unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant the agents approle read+write on the woodpecker agent token #151

Merged
benvin merged 1 commits from benvin/woodpecker-agents-token into master 2026-09-12 13:19:57 +10:00
Conversation 0 Commits 1 Files Changed 1
+21
unkin-agent commented 2026-09-12 13:18:10 +10:00
Member
Copy Link
Copy Source

Agents query the Woodpecker API to inspect pipeline runs and failing steps while reviewing PRs. That token is currently pasted into agent config by hand, so it lives in plaintext on disk instead of in Vault.

  • add policies/kv/service/woodpecker/tokens/agents.yaml
  • grant the agents approle create/read/update on kv/data/service/woodpecker/tokens/agents
  • grant read/list on the matching metadata path; no delete, mirroring the kv/kubernetes/* grant

Token seeding follows once this is applied.

Agents query the Woodpecker API to inspect pipeline runs and failing steps while reviewing PRs. That token is currently pasted into agent config by hand, so it lives in plaintext on disk instead of in Vault. - add `policies/kv/service/woodpecker/tokens/agents.yaml` - grant the `agents` approle create/read/update on `kv/data/service/woodpecker/tokens/agents` - grant read/list on the matching metadata path; no delete, mirroring the `kv/kubernetes/*` grant Token seeding follows once this is applied.
unkin-agent added 1 commit 2026-09-12 13:18:11 +10:00
Grant the agents approle read+write on the woodpecker agent token
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
afa42b960a
benvin merged commit 9e18627567 into master 2026-09-12 13:19:57 +10:00
benvin deleted branch benvin/woodpecker-agents-token 2026-09-12 13:19:57 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#151
Delete Branch "benvin/woodpecker-agents-token"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?