secret_backend/gitea/config"
capabilities: capabilities:
- read - read
- delete
auth: auth:
approle: approle: