unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Grant terraform-incus approle read on encapi environment secret #97

Closed
unkinben wants to merge 1 commits from benvin/terraform-incus-encapi-token into master
pull from: benvin/terraform-incus-encapi-token
merge into: unkin:master
Conversation 1 Commits 1 Files Changed 1
+12
unkinben commented 2026-07-24 22:56:18 +10:00
Owner
Copy Link
Copy Source

Why

terraform-incus dual-writes ENC (external node classifier) data to encapi via the new encapi Terraform provider. At make apply time the CI runner needs the encapi write token (ENCAPI_WRITE_TOKEN), which lives in Vault at kv/kubernetes/namespace/encapi/default/environment (the same secret the encapi deployment reads via its VaultStaticSecret). The terraform-incus approle currently has no grant for it.

This is a prerequisite for terraform-incus PR #39 (unkin/terraform-incus#39).

Changes

  • Add policy policies/kv/service/terraform/incus-encapi-environment.yaml granting the terraform_incus approle read on kv/data/kubernetes/namespace/encapi/default/environment, following the existing rancher/puppetca policy conventions (data-path read, no metadata grant).
## Why terraform-incus dual-writes ENC (external node classifier) data to encapi via the new encapi Terraform provider. At `make apply` time the CI runner needs the encapi write token (`ENCAPI_WRITE_TOKEN`), which lives in Vault at `kv/kubernetes/namespace/encapi/default/environment` (the same secret the encapi deployment reads via its VaultStaticSecret). The terraform-incus approle currently has no grant for it. This is a prerequisite for terraform-incus PR #39 (https://git.unkin.net/unkin/terraform-incus/pulls/39). ## Changes - Add policy `policies/kv/service/terraform/incus-encapi-environment.yaml` granting the `terraform_incus` approle `read` on `kv/data/kubernetes/namespace/encapi/default/environment`, following the existing rancher/puppetca policy conventions (data-path read, no metadata grant).
unkinben added 1 commit 2026-07-24 22:56:19 +10:00
Grant terraform-incus approle read on encapi environment secret
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details
4ec2f92ca5 
terraform-incus dual-writes ENC data to encapi and needs the
ENCAPI_WRITE_TOKEN from Vault at apply time. Add a policy granting the
terraform_incus approle read on kv/data/kubernetes/namespace/encapi/default/environment.

Prerequisite for terraform-incus PR #39.
unkinben commented 2026-07-24 23:01:49 +10:00
Author
Owner
Copy Link
Copy Source

Closing: superseded by the new dedicated terragrunt-enc repo (all encapi ENC data managed there; no changes to terraform-incus). Replacement PRs incoming.

Closing: superseded by the new dedicated `terragrunt-enc` repo (all encapi ENC data managed there; no changes to terraform-incus). Replacement PRs incoming.
unkinben closed this pull request 2026-07-24 23:01:50 +10:00
Some required checks failed
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details
ci/woodpecker/pr/plan Pipeline failed
Required
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#97
Delete Branch "benvin/terraform-incus-encapi-token"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?