From eb68ac1126e695e7ad3873ef5e292bfea1287cff Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 12 Oct 2026 00:19:06 +1100 Subject: [PATCH 1/2] Add Vault/Consul access for terraform-binarylane --- .../approle/terraform_binarylane.yaml | 9 +++++++++ .../syd1/woodpecker_terraform_binarylane.yaml | 7 +++++++ .../au/syd1/terraform-binarylane.yaml | 5 +++++ .../au/syd1/creds/terraform-binarylane.yaml | 11 ++++++++++ policies/kv/service/terraform/binarylane.yaml | 13 ++++++++++++ .../service/terraform/binarylane/agents.yaml | 16 +++++++++++++++ .../service/wireguard/binarylane/write.yaml | 20 +++++++++++++++++++ .../au/syd1/terraform-binarylane.hcl | 7 +++++++ 8 files changed, 88 insertions(+) create mode 100644 config/auth_approle_role/approle/terraform_binarylane.yaml create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_binarylane.yaml create mode 100644 config/consul_secret_backend_role/consul_root/au/syd1/terraform-binarylane.yaml create mode 100644 policies/consul_root/au/syd1/creds/terraform-binarylane.yaml create mode 100644 policies/kv/service/terraform/binarylane.yaml create mode 100644 policies/kv/service/terraform/binarylane/agents.yaml create mode 100644 policies/kv/service/wireguard/binarylane/write.yaml create mode 100644 resources/secret_backend/consul_root/au/syd1/terraform-binarylane.hcl diff --git a/config/auth_approle_role/approle/terraform_binarylane.yaml b/config/auth_approle_role/approle/terraform_binarylane.yaml new file mode 100644 index 0000000..cec109a --- /dev/null +++ b/config/auth_approle_role/approle/terraform_binarylane.yaml @@ -0,0 +1,9 @@ +token_ttl: 120 +token_max_ttl: 120 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" + - "198.18.25.102/32" + - "198.18.26.91/32" + - "198.18.27.40/32" +use_deterministic_role_id: true diff --git a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_binarylane.yaml b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_binarylane.yaml new file mode 100644 index 0000000..bd396a6 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_binarylane.yaml @@ -0,0 +1,7 @@ +bound_service_account_names: + - terraform-binarylane +bound_service_account_namespaces: + - woodpecker +token_ttl: 600 +token_max_ttl: 600 +audience: https://kubernetes.default.svc.cluster.local diff --git a/config/consul_secret_backend_role/consul_root/au/syd1/terraform-binarylane.yaml b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-binarylane.yaml new file mode 100644 index 0000000..61d1876 --- /dev/null +++ b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-binarylane.yaml @@ -0,0 +1,5 @@ +consul_roles: + - terraform-binarylane +ttl: 120 +max_ttl: 300 +datacenters: [] diff --git a/policies/consul_root/au/syd1/creds/terraform-binarylane.yaml b/policies/consul_root/au/syd1/creds/terraform-binarylane.yaml new file mode 100644 index 0000000..8d894b9 --- /dev/null +++ b/policies/consul_root/au/syd1/creds/terraform-binarylane.yaml @@ -0,0 +1,11 @@ +--- +rules: + - path: "consul_root/au/syd1/creds/terraform-binarylane" + capabilities: + - read + +auth: + approle: + - terraform_binarylane + k8s/au/syd1: + - woodpecker_terraform_binarylane diff --git a/policies/kv/service/terraform/binarylane.yaml b/policies/kv/service/terraform/binarylane.yaml new file mode 100644 index 0000000..11b89db --- /dev/null +++ b/policies/kv/service/terraform/binarylane.yaml @@ -0,0 +1,13 @@ +# Allow the Terraform BinaryLane runner to read its BinaryLane API token +# (provider auth). +--- +rules: + - path: "kv/data/service/terraform/binarylane" + capabilities: + - read + +auth: + approle: + - terraform_binarylane + k8s/au/syd1: + - woodpecker_terraform_binarylane diff --git a/policies/kv/service/terraform/binarylane/agents.yaml b/policies/kv/service/terraform/binarylane/agents.yaml new file mode 100644 index 0000000..248aba2 --- /dev/null +++ b/policies/kv/service/terraform/binarylane/agents.yaml @@ -0,0 +1,16 @@ +# Lets the agents AppRole seed and rotate the BinaryLane API token (no delete). +--- +rules: + - path: "kv/data/service/terraform/binarylane" + capabilities: + - create + - read + - update + - path: "kv/metadata/service/terraform/binarylane" + capabilities: + - read + - list + +auth: + approle: + - agents diff --git a/policies/kv/service/wireguard/binarylane/write.yaml b/policies/kv/service/wireguard/binarylane/write.yaml new file mode 100644 index 0000000..617a1d9 --- /dev/null +++ b/policies/kv/service/wireguard/binarylane/write.yaml @@ -0,0 +1,20 @@ +# Let the terraform-binarylane runner store the WireGuard keypairs it generates +# for the BinaryLane gateways (no delete). vault_kv_secret_v2 reads metadata on +# every plan/apply. +--- +rules: + - path: "kv/data/service/wireguard/binarylane/*" + capabilities: + - create + - read + - update + - path: "kv/metadata/service/wireguard/binarylane/*" + capabilities: + - read + - list + +auth: + approle: + - terraform_binarylane + k8s/au/syd1: + - woodpecker_terraform_binarylane diff --git a/resources/secret_backend/consul_root/au/syd1/terraform-binarylane.hcl b/resources/secret_backend/consul_root/au/syd1/terraform-binarylane.hcl new file mode 100644 index 0000000..52f802f --- /dev/null +++ b/resources/secret_backend/consul_root/au/syd1/terraform-binarylane.hcl @@ -0,0 +1,7 @@ +key_prefix "infra/terraform/binarylane/" { + policy = "write" +} + +session_prefix "" { + policy = "write" +} -- 2.47.3 From a80373aa813b61dda973834183363163e9b63378 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 12 Oct 2026 00:21:06 +1100 Subject: [PATCH 2/2] Allow terraform-binarylane to delete its WireGuard keypairs --- policies/kv/service/wireguard/binarylane/write.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/policies/kv/service/wireguard/binarylane/write.yaml b/policies/kv/service/wireguard/binarylane/write.yaml index 617a1d9..900a6e3 100644 --- a/policies/kv/service/wireguard/binarylane/write.yaml +++ b/policies/kv/service/wireguard/binarylane/write.yaml @@ -1,6 +1,7 @@ # Let the terraform-binarylane runner store the WireGuard keypairs it generates -# for the BinaryLane gateways (no delete). vault_kv_secret_v2 reads metadata on -# every plan/apply. +# for the BinaryLane gateways. delete lets `terraform destroy` and keypair +# replacement remove a secret and its metadata; vault_kv_secret_v2 reads +# metadata on every plan/apply. --- rules: - path: "kv/data/service/wireguard/binarylane/*" @@ -8,10 +9,12 @@ rules: - create - read - update + - delete - path: "kv/metadata/service/wireguard/binarylane/*" capabilities: - read - list + - delete auth: approle: -- 2.47.3