- K8s auth role for Woodpecker CI (terraform-authentik SA)
- AppRole for local runs
- Consul secret backend role for state storage
- Consul ACL policy for infra/terraform/authentik/ key prefix
- Vault policy granting creds access to both auth methods