unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

vault: ghp engine config-write + consumer policies (apply before #121) #122

Merged
benvin merged 1 commits from benvin/ghp-vault-policy into master 2026-08-16 14:49:35 +10:00
Conversation 0 Commits 1 Files Changed 2
+50

1 Commits

Author SHA1 Message Date
unkin-agent a962a22416 vault: add ghp engine config-write + consumer policies (pre-step)
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details 
Step 2 of the ordered ghp plugin add. policies/ghp/admin.yaml grants the
terraform apply identities (tf_vault approle, woodpecker_terraform_vault k8s
role) create/update on ghp/config and ghp/roles/*; policies/ghp/creds/agent.yaml
grants the agents approle read on ghp/creds/agent.

Must merge + apply BEFORE the engine resources (terraform-vault#121): an approle
token's capabilities are fixed at login, so the deployer needs this policy active
in a prior apply before it can write ghp/config.
 2026-08-16 14:44:15 +10:00