unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

add vault auth for encapi #80

Closed
unkinben wants to merge 1 commits from benvin/add-encapi-vault-auth into master
pull from: benvin/add-encapi-vault-auth
merge into: unkin:master
Conversation 0 Commits 1 Files Changed 3
+27
unkinben commented 2026-07-04 23:26:47 +10:00
Owner
Copy Link
Copy Source

Why

encapi is the new Postgres-backed Puppet ENC that replaces Cobbler. Its server runs in k8s (see the argocd-apps deployment PR) and needs to read its secrets (DB password, ENCAPI_WRITE_TOKEN) from Vault via the Kubernetes auth backend. Grant that access, mirroring artifactapi's footprint.

Changes

  • add k8s auth role encapi (binds SA default in namespace encapi, mount k8s/au/syd1)
  • add vault policy kv/service/encapi/environment/read
  • add vault policy kv/service/encapi/postgres-password/read

Notes

  • App-facing only; no Consul state / AppRole resources, since there is no terraform-encapi terragrunt repo (the encapi server does not manage its own Terraform state).
## Why encapi is the new Postgres-backed Puppet ENC that replaces Cobbler. Its server runs in k8s (see the argocd-apps deployment PR) and needs to read its secrets (DB password, ENCAPI_WRITE_TOKEN) from Vault via the Kubernetes auth backend. Grant that access, mirroring artifactapi's footprint. ## Changes - add k8s auth role `encapi` (binds SA `default` in namespace `encapi`, mount `k8s/au/syd1`) - add vault policy `kv/service/encapi/environment/read` - add vault policy `kv/service/encapi/postgres-password/read` ## Notes - App-facing only; no Consul state / AppRole resources, since there is no `terraform-encapi` terragrunt repo (the encapi server does not manage its own Terraform state).
unkinben added 1 commit 2026-07-04 23:26:48 +10:00
add vault auth for encapi
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
4f4182cb18 
encapi (the new Postgres-backed Puppet ENC replacing Cobbler) runs in k8s and
reads its secrets from Vault via the Kubernetes auth backend. Grant its pods
that access, mirroring artifactapi.

- add k8s auth role encapi (binds SA default in namespace encapi, mount k8s/au/syd1)
- add vault policy kv/service/encapi/environment/read
- add vault policy kv/service/encapi/postgres-password/read
unkinben closed this pull request 2026-07-05 16:59:52 +10:00
All checks were successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details
ci/woodpecker/pr/plan Pipeline was successful
Required
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#80
Delete Branch "benvin/add-encapi-vault-auth"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?