unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add agent-observability kubernetes creds role and policy #156

Merged
benvin merged 3 commits from benvin/agent-observability-creds into master 2026-09-27 11:23:37 +10:00
Conversation 0 Commits 3 Files Changed 3
+80
unkin-agent commented 2026-09-27 00:36:54 +10:00
Member
Copy Link
Copy Source

No agent Vault role covers the VictoriaMetrics/VictoriaLogs stack, so a scoped Kubernetes token cannot be issued for it and writes there fall back to an admin context.

  • add the agent-observability kubernetes secret backend role, allowed in vm-system, observability and logging
  • add its generated role rules: read plus patch/update on VictoriaMetrics CRs and workloads, pod delete for rolling restarts, read-only on services, configmaps, endpoints, events and Gateway API routes
  • add a policy granting update on kubernetes/au/syd1/creds/agent-observability to the cluster_operator LDAP group and the agents approle
No agent Vault role covers the VictoriaMetrics/VictoriaLogs stack, so a scoped Kubernetes token cannot be issued for it and writes there fall back to an admin context. - add the agent-observability kubernetes secret backend role, allowed in vm-system, observability and logging - add its generated role rules: read plus patch/update on VictoriaMetrics CRs and workloads, pod delete for rolling restarts, read-only on services, configmaps, endpoints, events and Gateway API routes - add a policy granting update on kubernetes/au/syd1/creds/agent-observability to the cluster_operator LDAP group and the agents approle
unkin-agent added 1 commit 2026-09-27 00:36:54 +10:00
add agent-observability kubernetes creds role and policy
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
1887727a04
unkin-agent added 1 commit 2026-09-27 00:43:39 +10:00
scope agent-observability creds role to vm-system
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
2feb24ac88
unkin-agent added 1 commit 2026-09-27 10:03:27 +10:00
generate agent-observability role rules in vault instead of static RBAC
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
0d66106cd5
benvin merged commit 2ec552d6fd into master 2026-09-27 11:23:37 +10:00
benvin deleted branch benvin/agent-observability-creds 2026-09-27 11:23:37 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#156
Delete Branch "benvin/agent-observability-creds"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?