From 7e648d2251ab56c807c31860044595cee671467d Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 26 Aug 2026 19:42:12 -0700
Subject: [PATCH] feat: add vault-service-api group for non-human Vault access

Separate from homelab-admins' blanket grant - target for a future
Vault Identity Group alias scoping service/API tokens narrower than
full admin.
---
 k8s/infra/iam/scripts/authentik-provision.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/k8s/infra/iam/scripts/authentik-provision.py b/k8s/infra/iam/scripts/authentik-provision.py
index 7e5c249..427ba97 100644
--- a/k8s/infra/iam/scripts/authentik-provision.py
+++ b/k8s/infra/iam/scripts/authentik-provision.py
@@ -176,6 +176,7 @@ GROUP_PERMISSIONS = {
     "immich-admins": ["immich:read", "immich:write"],
     "poimen-memory-admins": ["poimen-memory:read", "poimen-memory:write"],
     "k8s-devops-admin": ["k8s:devops"],
+    "vault-service-api": ["vault:read", "vault:write"],
 }
 perms = set()
 for group in request.user.groups.all():
@@ -268,6 +269,10 @@ SERVICE_ADMIN_GROUP_NAMES = [
     "portainer-admins", "kmsvc-admins", "temporal-admins", "llm-admins",
     "paperless-admins", "immich-admins", "poimen-memory-admins",
     "k8s-devops-admin",
+    # Not a human-admin group like the others - Vault Identity Group aliasing
+    # target for service/API (non-browser) access to Vault, kept separate from
+    # homelab-admins' blanket "*" grant. See k8s/infra/iam/scripts/vault-provision.sh.
+    "vault-service-api",
 ]
 service_admin_groups = {}
 for group_name in SERVICE_ADMIN_GROUP_NAMES: