environments/root.hcl

@@ -67,7 +67,7 @@ terraform {
     }
     arrstack = {
       source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
-      version = "0.1.1"
+      version = "0.2.0"
     }
   }
 }

modules/vault_cluster/main.tf

@@ -370,6 +370,7 @@ module "arrstack_secret_backend_role" {
   name    = each.value.name
   backend = each.value.backend
   apps    = each.value.apps
+  methods = each.value.methods
   ttl     = each.value.ttl
   max_ttl = each.value.max_ttl
 

modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf

@@ -7,7 +7,7 @@ terraform {
     }
     arrstack = {
       source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
-      version = "0.1.1"
+      version = "0.2.0"
     }
   }
 }

modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf

@@ -2,6 +2,7 @@ resource "arrstack_secret_backend_role" "this" {
   backend = var.backend
   name    = var.name
   apps    = var.apps
+  methods = var.methods
   ttl     = var.ttl
   max_ttl = var.max_ttl
 }

modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     arrstack = {
       source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
-      version = "0.1.1"
+      version = "0.2.0"
     }
   }
 }

modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf

@@ -13,6 +13,13 @@ variable "apps" {
   type        = list(string)
 }
 
+variable "methods" {
+  description = "HTTP methods a generated key is limited to (subset of GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS). Null leaves the role unrestricted"
+  type        = set(string)
+  # null, not [], so a role yaml that omits methods matches the provider's null read-back and shows no drift.
+  default = null
+}
+
 variable "ttl" {
   description = "Default lease TTL in seconds for keys generated from this role"
   type        = number

modules/vault_cluster/variables.tf

@@ -334,6 +334,7 @@ variable "arrstack_secret_backend_role" {
     name    = string
     backend = string
     apps    = list(string)
+    methods = optional(set(string))
     ttl     = optional(number)
     max_ttl = optional(number)
   }))