unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Grant vault deployer access to import + manage the rancher engine #91

Open
unkinben wants to merge 1 commits from benvin/rancher-deployer-policy into master
pull from: benvin/rancher-deployer-policy
merge into: unkin:master
Conversation 0 Commits 1 Files Changed 1
+55
unkinben commented 2026-07-17 23:37:53 +10:00
Owner
Copy Link
Copy Source

Why

Wiring the new Rancher token secrets engine into Vault. The deployer registers the plugin (sudo-protected sys/plugins/catalog) and configures the engine via the ranchervaultsecret provider, so it needs catalog + engine-path access. Mirrors #88 (gpg).

Changes

  • Add policies/rancher/admin.yaml granting the tf_vault approle and woodpecker_terraform_vault k8s role: catalog sudo on vault-plugin-secrets-rancher, and manage on rancher/{config,service-accounts,roles}.

Merge order

Part 1 of 4. Merge before the plugin-import and backend PRs so apply doesn't 403. (Puppet install + this policy first, then import, then backend.)

## Why Wiring the new Rancher token secrets engine into Vault. The deployer registers the plugin (sudo-protected `sys/plugins/catalog`) and configures the engine via the ranchervaultsecret provider, so it needs catalog + engine-path access. Mirrors #88 (gpg). ## Changes - Add `policies/rancher/admin.yaml` granting the `tf_vault` approle and `woodpecker_terraform_vault` k8s role: catalog sudo on `vault-plugin-secrets-rancher`, and manage on `rancher/{config,service-accounts,roles}`. ## Merge order Part 1 of 4. Merge before the plugin-import and backend PRs so apply doesn't 403. (Puppet install + this policy first, then import, then backend.)
unkinben added 1 commit 2026-07-17 23:37:53 +10:00
Grant vault deployer access to import + manage the rancher engine
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
6f27546207 
The rancher token secrets engine is registered ('imported') into the catalog by
terraform-vault (sys/plugins/catalog, sudo-protected) and configured via the
ranchervaultsecret provider, so the deployer needs catalog access plus write on
the engine's config/service-accounts/roles paths. Without this, apply 403s on
plugin registration and on rancher/* writes.

- Add policies/rancher/admin.yaml granting the tf_vault approle and the
  woodpecker_terraform_vault k8s role: catalog sudo on the plugin, and manage on
  rancher/{config,service-accounts,roles}.
All checks were successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details
ci/woodpecker/pr/plan Pipeline was successful
Required
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin benvin/rancher-deployer-policy:benvin/rancher-deployer-policy
git checkout benvin/rancher-deployer-policy
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#91
Delete Branch "benvin/rancher-deployer-policy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?