unkin-agent 9e18627567 Grant the agents approle read+write on the woodpecker agent token (#151) ...

Agents query the Woodpecker API to inspect pipeline runs and failing steps while reviewing PRs. That token is currently pasted into agent config by hand, so it lives in plaintext on disk instead of in Vault.

- add `policies/kv/service/woodpecker/tokens/agents.yaml`
- grant the `agents` approle create/read/update on `kv/data/service/woodpecker/tokens/agents`
- grant read/list on the matching metadata path; no delete, mirroring the `kv/kubernetes/*` grant

Token seeding follows once this is applied.

Reviewed-on: #151
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-09-12 13:19:56 +10:00

..

config

feat: add plan workflow

2026-05-21 23:52:30 +10:00

kubernetes

vault: add arrstack policies (deployer + KV read + creds) (2/3) (#126)

2026-08-19 22:54:13 +10:00

service

Grant the agents approle read+write on the woodpecker agent token (#151)

2026-09-12 13:19:56 +10:00