unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant the vault deployer read on the Authentik OIDC client secret #146

Merged
benvin merged 1 commits from benvin/oidc-client-read-grant into master 2026-08-30 21:50:58 +10:00
Conversation 0 Commits 1 Files Changed 1
+21

1 Commits

Author SHA1 Message Date
unkin-agent 594f67f525 Grant the vault deployer read on the Authentik OIDC client secret
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details 
Authentik's provider module generates the OpenBao OIDC client and writes its
credentials to kv/service/authentik/oidc-vault (terraform_authentik owns that
subtree). The terraform-vault deployer needs to read them to configure the
auth/oidc backend, and AppRole capabilities are fixed at login, so the grant
must land in a prior apply.

Add policies/kv/service/authentik/oidc-vault/read.yaml granting read on
kv/data/service/authentik/oidc-vault to the deployer identities (approle
tf_vault and k8s/au/syd1 woodpecker_terraform_vault).
 2026-08-30 21:22:12 +10:00