unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Temporarily remove ghp secret backend + roles (unblock apply) #129

Merged
benvin merged 2 commits from benvin/remove-ghp-backend-temp into master 2026-08-19 22:51:55 +10:00
Conversation 0 Commits 2 Files Changed 2
-30
unkin-agent commented 2026-08-19 22:42:26 +10:00
Member
Copy Link
Copy Source

Why

The terraform-vault master apply aborts with:

Error: no secret found at "kv/data/service/vault/au/syd1/secret_backend/ghp/config"
  from module.ghp_secret_backend["ghp"].data.vault_kv_secret_v2.config

The ghp secret backend reads its admin token from a KV path that has not been
seeded yet, so the apply fails and blocks every other change — including the
arrstack plugin registration (#125).

This PR removes only the ghp backend + role config YAMLs (empties the
for_each map). With no config YAMLs, var.ghp_secret_backend /
var.ghp_secret_backend_role are empty maps, so zero ghp backend/role
instances are created, the unseeded ghp/config KV is never read, and the
apply passes. The ghp module wiring, plugin registration, and policies all stay
in place. This is part 1 of a remove -> grant write policy -> seed KV -> re-add
sequence, and the YAMLs will be restored once the ghp config KV is seeded.

Changes

  • Delete config/ghp_secret_backend/ghp.yaml.
  • Delete config/ghp_secret_backend_role/ghp/agent.yaml.

Net diff vs master is exactly those two file deletions. All ghp wiring is
unchanged (identical to master): the module.ghp_secret_backend /
module.ghp_secret_backend_role instantiations, their variables, the
config.hcl parsing blocks, the terragrunt.hcl inputs, the
vault-plugin-secrets-ghp plugin registration, and the ghp/admin +
ghp/creds/agent policies all remain.

## Why The `terraform-vault` master apply aborts with: ``` Error: no secret found at "kv/data/service/vault/au/syd1/secret_backend/ghp/config" from module.ghp_secret_backend["ghp"].data.vault_kv_secret_v2.config ``` The ghp secret backend reads its admin token from a KV path that has not been seeded yet, so the apply fails and blocks every other change — including the arrstack plugin registration (#125). This PR **removes only the ghp backend + role config YAMLs (empties the `for_each` map)**. With no config YAMLs, `var.ghp_secret_backend` / `var.ghp_secret_backend_role` are empty maps, so zero ghp backend/role instances are created, the unseeded `ghp/config` KV is never read, and the apply passes. The ghp module wiring, plugin registration, and policies all stay in place. This is part 1 of a remove -> grant write policy -> seed KV -> re-add sequence, and the YAMLs will be restored once the ghp config KV is seeded. ## Changes - Delete `config/ghp_secret_backend/ghp.yaml`. - Delete `config/ghp_secret_backend_role/ghp/agent.yaml`. Net diff vs `master` is exactly those two file deletions. All ghp wiring is unchanged (identical to master): the `module.ghp_secret_backend` / `module.ghp_secret_backend_role` instantiations, their variables, the `config.hcl` parsing blocks, the `terragrunt.hcl` inputs, the `vault-plugin-secrets-ghp` plugin registration, and the `ghp/admin` + `ghp/creds/agent` policies all remain.
unkin-agent added 1 commit 2026-08-19 22:42:27 +10:00
vault: temporarily remove ghp secret backend + roles (unblock apply)
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
bb4db3e069 
The master apply aborts reading the unseeded ghp config KV
(kv/data/service/vault/au/syd1/secret_backend/ghp/config), blocking all
changes including the arrstack plugin registration (#125). The ghp backend
and role are not-yet-created (0 to destroy), so removing them is
non-destructive and lets the apply proceed.

The ghp plugin registration and ghp policies are retained. This is part 1
of remove -> grant write policy -> seed KV -> re-add; it will be reverted
once the ghp config is seeded.

- Remove module.ghp_secret_backend and module.ghp_secret_backend_role
  instantiations (and the role's depends_on) from modules/vault_cluster/main.tf.
- Remove the ghp_secret_backend and ghp_secret_backend_role variables from
  modules/vault_cluster/variables.tf.
- Remove the ghp_secret_backend and ghp_secret_backend_role parsing blocks
  from config/config.hcl.
- Remove the ghp_secret_backend and ghp_secret_backend_role inputs from
  environments/au/syd1/terragrunt.hcl.
- Delete config/ghp_secret_backend/ghp.yaml and
  config/ghp_secret_backend_role/ghp/agent.yaml.
unkinben added 1 commit 2026-08-19 22:48:45 +10:00
vault: scope down to only removing the ghp backend + role config YAMLs
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
528e081bf1 
Restore the ghp wiring (module instantiations, variables, config.hcl parsing
blocks, and terragrunt inputs) exactly as on master, and remove ONLY the two
ghp config YAMLs. With no yaml files, the for_each maps are empty, so zero ghp
backend/role instances are created and the unseeded ghp/config KV is never read
- the master apply passes while the wiring stays in place for the later re-add.
benvin merged commit 2525bae1d7 into master 2026-08-19 22:51:55 +10:00
benvin deleted branch benvin/remove-ghp-backend-temp 2026-08-19 22:51:56 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#129
Delete Branch "benvin/remove-ghp-backend-temp"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?