unkin-agent
f3a3e4b874
ci/woodpecker/push/apply Pipeline was successful
## Why `kv/service/authentik/agent-api-token` is seeded by hand today. terraform-authentik should own it as IaC (`vault_kv_secret_v2`), along with any future Authentik automation tokens, but its runner identities only hold read on `kv/service/terraform/authentik` and the per-namespace oauth-credentials paths. This must land and **apply** first: an AppRole/k8s token's capabilities are fixed at login, so the companion terraform-authentik PR would fail its very first plan against a policy that is not yet live. ## How - Adds `policies/kv/service/authentik/write.yaml`, granting: - `kv/data/service/authentik/*` — create, read, update, delete - `kv/metadata/service/authentik/*` — read, list, delete - Assigned to the same identities that already hold the terraform-authentik read policy: approle `terraform_authentik` and `k8s/au/syd1` role `woodpecker_terraform_authentik`. - `delete` is included (unlike the `kv/kubernetes` agents grant) so `terraform destroy` and resource replacement clean up both the data and the metadata; metadata `read`/`list` is what `vault_kv_secret_v2` hits on every plan. - Scope note in the file header: the ask was to scope to `*-token` paths, but Vault ACL paths only support a trailing glob, so the whole `kv/service/authentik/` subtree is granted. terraform-authentik is the owner of everything under that prefix. - Existing `policies/kv/service/authentik/agent-api-token/read.yaml` (agents approle) is untouched. ## Order Merge + apply this first; the companion terraform-authentik PR merges only afterwards. Reviewed-on: #140 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>