2026-08-29 12:56:07 +10:00
1 changed files with 14 additions and 0 deletions
@@ -0,0 +1,14 @@
+# Lets the agents AppRole read a dedicated, scoped Authentik API token seeded by
+# the operator. Automation seeds OAuth2 client secrets and LDAP outpost tokens as
+# part of normal IaC workflows; fetching an outpost token requires calling the
+# Authentik API, so a scoped token (not the CI admin credential) is read here.
+# Mirrors the gitea/creds/unkin-agent agents-approle read grant pattern.
+---
+rules:
+  - path: "kv/data/service/authentik/agent-api-token"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - agents