From 3170a341d178d8d6819d834dc1f1acc809e4c461 Mon Sep 17 00:00:00 2001 From: Gabriel Radureau Date: Sun, 28 Jun 2026 19:18:06 +0200 Subject: [PATCH] fix(vault): rename applications.policies field to ops_policies (cms CI was silently missing its R2 policy) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `applications` object field was declared `policies` in variables.tf, but the cms tfvars entry, the runbook (doc/runbooks/new-web-app/03-vault-platform.md), the guidebook (vibe/guidebooks/tools/secrets-and-vso.md) and the module input (modules/app_policy variable `ops_policies`) all use the name `ops_policies`. Because Terraform silently drops unknown attributes when converting a value to an object() type, cms's `ops_policies = ["factory__cf_r2_arcodange_tf"]` was discarded and `each.value.policies` fell back to [] — so gitea_cicd_cms never received the `factory__cf_r2_arcodange_tf` token policy (read on kvv1/cloudflare/r2/arcodange-tf + kvv1/zoho/self_client, defined in factory iac/cloudflare.tf). cms CI was missing its Cloudflare R2 Terraform-state permissions. Fix at the root: rename the schema field `policies` -> `ops_policies` (and its single reference main.tf:82 `each.value.policies` -> `each.value.ops_policies`), aligning the whole chain. This is lower-churn than renaming the tfvars key (the chosen alternative would also have required fixing the runbook + guidebook, which both already document `ops_policies`) and prevents the next app created from the runbook from re-introducing the same silently-dropped key. Behavioural change: gitea_cicd_cms gains `factory__cf_r2_arcodange_tf` in its token_policies. No other app sets this field (all default []), so no other role changes. Reviewer: confirm the R2 policy is the intended grant for cms CI. Co-Authored-By: Claude Opus 4.7 (1M context) --- hashicorp-vault/iac/main.tf | 2 +- hashicorp-vault/iac/variables.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hashicorp-vault/iac/main.tf b/hashicorp-vault/iac/main.tf index 3d36b03..f90cf14 100644 --- a/hashicorp-vault/iac/main.tf +++ b/hashicorp-vault/iac/main.tf @@ -79,7 +79,7 @@ module "app_policies" { for_each = { for app in var.applications : app.name => app } name = each.value.name envs = each.value.envs - ops_policies = each.value.policies + ops_policies = each.value.ops_policies service_account_names = each.value.service_account_names service_account_namespaces = each.value.service_account_namespaces gitea_app_id = var.gitea_app_id diff --git a/hashicorp-vault/iac/variables.tf b/hashicorp-vault/iac/variables.tf index 5c89240..aa01227 100644 --- a/hashicorp-vault/iac/variables.tf +++ b/hashicorp-vault/iac/variables.tf @@ -12,7 +12,7 @@ variable "POSTGRES_CREDENTIALS_EDITOR_PASSWORD" { variable "applications" { type = set(object({ name = string - policies = optional(list(string), []) + ops_policies = optional(list(string), []) service_account_names = optional(list(string), []) service_account_namespaces = optional(list(string), []) # Multi-env extension: list of envs this app deploys to. Defaults to ["prod"] for -- 2.49.1