unkinben
bbde79d2a6
ci/woodpecker/push/apply Pipeline was successful
## Why terraform-authentik's provider needs an Authentik API token (`TF_VAR_authentik_token`), now sourced from Vault at `kv/service/terraform/authentik` (Makefile wiring in terraform-authentik #2). The CI role needs read access to that path. ## Change Extend `policies/kv/service/terraform/authentik.yaml` to also grant read on `kv/data/service/terraform/authentik` for the `terraform_authentik` approle + `woodpecker_terraform_authentik` k8s role. Reviewed-on: #82 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
19 lines
539 B
YAML
19 lines
539 B
YAML
# Allow the Terraform Authentik runner to read:
|
|
# - its own Authentik API token (provider auth), and
|
|
# - OAuth2/OIDC client secrets that back authentik providers (per target
|
|
# service's kv namespace path, via the module's data.vault_kv_secret_v2).
|
|
---
|
|
rules:
|
|
- path: "kv/data/service/terraform/authentik"
|
|
capabilities:
|
|
- read
|
|
- path: "kv/data/kubernetes/namespace/+/default/oauth-credentials"
|
|
capabilities:
|
|
- read
|
|
|
|
auth:
|
|
approle:
|
|
- terraform_authentik
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_authentik
|