unkin-agent
41935d5603
ci/woodpecker/push/apply Pipeline failed
Why: final step of the ordered ghp plugin add. Mounts + configures the ghp OpenBao secrets engine and its token-minting role (catalog registration is #123; policies #122). How: config/ghp_secret_backend/ghp.yaml (mount at ghp; base_url https://ghp.unkin.net; admin_token read from KV kv/service/vault/au/syd1/secret_backend/ghp/config), config/ghp_secret_backend_role/ghp/agent.yaml (agent role), the two vault_cluster submodules, and the config.hcl ghp_secret_backend/role discovery + terragrunt inputs pulling the ghp provider (vault-secrets-ghp v0.1.0). ORDER — apply in sequence: 1. puppet-prod#520 — install openbao-plugin-secrets-ghp binary (merged). 2. terraform-vault#122 — config-write policy (merged). 3. terraform-vault#123 — register plugin in catalog. 4. THIS PR — mount + config + role. Before apply is clean: set the role real ghp App installation_id (currently sentinel 0), and KV dual-seed the ghpsvc_ token (this engine admin_token + the ghp deployment GHP_AUTH_SERVICE_TOKENS). Reviewed-on: #121 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
16 lines
880 B
YAML
16 lines
880 B
YAML
# Mounts the ghp token secrets engine at "ghp" and writes its config.
|
|
# The seeded ghp service token is sensitive and read from KV, not stored here:
|
|
# kv/service/vault/au/syd1/secret_backend/ghp/config
|
|
# -> key: admin_token (required) the shared ghpsvc_... service token
|
|
#
|
|
# admin_token is a static shared secret provisioned into KV by an operator. The
|
|
# SAME token value must also be present in the running ghp deployment's accepted
|
|
# service tokens (GHP_AUTH_SERVICE_TOKENS) so ghp ACCEPTS what this engine
|
|
# PRESENTS. ghp has no rotate endpoint, so the engine never rotates it in place;
|
|
# the mount uses ignore_changes=[admin_token], making the KV seed create-only
|
|
# (re-reading a stale KV value never re-pushes it to a live mount).
|
|
description: "ghp ephemeral scoped agent token engine"
|
|
base_url: "https://ghp.unkin.net"
|
|
tls_skip_verify: false
|
|
request_timeout_seconds: 30
|