unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant agents AppRole read on the Authentik provider token #137

Merged
benvin merged 1 commits from benvin/agents-authentik-read into master 2026-08-23 22:34:32 +10:00
Conversation 0 Commits 1 Files Changed 1
+14
unkin-agent commented 2026-08-23 22:31:30 +10:00
Member
Copy Link
Copy Source

A one-off terragrunt import in terraform-authentik is needed to reconcile the Authentik resources orphaned by the jellyfin apply failure. The agents AppRole must be able to read the Authentik provider token (kv/service/terraform/authentik) to run the import; this grant is read-only on that single path and can be reverted once the import is done.

  • Add kv/service/terraform/authentik/read policy (read on kv/data/service/terraform/authentik) bound to the agents AppRole
A one-off `terragrunt import` in terraform-authentik is needed to reconcile the Authentik resources orphaned by the jellyfin apply failure. The agents AppRole must be able to read the Authentik provider token (`kv/service/terraform/authentik`) to run the import; this grant is read-only on that single path and can be reverted once the import is done. - Add `kv/service/terraform/authentik/read` policy (read on `kv/data/service/terraform/authentik`) bound to the `agents` AppRole
unkin-agent added 1 commit 2026-08-23 22:31:30 +10:00
Grant agents AppRole read on the Authentik provider token
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
de9d6e5fcc 
A one-off terragrunt import in terraform-authentik is needed to reconcile
resources orphaned by the failed jellyfin apply, and the agents role must
read the Authentik provider token to run it. Revertable after the import.

- Add kv/service/terraform/authentik/read policy (read on
  kv/data/service/terraform/authentik) bound to the agents AppRole
benvin merged commit 9fcd9d7ab5 into master 2026-08-23 22:34:32 +10:00
benvin deleted branch benvin/agents-authentik-read 2026-08-23 22:34:32 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#137
Delete Branch "benvin/agents-authentik-read"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?