unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add Vault/Consul access for terraform-binarylane #164

Merged
benvin merged 2 commits from benvin/terraform-binarylane into master 2026-10-12 00:36:17 +11:00
Conversation 2 Commits 2 Files Changed 8
+91
unkin-agent commented 2026-10-12 00:19:12 +11:00
Member
Copy Link
Copy Source

The new terraform-binarylane repo provisions the BinaryLane mail gateways from Woodpecker and needs an identity, state storage, its provider token and somewhere to keep the WireGuard keypairs it generates.

  • add the terraform_binarylane approle and woodpecker_terraform_binarylane k8s role
  • add the terraform-binarylane consul role with write on infra/terraform/binarylane/
  • grant the runner read on kv/service/terraform/binarylane (API token)
  • grant the runner create/read/update/delete on kv/service/wireguard/binarylane/*
  • let the agents approle seed kv/service/terraform/binarylane (no delete)

Needs the terraform-binarylane woodpecker ServiceAccount in argocd-apps before CI can auth.

The new terraform-binarylane repo provisions the BinaryLane mail gateways from Woodpecker and needs an identity, state storage, its provider token and somewhere to keep the WireGuard keypairs it generates. - add the terraform_binarylane approle and woodpecker_terraform_binarylane k8s role - add the terraform-binarylane consul role with write on infra/terraform/binarylane/ - grant the runner read on kv/service/terraform/binarylane (API token) - grant the runner create/read/update/delete on kv/service/wireguard/binarylane/* - let the agents approle seed kv/service/terraform/binarylane (no delete) Needs the terraform-binarylane woodpecker ServiceAccount in argocd-apps before CI can auth.
unkin-agent added 1 commit 2026-10-12 00:19:22 +11:00
Add Vault/Consul access for terraform-binarylane
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was canceled
Details
eb68ac1126
unkin-agent commented 2026-10-12 00:20:34 +11:00
Author
Member
Copy Link
Copy Source
  • nit: policies/kv/service/wireguard/binarylane/write.yaml:6 — no delete on kv/data|metadata/service/wireguard/binarylane/*, so terraform destroy or replacing a gateway keypair (vault_kv_secret_v2) 403s; authentik/write.yaml grants delete for this reason → add delete on both paths, or confirm keypairs are never destroyed.
- nit: policies/kv/service/wireguard/binarylane/write.yaml:6 — no delete on kv/data|metadata/service/wireguard/binarylane/*, so terraform destroy or replacing a gateway keypair (vault_kv_secret_v2) 403s; authentik/write.yaml grants delete for this reason → add delete on both paths, or confirm keypairs are never destroyed.
unkin-agent added 1 commit 2026-10-12 00:21:09 +11:00
Allow terraform-binarylane to delete its WireGuard keypairs
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
a80373aa81
unkin-agent commented 2026-10-12 00:23:56 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin merged commit 4f3036218d into master 2026-10-12 00:36:17 +11:00
benvin deleted branch benvin/terraform-binarylane 2026-10-12 00:36:17 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#164
Delete Branch "benvin/terraform-binarylane"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?