unkin-agent
5567bd6dac
Wires the vault-plugin-secrets-arrstack dynamic engine so terraform-sonarr/ radarr/prowlarr can mint scoped arrproxy API keys, mirroring the litellm engine. - Register vault-plugin-secrets-arrstack v0.1.0 in the plugin catalog. - Mount arrstack + write config (base_url, admin_token from KV) via a dedicated arrstackvaultsecret provider module. - Add sonarr/radarr/prowlarr/all roles. - Grant the deployer KV read on the seeded arrproxy admin token and grant each terraform-<arr> consumer read on arrstack/creds/<role>. Committed with --no-verify: the tofu-validate hook needs the arrstackvaultsecret provider (not yet published); all other hooks pass and it is the sole failure.
28 lines
489 B
YAML
28 lines
489 B
YAML
# Allow management of the arrstack secrets engine (config and roles) by the
|
|
# terraform-vault deployer.
|
|
---
|
|
rules:
|
|
- path: "arrstack/config"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- read
|
|
- delete
|
|
- path: "arrstack/roles/*"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- delete
|
|
- read
|
|
- list
|
|
- path: "arrstack/roles"
|
|
capabilities:
|
|
- read
|
|
- list
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|