unkin-agent
59c42993bc
ci/woodpecker/push/apply Pipeline was canceled
terraform-artifactapi CI needs a Vault-signed identity token that artifactapi can verify, so the issuer must be a fixed address reachable from pods rather than per-node api_addr. - set the identity token issuer to https://vault.service.consul:8200 - add RS256 named key artifactapi - add role terraform-artifactapi (aud artifactapi, 15m ttl) - grant read on identity/oidc/token/terraform-artifactapi to the terraform_artifactapi approle and woodpecker_terraform_artifactapi k8s role Requires terraform-vault #165 and #166. Reviewed-on: #167 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>