Files
terraform-vault/policies/kv/service/vault
unkinben bf9c785281
ci/woodpecker/push/apply Pipeline was successful
policies: allow terraform-git to delete the gitea config seed for taint recovery (#104)
terraform-git's apply (pipeline 108) still fails: pipeline 107 actually wrote the seed but the post-create metadata read 403'd, so terraform tainted the resource — recovery is replace (delete+create), and delete was deliberately not granted. Withholding delete doesn't provide the write-once property anyway (that's lifecycle ignore_changes in terraform-git); it just breaks taint recovery and destroy.

- add delete on the kv data path for the gitea config seed
- add delete on the matching kv metadata path (full destroy support)

After merge+apply, restart the terraform-git apply once more — it will replace the tainted seed and go green, unblocking #101.

Reviewed-on: #104
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
2026-07-27 23:36:53 +10:00
..