unkinben
aac651a5e4
ci/woodpecker/push/apply Pipeline was successful
Follow-up to the merged #111 (which shipped `kv/data/service/terraform/infra` read only). `terraform-infra`'s providers.tf uses a `vault_kv_secret_v2` **data source**, which reads the kv-v2 **metadata** path on every plan/apply (same behaviour that 403'd a prior terraform-git apply — see `policies/kv/service/vault/.../gitea/config_write.yaml`). Add `kv/metadata/service/terraform/infra` read so the plan doesn't 403 once the secret is seeded. Verified against terraform-infra PR #5: `skip_child_token` cleared the child-token 403 and the data-read policy works (plan now reaches "no secret found"); metadata read is the remaining policy gap before a seeded plan can pass. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT Reviewed-on: #113 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
19 lines
545 B
YAML
19 lines
545 B
YAML
# Allow the terraform-infra runner to read the NetBox + KeaAPI tokens
|
|
# (netbox_token / kea_token fields) used by the netbox and kea providers.
|
|
---
|
|
rules:
|
|
- path: "kv/data/service/terraform/infra"
|
|
capabilities:
|
|
- read
|
|
# vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
|
|
# metadata path on every plan/apply; a 403 here fails the plan.
|
|
- path: "kv/metadata/service/terraform/infra"
|
|
capabilities:
|
|
- read
|
|
|
|
auth:
|
|
approle:
|
|
- terraform_infra
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_infra
|