unkinben
4ec2f92ca5
terraform-incus dual-writes ENC data to encapi and needs the ENCAPI_WRITE_TOKEN from Vault at apply time. Add a policy granting the terraform_incus approle read on kv/data/kubernetes/namespace/encapi/default/environment. Prerequisite for terraform-incus PR #39.
13 lines
334 B
YAML
13 lines
334 B
YAML
# Allow the Terraform Incus runner to read the encapi environment secret
|
|
# (ENCAPI_WRITE_TOKEN), so `make apply` can dual-write ENC data to encapi via
|
|
# the encapi Terraform provider.
|
|
---
|
|
rules:
|
|
- path: "kv/data/kubernetes/namespace/encapi/default/environment"
|
|
capabilities:
|
|
- read
|
|
|
|
auth:
|
|
approle:
|
|
- terraform_incus
|