2026-08-30 21:50:58 +10:00
1 changed files with 21 additions and 0 deletions
@@ -0,0 +1,21 @@
+# Let the terraform-vault deployer read the OpenBao OIDC client credentials that
+# Authentik's provider module generates and writes here (terraform_authentik owns
+# kv/service/authentik/* — see policies/kv/service/authentik/write.yaml). The
+# deployer consumes client_id/client_secret to configure the auth/oidc backend.
+#
+# OIDC becomes the default human auth path; approle and k8s (CI and agents) plus
+# the break-glass root path are unchanged.
+#
+# AppRole capabilities are fixed at login, so this grant must be applied before
+# the PR that adds the auth/oidc modules.
+---
+rules:
+  - path: "kv/data/service/authentik/oidc-vault"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault