unkinben
d2c8b3d18c
Grant the terraform_authentik approle / woodpecker_terraform_authentik k8s role read on kv/data/service/terraform/authentik so the Makefile can export TF_VAR_authentik_token for the authentik provider.
19 lines
539 B
YAML
19 lines
539 B
YAML
# Allow the Terraform Authentik runner to read:
|
|
# - its own Authentik API token (provider auth), and
|
|
# - OAuth2/OIDC client secrets that back authentik providers (per target
|
|
# service's kv namespace path, via the module's data.vault_kv_secret_v2).
|
|
---
|
|
rules:
|
|
- path: "kv/data/service/terraform/authentik"
|
|
capabilities:
|
|
- read
|
|
- path: "kv/data/kubernetes/namespace/+/default/oauth-credentials"
|
|
capabilities:
|
|
- read
|
|
|
|
auth:
|
|
approle:
|
|
- terraform_authentik
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_authentik
|