From de9d6e5fcc6df9e95b8050570396576419ea6d8a Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 23 Aug 2026 22:31:13 +1000 Subject: [PATCH] Grant agents AppRole read on the Authentik provider token A one-off terragrunt import in terraform-authentik is needed to reconcile resources orphaned by the failed jellyfin apply, and the agents role must read the Authentik provider token to run it. Revertable after the import. - Add kv/service/terraform/authentik/read policy (read on kv/data/service/terraform/authentik) bound to the agents AppRole --- policies/kv/service/terraform/authentik/read.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 policies/kv/service/terraform/authentik/read.yaml diff --git a/policies/kv/service/terraform/authentik/read.yaml b/policies/kv/service/terraform/authentik/read.yaml new file mode 100644 index 0000000..655de85 --- /dev/null +++ b/policies/kv/service/terraform/authentik/read.yaml @@ -0,0 +1,14 @@ +# Lets the agents AppRole read the Authentik provider API token so a coding +# agent can run a one-off `terragrunt import` in terraform-authentik to +# reconcile resources orphaned by the failed jellyfin apply. Read-only on the +# single token path; revert once the import is done. Mirrors the +# gitea/creds/unkin-agent binding pattern. +--- +rules: + - path: "kv/data/service/terraform/authentik" + capabilities: + - read + +auth: + approle: + - agents -- 2.47.3