unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Replace the terraform-infra Vault identity with terraform-netbox #161

Merged
benvin merged 2 commits from benvin/terraform-netbox-identity into master 2026-10-03 09:39:11 +10:00
Conversation 0 Commits 2 Files Changed 10
+63 -56
unkin-agent commented 2026-10-03 09:25:47 +10:00
Member
Copy Link
Copy Source

terraform-netbox supersedes terraform-infra but has no identity to run as: the terraform-infra policies bind to a terraform_infra approle and a woodpecker_terraform_infra k8s role that were never created.

  • rename the netbox and consul creds policies, the engine role and the consul ACL rules to terraform-netbox
  • add the terraform_netbox approle and woodpecker_terraform_netbox k8s role
  • grant the engine role extras.customfield, dcim.platform and the device inventory types the module creates (manufacturer, devicetype, devicerole, tag, ipam.role) — the old scope would have 403ed on first apply
  • drop the kv/service/terraform/infra policy: the kea_token is gone with Kea and the NetBox token is minted per run

Needs the terraform-netbox woodpecker ServiceAccount in argocd-apps before CI can auth.

terraform-netbox supersedes terraform-infra but has no identity to run as: the terraform-infra policies bind to a terraform_infra approle and a woodpecker_terraform_infra k8s role that were never created. - rename the netbox and consul creds policies, the engine role and the consul ACL rules to terraform-netbox - add the terraform_netbox approle and woodpecker_terraform_netbox k8s role - grant the engine role extras.customfield, dcim.platform and the device inventory types the module creates (manufacturer, devicetype, devicerole, tag, ipam.role) — the old scope would have 403ed on first apply - drop the kv/service/terraform/infra policy: the kea_token is gone with Kea and the NetBox token is minted per run Needs the terraform-netbox woodpecker ServiceAccount in argocd-apps before CI can auth.
unkin-agent added 1 commit 2026-10-03 09:25:48 +10:00
Replace the terraform-infra Vault identity with terraform-netbox
ci/woodpecker/pr/plan Pipeline failed
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
2870ae7e25 
terraform-netbox supersedes terraform-infra but has no identity to run as:
the terraform-infra policies bind to a terraform_infra approle and a
woodpecker_terraform_infra k8s role that were never created.

- rename the netbox and consul creds policies, the engine role and the
  consul ACL rules to terraform-netbox
- add the terraform_netbox approle and woodpecker_terraform_netbox k8s role
- grant the engine role extras.customfield, dcim.platform and the device
  inventory types the module creates
- drop the kv/service/terraform/infra policy: the kea_token is gone with Kea
  and the NetBox token is minted per run
unkin-agent added 1 commit 2026-10-03 09:35:49 +10:00
Remove the orphaned woodpecker_terraform_infra auth role
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
f4ca90bd57 
Renaming its policies left the role bound to nothing, and the module
indexes policy_auth_map by role name, so the plan failed with Invalid
index. woodpecker_terraform_netbox replaces it.
benvin merged commit e2c07a8c83 into master 2026-10-03 09:39:11 +10:00
benvin deleted branch benvin/terraform-netbox-identity 2026-10-03 09:39:11 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#161
Delete Branch "benvin/terraform-netbox-identity"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?