unkin-agent
67e79e72dc
ci/woodpecker/push/apply Pipeline was successful
**Why:** the terraform-vault deployer must read the OpenBao OIDC client credentials that Authentik's provider module generates before it can configure `auth/oidc`, and AppRole capabilities are fixed at login so the grant has to exist in a prior apply. **How:** - Add `policies/kv/service/authentik/oidc-vault/read.yaml`: read on `kv/data/service/authentik/oidc-vault` for the deployer identities (approle `tf_vault`, k8s/au/syd1 `woodpecker_terraform_vault`); `terraform_authentik` still owns the write side of `kv/service/authentik/*`. **Merge order:** this PR must merge and apply *before* the follow-up PR that adds the `auth/oidc` modules. OIDC becomes the default human auth path; approle/k8s (CI and agents) and break-glass are unchanged. Reviewed-on: #146 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
22 lines
745 B
YAML
22 lines
745 B
YAML
# Let the terraform-vault deployer read the OpenBao OIDC client credentials that
|
|
# Authentik's provider module generates and writes here (terraform_authentik owns
|
|
# kv/service/authentik/* — see policies/kv/service/authentik/write.yaml). The
|
|
# deployer consumes client_id/client_secret to configure the auth/oidc backend.
|
|
#
|
|
# OIDC becomes the default human auth path; approle and k8s (CI and agents) plus
|
|
# the break-glass root path are unchanged.
|
|
#
|
|
# AppRole capabilities are fixed at login, so this grant must be applied before
|
|
# the PR that adds the auth/oidc modules.
|
|
---
|
|
rules:
|
|
- path: "kv/data/service/authentik/oidc-vault"
|
|
capabilities:
|
|
- read
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|