feat: rename occ project slug and enable kennel and docs

anish commented

2026-10-16 23:10:43 +00:00

Member

No description provided.

anish added 1 commit

2026-10-16 23:10:43 +00:00

feat: rename occ project slug and enable kennel and docs

atlantis/plan 2/3 projects failed to plan.

CI / build (pull_request) Has been skipped

Details

atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.

Details

atlantis/plan: keycloak Plan failed.

Details

atlantis/plan: git Plan failed.

Details

Validate / Governance (pull_request_target) Has been cancelled

Details

CI / check (pull_request) Has been cancelled

Details

CI / check-1 (pull_request) Has been cancelled

Details

atlantis/plan: openbao Plan: 7 to add, 1 to change, 16 to destroy.

Details

kennel/build skipped: no services or static sites defined

Details

ee983b490e

Signed-off-by: Anish Pallati <i@anish.land>

anish requested review from thesuperRL

2026-10-16 23:10:43 +00:00

anish force-pushed occ-slug-kennel-docs from ee983b490e

atlantis/plan 2/3 projects failed to plan.

CI / build (pull_request) Has been skipped

Details

atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.

Details

atlantis/plan: keycloak Plan failed.

Details

atlantis/plan: git Plan failed.

Details

Validate / Governance (pull_request_target) Has been cancelled

Details

CI / check (pull_request) Has been cancelled

Details

CI / check-1 (pull_request) Has been cancelled

Details

atlantis/plan: openbao Plan: 7 to add, 1 to change, 16 to destroy.

Details

kennel/build skipped: no services or static sites defined

Details

to 13aebb42a3

CI / build (pull_request) Has been skipped

Details

kennel/build skipped: no services or static sites defined

Details

atlantis/plan: openbao Plan: 7 to add, 1 to change, 7 to destroy.

Details

atlantis/plan: keycloak Plan: 4 to add, 0 to change, 4 to destroy.

Details

atlantis/plan: git Plan: 6 to add, 1 to change, 4 to destroy.

Details

atlantis/plan 3/3 projects planned successfully.

atlantis/policy_check 0/0 projects had policies checked successfully.

atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.

Details

atlantis/apply: openbao Apply succeeded.

Details

atlantis/apply: git Apply succeeded.

Details

atlantis/apply: keycloak Apply succeeded.

Details

atlantis/apply 3/3 projects applied successfully.

Validate / Governance (pull_request_target) Successful in 12m38s

Details

CI / check-1 (pull_request) Failing after 7m40s

Details

CI / check (pull_request) Failing after 0s

Details

2026-10-16 23:10:48 +00:00

Compare

scottylabs-bot commented

2026-10-16 23:10:57 +00:00

Owner

Ran Plan for 3 projects:

project: keycloak dir: tofu/keycloak workspace: default
project: git dir: tofu/git workspace: default
project: openbao dir: tofu/openbao workspace: default

1. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #520. To continue, delete the lock from #520 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

2. project: `git` dir: `tofu/git` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #519. To continue, delete the lock from #519 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Compiling governance-schema v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/522/default/crates/governance-schema)
   Compiling governance-core v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/522/default/crates/governance-core)
   Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/522/default/crates/governance-tfgen)
   Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/522/default/crates/governance-cli)
    Finished `release` profile [optimized] target(s) in 9.43s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)
- destroy

OpenTofu will perform the following actions:

  # vault_identity_entity.collar_ci will be destroyed
  # (because vault_identity_entity.collar_ci is not in configuration)
- resource "vault_identity_entity" "collar_ci" {
-       disabled          = false -> null
-       external_policies = false -> null
-       id                = "5965f6b6-82e2-be90-a09f-79e9f1e20157" -> null
-       metadata          = {} -> null
-       name              = "ci-collar" -> null
-       policies          = [
-           "ci-collar",
        ] -> null
    }

  # vault_identity_entity.occ_ci will be updated in-place
! resource "vault_identity_entity" "occ_ci" {
        id                = "69cf8230-f1ae-42ba-09e6-668620d78889"
        name              = "ci-occ"
!       policies          = [
-           "ci-occ-main",
+           "ci-occ",
        ]
        # (3 unchanged attributes hidden)
    }

  # vault_identity_entity_alias.collar_ci will be destroyed
  # (because vault_identity_entity_alias.collar_ci is not in configuration)
- resource "vault_identity_entity_alias" "collar_ci" {
-       canonical_id    = "5965f6b6-82e2-be90-a09f-79e9f1e20157" -> null
-       custom_metadata = {} -> null
-       id              = "52cbe161-4299-13c1-d5e6-3d77c4dc0502" -> null
-       mount_accessor  = "auth_jwt_d7c2ba6c" -> null
-       name            = "ScottyLabs/collar" -> null
    }

  # vault_identity_group.collar_admins will be destroyed
  # (because vault_identity_group.collar_admins is not in configuration)
- resource "vault_identity_group" "collar_admins" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "7112e64a-668a-1018-8fd1-8ffdc9d930bd" -> null
-       member_entity_ids          = [
-           "ecb8811e-4c70-d527-2750-5ed1de498ed0",
        ] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "collar-admins" -> null
-       policies                   = [
-           "collar-prod",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.collar_members will be destroyed
  # (because vault_identity_group.collar_members is not in configuration)
- resource "vault_identity_group" "collar_members" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "06c38b8d-d991-6abe-67c9-8f5d49e47554" -> null
-       member_entity_ids          = [
-           "ecb8811e-4c70-d527-2750-5ed1de498ed0",
        ] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "collar-members" -> null
-       policies                   = [
-           "collar-dev",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.occ-main_admins will be destroyed
  # (because vault_identity_group.occ-main_admins is not in configuration)
- resource "vault_identity_group" "occ-main_admins" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null
-       member_entity_ids          = [] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "occ-main-admins" -> null
-       policies                   = [
-           "occ-main-prod",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.occ-main_members will be destroyed
  # (because vault_identity_group.occ-main_members is not in configuration)
- resource "vault_identity_group" "occ-main_members" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null
-       member_entity_ids          = [
-           "2d55e58a-77b6-5153-e47c-22debc528d82",
        ] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "occ-main-members" -> null
-       policies                   = [
-           "occ-main-dev",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.occ_admins will be created
+ resource "vault_identity_group" "occ_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "occ-admins"
+       policies                   = [
+           "occ-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.occ_members will be created
+ resource "vault_identity_group" "occ_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "occ-members"
+       policies                   = [
+           "occ-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.collar_admins will be destroyed
  # (because vault_identity_group_alias.collar_admins is not in configuration)
- resource "vault_identity_group_alias" "collar_admins" {
-       canonical_id   = "7112e64a-668a-1018-8fd1-8ffdc9d930bd" -> null
-       id             = "cd94513b-1663-f335-fa33-1388b75faeef" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/collar/admins" -> null
    }

  # vault_identity_group_alias.collar_members will be destroyed
  # (because vault_identity_group_alias.collar_members is not in configuration)
- resource "vault_identity_group_alias" "collar_members" {
-       canonical_id   = "06c38b8d-d991-6abe-67c9-8f5d49e47554" -> null
-       id             = "e3a74822-5f31-9fa3-4dcb-0b065215e86f" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/collar" -> null
    }

  # vault_identity_group_alias.occ-main_admins will be destroyed
  # (because vault_identity_group_alias.occ-main_admins is not in configuration)
- resource "vault_identity_group_alias" "occ-main_admins" {
-       canonical_id   = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null
-       id             = "c8dc72bc-9884-1686-49d8-cecb82e0486c" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/occ-main/admins" -> null
    }

  # vault_identity_group_alias.occ-main_members will be destroyed
  # (because vault_identity_group_alias.occ-main_members is not in configuration)
- resource "vault_identity_group_alias" "occ-main_members" {
-       canonical_id   = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null
-       id             = "5015685b-a07d-7b14-87aa-855ac72441a9" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/occ-main" -> null
    }

  # vault_identity_group_alias.occ_admins will be created
+ resource "vault_identity_group_alias" "occ_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/occ/admins"
    }

  # vault_identity_group_alias.occ_members will be created
+ resource "vault_identity_group_alias" "occ_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/occ"
    }

  # vault_policy.collar_ci will be destroyed
  # (because vault_policy.collar_ci is not in configuration)
- resource "vault_policy" "collar_ci" {
-       id     = "ci-collar" -> null
-       name   = "ci-collar" -> null
-       policy = <<-EOT
            path "secret/data/secretspec/collar/ci/*" {
              capabilities = ["read"]
            }
        EOT -> null
    }

  # vault_policy.collar_dev will be destroyed
  # (because vault_policy.collar_dev is not in configuration)
- resource "vault_policy" "collar_dev" {
-       id     = "collar-dev" -> null
-       name   = "collar-dev" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/collar" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/collar/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/collar/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/collar/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/collar/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.collar_prod will be destroyed
  # (because vault_policy.collar_prod is not in configuration)
- resource "vault_policy" "collar_prod" {
-       id     = "collar-prod" -> null
-       name   = "collar-prod" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/collar" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/collar/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/collar/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/collar/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/collar/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/collar/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/collar/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.occ-main_ci will be destroyed
  # (because vault_policy.occ-main_ci is not in configuration)
- resource "vault_policy" "occ-main_ci" {
-       id     = "ci-occ-main" -> null
-       name   = "ci-occ-main" -> null
-       policy = <<-EOT
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["read"]
            }
        EOT -> null
    }

  # vault_policy.occ-main_dev will be destroyed
  # (because vault_policy.occ-main_dev is not in configuration)
- resource "vault_policy" "occ-main_dev" {
-       id     = "occ-main-dev" -> null
-       name   = "occ-main-dev" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ-main" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ-main/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.occ-main_prod will be destroyed
  # (because vault_policy.occ-main_prod is not in configuration)
- resource "vault_policy" "occ-main_prod" {
-       id     = "occ-main-prod" -> null
-       name   = "occ-main-prod" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ-main" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ-main/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.occ_ci will be created
+ resource "vault_policy" "occ_ci" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "ci-occ"
+       policy          = <<-EOT
            path "secret/data/secretspec/occ/ci/*" {
              capabilities = ["read"]
            }
        EOT
    }

  # vault_policy.occ_dev will be created
+ resource "vault_policy" "occ_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "occ-dev"
+       policy          = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ_prod will be created
+ resource "vault_policy" "occ_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "occ-prod"
+       policy          = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 7 to add, 1 to change, 16 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 7 to add, 1 to change, 16 to destroy.

Plan Summary

3 projects, 1 with changes, 0 with no changes, 2 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `openbao` dir: `tofu/openbao` workspace: `default` --- ### 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #520. To continue, delete the lock from #520 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `git` dir: `tofu/git` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #519. To continue, delete the lock from #519 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Compiling governance-schema v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/522/default/crates/governance-schema) Compiling governance-core v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/522/default/crates/governance-core) Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/522/default/crates/governance-tfgen) Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/522/default/crates/governance-cli) Finished `release` profile [optimized] target(s) in 9.43s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) - destroy OpenTofu will perform the following actions: # vault_identity_entity.collar_ci will be destroyed # (because vault_identity_entity.collar_ci is not in configuration) - resource "vault_identity_entity" "collar_ci" { - disabled = false -> null - external_policies = false -> null - id = "5965f6b6-82e2-be90-a09f-79e9f1e20157" -> null - metadata = {} -> null - name = "ci-collar" -> null - policies = [ - "ci-collar", ] -> null } # vault_identity_entity.occ_ci will be updated in-place ! resource "vault_identity_entity" "occ_ci" { id = "69cf8230-f1ae-42ba-09e6-668620d78889" name = "ci-occ" ! policies = [ - "ci-occ-main", + "ci-occ", ] # (3 unchanged attributes hidden) } # vault_identity_entity_alias.collar_ci will be destroyed # (because vault_identity_entity_alias.collar_ci is not in configuration) - resource "vault_identity_entity_alias" "collar_ci" { - canonical_id = "5965f6b6-82e2-be90-a09f-79e9f1e20157" -> null - custom_metadata = {} -> null - id = "52cbe161-4299-13c1-d5e6-3d77c4dc0502" -> null - mount_accessor = "auth_jwt_d7c2ba6c" -> null - name = "ScottyLabs/collar" -> null } # vault_identity_group.collar_admins will be destroyed # (because vault_identity_group.collar_admins is not in configuration) - resource "vault_identity_group" "collar_admins" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "7112e64a-668a-1018-8fd1-8ffdc9d930bd" -> null - member_entity_ids = [ - "ecb8811e-4c70-d527-2750-5ed1de498ed0", ] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "collar-admins" -> null - policies = [ - "collar-prod", ] -> null - type = "external" -> null } # vault_identity_group.collar_members will be destroyed # (because vault_identity_group.collar_members is not in configuration) - resource "vault_identity_group" "collar_members" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "06c38b8d-d991-6abe-67c9-8f5d49e47554" -> null - member_entity_ids = [ - "ecb8811e-4c70-d527-2750-5ed1de498ed0", ] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "collar-members" -> null - policies = [ - "collar-dev", ] -> null - type = "external" -> null } # vault_identity_group.occ-main_admins will be destroyed # (because vault_identity_group.occ-main_admins is not in configuration) - resource "vault_identity_group" "occ-main_admins" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null - member_entity_ids = [] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "occ-main-admins" -> null - policies = [ - "occ-main-prod", ] -> null - type = "external" -> null } # vault_identity_group.occ-main_members will be destroyed # (because vault_identity_group.occ-main_members is not in configuration) - resource "vault_identity_group" "occ-main_members" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null - member_entity_ids = [ - "2d55e58a-77b6-5153-e47c-22debc528d82", ] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "occ-main-members" -> null - policies = [ - "occ-main-dev", ] -> null - type = "external" -> null } # vault_identity_group.occ_admins will be created + resource "vault_identity_group" "occ_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "occ-admins" + policies = [ + "occ-prod", ] + type = "external" } # vault_identity_group.occ_members will be created + resource "vault_identity_group" "occ_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "occ-members" + policies = [ + "occ-dev", ] + type = "external" } # vault_identity_group_alias.collar_admins will be destroyed # (because vault_identity_group_alias.collar_admins is not in configuration) - resource "vault_identity_group_alias" "collar_admins" { - canonical_id = "7112e64a-668a-1018-8fd1-8ffdc9d930bd" -> null - id = "cd94513b-1663-f335-fa33-1388b75faeef" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/collar/admins" -> null } # vault_identity_group_alias.collar_members will be destroyed # (because vault_identity_group_alias.collar_members is not in configuration) - resource "vault_identity_group_alias" "collar_members" { - canonical_id = "06c38b8d-d991-6abe-67c9-8f5d49e47554" -> null - id = "e3a74822-5f31-9fa3-4dcb-0b065215e86f" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/collar" -> null } # vault_identity_group_alias.occ-main_admins will be destroyed # (because vault_identity_group_alias.occ-main_admins is not in configuration) - resource "vault_identity_group_alias" "occ-main_admins" { - canonical_id = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null - id = "c8dc72bc-9884-1686-49d8-cecb82e0486c" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/occ-main/admins" -> null } # vault_identity_group_alias.occ-main_members will be destroyed # (because vault_identity_group_alias.occ-main_members is not in configuration) - resource "vault_identity_group_alias" "occ-main_members" { - canonical_id = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null - id = "5015685b-a07d-7b14-87aa-855ac72441a9" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/occ-main" -> null } # vault_identity_group_alias.occ_admins will be created + resource "vault_identity_group_alias" "occ_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/occ/admins" } # vault_identity_group_alias.occ_members will be created + resource "vault_identity_group_alias" "occ_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/occ" } # vault_policy.collar_ci will be destroyed # (because vault_policy.collar_ci is not in configuration) - resource "vault_policy" "collar_ci" { - id = "ci-collar" -> null - name = "ci-collar" -> null - policy = <<-EOT path "secret/data/secretspec/collar/ci/*" { capabilities = ["read"] } EOT -> null } # vault_policy.collar_dev will be destroyed # (because vault_policy.collar_dev is not in configuration) - resource "vault_policy" "collar_dev" { - id = "collar-dev" -> null - name = "collar-dev" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/collar" { capabilities = ["list"] } path "secret/data/secretspec/collar/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/collar/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/collar/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/collar/preview/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.collar_prod will be destroyed # (because vault_policy.collar_prod is not in configuration) - resource "vault_policy" "collar_prod" { - id = "collar-prod" -> null - name = "collar-prod" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/collar" { capabilities = ["list"] } path "secret/data/secretspec/collar/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/collar/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/collar/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/collar/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/collar/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/collar/ci/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.occ-main_ci will be destroyed # (because vault_policy.occ-main_ci is not in configuration) - resource "vault_policy" "occ-main_ci" { - id = "ci-occ-main" -> null - name = "ci-occ-main" -> null - policy = <<-EOT path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["read"] } EOT -> null } # vault_policy.occ-main_dev will be destroyed # (because vault_policy.occ-main_dev is not in configuration) - resource "vault_policy" "occ-main_dev" { - id = "occ-main-dev" -> null - name = "occ-main-dev" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ-main" { capabilities = ["list"] } path "secret/data/secretspec/occ-main/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.occ-main_prod will be destroyed # (because vault_policy.occ-main_prod is not in configuration) - resource "vault_policy" "occ-main_prod" { - id = "occ-main-prod" -> null - name = "occ-main-prod" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ-main" { capabilities = ["list"] } path "secret/data/secretspec/occ-main/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.occ_ci will be created + resource "vault_policy" "occ_ci" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "ci-occ" + policy = <<-EOT path "secret/data/secretspec/occ/ci/*" { capabilities = ["read"] } EOT } # vault_policy.occ_dev will be created + resource "vault_policy" "occ_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "occ-dev" + policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ" { capabilities = ["list"] } path "secret/data/secretspec/occ/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ_prod will be created + resource "vault_policy" "occ_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "occ-prod" + policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ" { capabilities = ["list"] } path "secret/data/secretspec/occ/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 7 to add, 1 to change, 16 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 7 to add, 1 to change, 16 to destroy. --- ### Plan Summary 3 projects, 1 with changes, 0 with no changes, 2 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

scottylabs-bot commented

2026-10-16 23:11:01 +00:00

Owner

Ran Plan for 3 projects:

project: git dir: tofu/git workspace: default
project: keycloak dir: tofu/keycloak workspace: default
project: openbao dir: tofu/openbao workspace: default

1. project: `git` dir: `tofu/git` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #519. To continue, delete the lock from #519 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #520. To continue, delete the lock from #520 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Finished `release` profile [optimized] target(s) in 0.06s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)
- destroy

OpenTofu will perform the following actions:

  # vault_identity_entity.occ_ci will be updated in-place
! resource "vault_identity_entity" "occ_ci" {
        id                = "69cf8230-f1ae-42ba-09e6-668620d78889"
        name              = "ci-occ"
!       policies          = [
-           "ci-occ-main",
+           "ci-occ",
        ]
        # (3 unchanged attributes hidden)
    }

  # vault_identity_group.occ-main_admins will be destroyed
  # (because vault_identity_group.occ-main_admins is not in configuration)
- resource "vault_identity_group" "occ-main_admins" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null
-       member_entity_ids          = [] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "occ-main-admins" -> null
-       policies                   = [
-           "occ-main-prod",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.occ-main_members will be destroyed
  # (because vault_identity_group.occ-main_members is not in configuration)
- resource "vault_identity_group" "occ-main_members" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null
-       member_entity_ids          = [
-           "2d55e58a-77b6-5153-e47c-22debc528d82",
        ] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "occ-main-members" -> null
-       policies                   = [
-           "occ-main-dev",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.occ_admins will be created
+ resource "vault_identity_group" "occ_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "occ-admins"
+       policies                   = [
+           "occ-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.occ_members will be created
+ resource "vault_identity_group" "occ_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "occ-members"
+       policies                   = [
+           "occ-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.occ-main_admins will be destroyed
  # (because vault_identity_group_alias.occ-main_admins is not in configuration)
- resource "vault_identity_group_alias" "occ-main_admins" {
-       canonical_id   = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null
-       id             = "c8dc72bc-9884-1686-49d8-cecb82e0486c" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/occ-main/admins" -> null
    }

  # vault_identity_group_alias.occ-main_members will be destroyed
  # (because vault_identity_group_alias.occ-main_members is not in configuration)
- resource "vault_identity_group_alias" "occ-main_members" {
-       canonical_id   = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null
-       id             = "5015685b-a07d-7b14-87aa-855ac72441a9" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/occ-main" -> null
    }

  # vault_identity_group_alias.occ_admins will be created
+ resource "vault_identity_group_alias" "occ_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/occ/admins"
    }

  # vault_identity_group_alias.occ_members will be created
+ resource "vault_identity_group_alias" "occ_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/occ"
    }

  # vault_policy.occ-main_ci will be destroyed
  # (because vault_policy.occ-main_ci is not in configuration)
- resource "vault_policy" "occ-main_ci" {
-       id     = "ci-occ-main" -> null
-       name   = "ci-occ-main" -> null
-       policy = <<-EOT
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["read"]
            }
        EOT -> null
    }

  # vault_policy.occ-main_dev will be destroyed
  # (because vault_policy.occ-main_dev is not in configuration)
- resource "vault_policy" "occ-main_dev" {
-       id     = "occ-main-dev" -> null
-       name   = "occ-main-dev" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ-main" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ-main/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.occ-main_prod will be destroyed
  # (because vault_policy.occ-main_prod is not in configuration)
- resource "vault_policy" "occ-main_prod" {
-       id     = "occ-main-prod" -> null
-       name   = "occ-main-prod" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ-main" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ-main/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.occ_ci will be created
+ resource "vault_policy" "occ_ci" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "ci-occ"
+       policy          = <<-EOT
            path "secret/data/secretspec/occ/ci/*" {
              capabilities = ["read"]
            }
        EOT
    }

  # vault_policy.occ_dev will be created
+ resource "vault_policy" "occ_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "occ-dev"
+       policy          = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ_prod will be created
+ resource "vault_policy" "occ_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "occ-prod"
+       policy          = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 7 to add, 1 to change, 7 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 7 to add, 1 to change, 7 to destroy.

Plan Summary

3 projects, 1 with changes, 0 with no changes, 2 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `openbao` dir: `tofu/openbao` workspace: `default` --- ### 1. project: `git` dir: `tofu/git` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #519. To continue, delete the lock from #519 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `keycloak` dir: `tofu/keycloak` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #520. To continue, delete the lock from #520 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Finished `release` profile [optimized] target(s) in 0.06s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) - destroy OpenTofu will perform the following actions: # vault_identity_entity.occ_ci will be updated in-place ! resource "vault_identity_entity" "occ_ci" { id = "69cf8230-f1ae-42ba-09e6-668620d78889" name = "ci-occ" ! policies = [ - "ci-occ-main", + "ci-occ", ] # (3 unchanged attributes hidden) } # vault_identity_group.occ-main_admins will be destroyed # (because vault_identity_group.occ-main_admins is not in configuration) - resource "vault_identity_group" "occ-main_admins" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null - member_entity_ids = [] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "occ-main-admins" -> null - policies = [ - "occ-main-prod", ] -> null - type = "external" -> null } # vault_identity_group.occ-main_members will be destroyed # (because vault_identity_group.occ-main_members is not in configuration) - resource "vault_identity_group" "occ-main_members" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null - member_entity_ids = [ - "2d55e58a-77b6-5153-e47c-22debc528d82", ] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "occ-main-members" -> null - policies = [ - "occ-main-dev", ] -> null - type = "external" -> null } # vault_identity_group.occ_admins will be created + resource "vault_identity_group" "occ_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "occ-admins" + policies = [ + "occ-prod", ] + type = "external" } # vault_identity_group.occ_members will be created + resource "vault_identity_group" "occ_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "occ-members" + policies = [ + "occ-dev", ] + type = "external" } # vault_identity_group_alias.occ-main_admins will be destroyed # (because vault_identity_group_alias.occ-main_admins is not in configuration) - resource "vault_identity_group_alias" "occ-main_admins" { - canonical_id = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null - id = "c8dc72bc-9884-1686-49d8-cecb82e0486c" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/occ-main/admins" -> null } # vault_identity_group_alias.occ-main_members will be destroyed # (because vault_identity_group_alias.occ-main_members is not in configuration) - resource "vault_identity_group_alias" "occ-main_members" { - canonical_id = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null - id = "5015685b-a07d-7b14-87aa-855ac72441a9" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/occ-main" -> null } # vault_identity_group_alias.occ_admins will be created + resource "vault_identity_group_alias" "occ_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/occ/admins" } # vault_identity_group_alias.occ_members will be created + resource "vault_identity_group_alias" "occ_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/occ" } # vault_policy.occ-main_ci will be destroyed # (because vault_policy.occ-main_ci is not in configuration) - resource "vault_policy" "occ-main_ci" { - id = "ci-occ-main" -> null - name = "ci-occ-main" -> null - policy = <<-EOT path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["read"] } EOT -> null } # vault_policy.occ-main_dev will be destroyed # (because vault_policy.occ-main_dev is not in configuration) - resource "vault_policy" "occ-main_dev" { - id = "occ-main-dev" -> null - name = "occ-main-dev" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ-main" { capabilities = ["list"] } path "secret/data/secretspec/occ-main/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.occ-main_prod will be destroyed # (because vault_policy.occ-main_prod is not in configuration) - resource "vault_policy" "occ-main_prod" { - id = "occ-main-prod" -> null - name = "occ-main-prod" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ-main" { capabilities = ["list"] } path "secret/data/secretspec/occ-main/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.occ_ci will be created + resource "vault_policy" "occ_ci" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "ci-occ" + policy = <<-EOT path "secret/data/secretspec/occ/ci/*" { capabilities = ["read"] } EOT } # vault_policy.occ_dev will be created + resource "vault_policy" "occ_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "occ-dev" + policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ" { capabilities = ["list"] } path "secret/data/secretspec/occ/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ_prod will be created + resource "vault_policy" "occ_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "occ-prod" + policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ" { capabilities = ["list"] } path "secret/data/secretspec/occ/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 7 to add, 1 to change, 7 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 7 to add, 1 to change, 7 to destroy. --- ### Plan Summary 3 projects, 1 with changes, 0 with no changes, 2 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

anish commented

2026-10-16 23:19:44 +00:00

Author

Member

atlantis plan

scottylabs-bot commented

2026-10-16 23:20:31 +00:00

Owner

Ran Plan for 3 projects:

project: git dir: tofu/git workspace: default
project: openbao dir: tofu/openbao workspace: default
project: keycloak dir: tofu/keycloak workspace: default

1. project: `git` dir: `tofu/git` workspace: `default`

Plan Failed: This project is currently locked by an unapplied plan from pull #519. To continue, delete the lock from #519 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

2. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Finished `release` profile [optimized] target(s) in 0.16s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)
- destroy

OpenTofu will perform the following actions:

  # vault_identity_entity.occ_ci will be updated in-place
! resource "vault_identity_entity" "occ_ci" {
        id                = "69cf8230-f1ae-42ba-09e6-668620d78889"
        name              = "ci-occ"
!       policies          = [
-           "ci-occ-main",
+           "ci-occ",
        ]
        # (3 unchanged attributes hidden)
    }

  # vault_identity_group.occ-main_admins will be destroyed
  # (because vault_identity_group.occ-main_admins is not in configuration)
- resource "vault_identity_group" "occ-main_admins" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null
-       member_entity_ids          = [] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "occ-main-admins" -> null
-       policies                   = [
-           "occ-main-prod",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.occ-main_members will be destroyed
  # (because vault_identity_group.occ-main_members is not in configuration)
- resource "vault_identity_group" "occ-main_members" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null
-       member_entity_ids          = [
-           "2d55e58a-77b6-5153-e47c-22debc528d82",
        ] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "occ-main-members" -> null
-       policies                   = [
-           "occ-main-dev",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.occ_admins will be created
+ resource "vault_identity_group" "occ_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "occ-admins"
+       policies                   = [
+           "occ-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.occ_members will be created
+ resource "vault_identity_group" "occ_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "occ-members"
+       policies                   = [
+           "occ-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.occ-main_admins will be destroyed
  # (because vault_identity_group_alias.occ-main_admins is not in configuration)
- resource "vault_identity_group_alias" "occ-main_admins" {
-       canonical_id   = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null
-       id             = "c8dc72bc-9884-1686-49d8-cecb82e0486c" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/occ-main/admins" -> null
    }

  # vault_identity_group_alias.occ-main_members will be destroyed
  # (because vault_identity_group_alias.occ-main_members is not in configuration)
- resource "vault_identity_group_alias" "occ-main_members" {
-       canonical_id   = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null
-       id             = "5015685b-a07d-7b14-87aa-855ac72441a9" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/occ-main" -> null
    }

  # vault_identity_group_alias.occ_admins will be created
+ resource "vault_identity_group_alias" "occ_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/occ/admins"
    }

  # vault_identity_group_alias.occ_members will be created
+ resource "vault_identity_group_alias" "occ_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/occ"
    }

  # vault_policy.occ-main_ci will be destroyed
  # (because vault_policy.occ-main_ci is not in configuration)
- resource "vault_policy" "occ-main_ci" {
-       id     = "ci-occ-main" -> null
-       name   = "ci-occ-main" -> null
-       policy = <<-EOT
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["read"]
            }
        EOT -> null
    }

  # vault_policy.occ-main_dev will be destroyed
  # (because vault_policy.occ-main_dev is not in configuration)
- resource "vault_policy" "occ-main_dev" {
-       id     = "occ-main-dev" -> null
-       name   = "occ-main-dev" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ-main" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ-main/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.occ-main_prod will be destroyed
  # (because vault_policy.occ-main_prod is not in configuration)
- resource "vault_policy" "occ-main_prod" {
-       id     = "occ-main-prod" -> null
-       name   = "occ-main-prod" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ-main" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ-main/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.occ_ci will be created
+ resource "vault_policy" "occ_ci" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "ci-occ"
+       policy          = <<-EOT
            path "secret/data/secretspec/occ/ci/*" {
              capabilities = ["read"]
            }
        EOT
    }

  # vault_policy.occ_dev will be created
+ resource "vault_policy" "occ_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "occ-dev"
+       policy          = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ_prod will be created
+ resource "vault_policy" "occ_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "occ-prod"
+       policy          = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 7 to add, 1 to change, 7 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 7 to add, 1 to change, 7 to destroy.

3. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Finished `release` profile [optimized] target(s) in 0.16s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
- destroy

OpenTofu will perform the following actions:

  # keycloak_group.project_occ will be created
+ resource "keycloak_group" "project_occ" {
+       id        = (known after apply)
+       name      = "occ"
+       parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25"
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group.project_occ_admins will be created
+ resource "keycloak_group" "project_occ_admins" {
+       id        = (known after apply)
+       name      = "admins"
+       parent_id = (known after apply)
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group.project_occ_occ-main will be destroyed
  # (because keycloak_group.project_occ_occ-main is not in configuration)
- resource "keycloak_group" "project_occ_occ-main" {
-       attributes = {} -> null
-       id         = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null
-       name       = "occ-main" -> null
-       parent_id  = "9e6890c8-50a0-4b82-86b9-91791fffac25" -> null
-       path       = "/projects/occ-main" -> null
-       realm_id   = "scottylabs" -> null
    }

  # keycloak_group.project_occ_occ-main_admins will be destroyed
  # (because keycloak_group.project_occ_occ-main_admins is not in configuration)
- resource "keycloak_group" "project_occ_occ-main_admins" {
-       attributes = {} -> null
-       id         = "d764fe02-0506-4875-88c1-fc86c524fb20" -> null
-       name       = "admins" -> null
-       parent_id  = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null
-       path       = "/projects/occ-main/admins" -> null
-       realm_id   = "scottylabs" -> null
    }

  # keycloak_group_memberships.project_occ will be created
+ resource "keycloak_group_memberships" "project_occ" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "apallati",
+           "azzhou",
+           "dcrodrig",
+           "spola2",
        ]
+       realm_id = "scottylabs"
    }

  # keycloak_group_memberships.project_occ_admins will be created
+ resource "keycloak_group_memberships" "project_occ_admins" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "apallati",
+           "dcrodrig",
        ]
+       realm_id = "scottylabs"
    }

  # keycloak_group_memberships.project_occ_occ-main will be destroyed
  # (because keycloak_group_memberships.project_occ_occ-main is not in configuration)
- resource "keycloak_group_memberships" "project_occ_occ-main" {
-       group_id = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null
-       id       = "scottylabs/group-memberships/a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null
-       members  = [
-           "apallati",
-           "azzhou",
-           "dcrodrig",
-           "spola2",
        ] -> null
-       realm_id = "scottylabs" -> null
    }

  # keycloak_group_memberships.project_occ_occ-main_admins will be destroyed
  # (because keycloak_group_memberships.project_occ_occ-main_admins is not in configuration)
- resource "keycloak_group_memberships" "project_occ_occ-main_admins" {
-       group_id = "d764fe02-0506-4875-88c1-fc86c524fb20" -> null
-       id       = "scottylabs/group-memberships/d764fe02-0506-4875-88c1-fc86c524fb20" -> null
-       members  = [
-           "apallati",
-           "dcrodrig",
        ] -> null
-       realm_id = "scottylabs" -> null
    }

Plan: 4 to add, 0 to change, 4 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p keycloak
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p keycloak
```

Plan: 4 to add, 0 to change, 4 to destroy.

Plan Summary

3 projects, 2 with changes, 0 with no changes, 1 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `openbao` dir: `tofu/openbao` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` --- ### 1. project: `git` dir: `tofu/git` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #519. To continue, delete the lock from #519 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Finished `release` profile [optimized] target(s) in 0.16s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) - destroy OpenTofu will perform the following actions: # vault_identity_entity.occ_ci will be updated in-place ! resource "vault_identity_entity" "occ_ci" { id = "69cf8230-f1ae-42ba-09e6-668620d78889" name = "ci-occ" ! policies = [ - "ci-occ-main", + "ci-occ", ] # (3 unchanged attributes hidden) } # vault_identity_group.occ-main_admins will be destroyed # (because vault_identity_group.occ-main_admins is not in configuration) - resource "vault_identity_group" "occ-main_admins" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null - member_entity_ids = [] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "occ-main-admins" -> null - policies = [ - "occ-main-prod", ] -> null - type = "external" -> null } # vault_identity_group.occ-main_members will be destroyed # (because vault_identity_group.occ-main_members is not in configuration) - resource "vault_identity_group" "occ-main_members" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null - member_entity_ids = [ - "2d55e58a-77b6-5153-e47c-22debc528d82", ] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "occ-main-members" -> null - policies = [ - "occ-main-dev", ] -> null - type = "external" -> null } # vault_identity_group.occ_admins will be created + resource "vault_identity_group" "occ_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "occ-admins" + policies = [ + "occ-prod", ] + type = "external" } # vault_identity_group.occ_members will be created + resource "vault_identity_group" "occ_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "occ-members" + policies = [ + "occ-dev", ] + type = "external" } # vault_identity_group_alias.occ-main_admins will be destroyed # (because vault_identity_group_alias.occ-main_admins is not in configuration) - resource "vault_identity_group_alias" "occ-main_admins" { - canonical_id = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null - id = "c8dc72bc-9884-1686-49d8-cecb82e0486c" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/occ-main/admins" -> null } # vault_identity_group_alias.occ-main_members will be destroyed # (because vault_identity_group_alias.occ-main_members is not in configuration) - resource "vault_identity_group_alias" "occ-main_members" { - canonical_id = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null - id = "5015685b-a07d-7b14-87aa-855ac72441a9" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/occ-main" -> null } # vault_identity_group_alias.occ_admins will be created + resource "vault_identity_group_alias" "occ_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/occ/admins" } # vault_identity_group_alias.occ_members will be created + resource "vault_identity_group_alias" "occ_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/occ" } # vault_policy.occ-main_ci will be destroyed # (because vault_policy.occ-main_ci is not in configuration) - resource "vault_policy" "occ-main_ci" { - id = "ci-occ-main" -> null - name = "ci-occ-main" -> null - policy = <<-EOT path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["read"] } EOT -> null } # vault_policy.occ-main_dev will be destroyed # (because vault_policy.occ-main_dev is not in configuration) - resource "vault_policy" "occ-main_dev" { - id = "occ-main-dev" -> null - name = "occ-main-dev" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ-main" { capabilities = ["list"] } path "secret/data/secretspec/occ-main/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.occ-main_prod will be destroyed # (because vault_policy.occ-main_prod is not in configuration) - resource "vault_policy" "occ-main_prod" { - id = "occ-main-prod" -> null - name = "occ-main-prod" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ-main" { capabilities = ["list"] } path "secret/data/secretspec/occ-main/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.occ_ci will be created + resource "vault_policy" "occ_ci" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "ci-occ" + policy = <<-EOT path "secret/data/secretspec/occ/ci/*" { capabilities = ["read"] } EOT } # vault_policy.occ_dev will be created + resource "vault_policy" "occ_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "occ-dev" + policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ" { capabilities = ["list"] } path "secret/data/secretspec/occ/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ_prod will be created + resource "vault_policy" "occ_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "occ-prod" + policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ" { capabilities = ["list"] } path "secret/data/secretspec/occ/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 7 to add, 1 to change, 7 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 7 to add, 1 to change, 7 to destroy. --- ### 3. project: `keycloak` dir: `tofu/keycloak` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Finished `release` profile [optimized] target(s) in 0.16s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create - destroy OpenTofu will perform the following actions: # keycloak_group.project_occ will be created + resource "keycloak_group" "project_occ" { + id = (known after apply) + name = "occ" + parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25" + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group.project_occ_admins will be created + resource "keycloak_group" "project_occ_admins" { + id = (known after apply) + name = "admins" + parent_id = (known after apply) + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group.project_occ_occ-main will be destroyed # (because keycloak_group.project_occ_occ-main is not in configuration) - resource "keycloak_group" "project_occ_occ-main" { - attributes = {} -> null - id = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null - name = "occ-main" -> null - parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25" -> null - path = "/projects/occ-main" -> null - realm_id = "scottylabs" -> null } # keycloak_group.project_occ_occ-main_admins will be destroyed # (because keycloak_group.project_occ_occ-main_admins is not in configuration) - resource "keycloak_group" "project_occ_occ-main_admins" { - attributes = {} -> null - id = "d764fe02-0506-4875-88c1-fc86c524fb20" -> null - name = "admins" -> null - parent_id = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null - path = "/projects/occ-main/admins" -> null - realm_id = "scottylabs" -> null } # keycloak_group_memberships.project_occ will be created + resource "keycloak_group_memberships" "project_occ" { + group_id = (known after apply) + id = (known after apply) + members = [ + "apallati", + "azzhou", + "dcrodrig", + "spola2", ] + realm_id = "scottylabs" } # keycloak_group_memberships.project_occ_admins will be created + resource "keycloak_group_memberships" "project_occ_admins" { + group_id = (known after apply) + id = (known after apply) + members = [ + "apallati", + "dcrodrig", ] + realm_id = "scottylabs" } # keycloak_group_memberships.project_occ_occ-main will be destroyed # (because keycloak_group_memberships.project_occ_occ-main is not in configuration) - resource "keycloak_group_memberships" "project_occ_occ-main" { - group_id = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null - id = "scottylabs/group-memberships/a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null - members = [ - "apallati", - "azzhou", - "dcrodrig", - "spola2", ] -> null - realm_id = "scottylabs" -> null } # keycloak_group_memberships.project_occ_occ-main_admins will be destroyed # (because keycloak_group_memberships.project_occ_occ-main_admins is not in configuration) - resource "keycloak_group_memberships" "project_occ_occ-main_admins" { - group_id = "d764fe02-0506-4875-88c1-fc86c524fb20" -> null - id = "scottylabs/group-memberships/d764fe02-0506-4875-88c1-fc86c524fb20" -> null - members = [ - "apallati", - "dcrodrig", ] -> null - realm_id = "scottylabs" -> null } Plan: 4 to add, 0 to change, 4 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p keycloak ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fkeycloak%252Fdefault%252Fkeycloak) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p keycloak ``` Plan: 4 to add, 0 to change, 4 to destroy. --- ### Plan Summary 3 projects, 2 with changes, 0 with no changes, 1 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

anish commented

2026-10-16 23:20:59 +00:00

Author

Member

atlantis plan

scottylabs-bot commented

2026-10-16 23:21:43 +00:00

Owner

Ran Plan for 3 projects:

project: openbao dir: tofu/openbao workspace: default
project: keycloak dir: tofu/keycloak workspace: default
project: git dir: tofu/git workspace: default

1. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Finished `release` profile [optimized] target(s) in 0.12s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)
- destroy

OpenTofu will perform the following actions:

  # vault_identity_entity.occ_ci will be updated in-place
! resource "vault_identity_entity" "occ_ci" {
        id                = "69cf8230-f1ae-42ba-09e6-668620d78889"
        name              = "ci-occ"
!       policies          = [
-           "ci-occ-main",
+           "ci-occ",
        ]
        # (3 unchanged attributes hidden)
    }

  # vault_identity_group.occ-main_admins will be destroyed
  # (because vault_identity_group.occ-main_admins is not in configuration)
- resource "vault_identity_group" "occ-main_admins" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null
-       member_entity_ids          = [] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "occ-main-admins" -> null
-       policies                   = [
-           "occ-main-prod",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.occ-main_members will be destroyed
  # (because vault_identity_group.occ-main_members is not in configuration)
- resource "vault_identity_group" "occ-main_members" {
-       external_member_entity_ids = false -> null
-       external_member_group_ids  = false -> null
-       external_policies          = false -> null
-       id                         = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null
-       member_entity_ids          = [
-           "2d55e58a-77b6-5153-e47c-22debc528d82",
        ] -> null
-       member_group_ids           = [] -> null
-       metadata                   = {} -> null
-       name                       = "occ-main-members" -> null
-       policies                   = [
-           "occ-main-dev",
        ] -> null
-       type                       = "external" -> null
    }

  # vault_identity_group.occ_admins will be created
+ resource "vault_identity_group" "occ_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "occ-admins"
+       policies                   = [
+           "occ-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.occ_members will be created
+ resource "vault_identity_group" "occ_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "occ-members"
+       policies                   = [
+           "occ-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.occ-main_admins will be destroyed
  # (because vault_identity_group_alias.occ-main_admins is not in configuration)
- resource "vault_identity_group_alias" "occ-main_admins" {
-       canonical_id   = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null
-       id             = "c8dc72bc-9884-1686-49d8-cecb82e0486c" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/occ-main/admins" -> null
    }

  # vault_identity_group_alias.occ-main_members will be destroyed
  # (because vault_identity_group_alias.occ-main_members is not in configuration)
- resource "vault_identity_group_alias" "occ-main_members" {
-       canonical_id   = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null
-       id             = "5015685b-a07d-7b14-87aa-855ac72441a9" -> null
-       mount_accessor = "auth_oidc_375ac979" -> null
-       name           = "/projects/occ-main" -> null
    }

  # vault_identity_group_alias.occ_admins will be created
+ resource "vault_identity_group_alias" "occ_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/occ/admins"
    }

  # vault_identity_group_alias.occ_members will be created
+ resource "vault_identity_group_alias" "occ_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/occ"
    }

  # vault_policy.occ-main_ci will be destroyed
  # (because vault_policy.occ-main_ci is not in configuration)
- resource "vault_policy" "occ-main_ci" {
-       id     = "ci-occ-main" -> null
-       name   = "ci-occ-main" -> null
-       policy = <<-EOT
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["read"]
            }
        EOT -> null
    }

  # vault_policy.occ-main_dev will be destroyed
  # (because vault_policy.occ-main_dev is not in configuration)
- resource "vault_policy" "occ-main_dev" {
-       id     = "occ-main-dev" -> null
-       name   = "occ-main-dev" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ-main" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ-main/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.occ-main_prod will be destroyed
  # (because vault_policy.occ-main_prod is not in configuration)
- resource "vault_policy" "occ-main_prod" {
-       id     = "occ-main-prod" -> null
-       name   = "occ-main-prod" -> null
-       policy = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ-main" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ-main/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT -> null
    }

  # vault_policy.occ_ci will be created
+ resource "vault_policy" "occ_ci" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "ci-occ"
+       policy          = <<-EOT
            path "secret/data/secretspec/occ/ci/*" {
              capabilities = ["read"]
            }
        EOT
    }

  # vault_policy.occ_dev will be created
+ resource "vault_policy" "occ_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "occ-dev"
+       policy          = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ_prod will be created
+ resource "vault_policy" "occ_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "occ-prod"
+       policy          = <<-EOT
            path "secret/metadata/secretspec" {
              capabilities = ["list"]
            }
            
            path "secret/metadata/secretspec/occ" {
              capabilities = ["list"]
            }
            
            path "secret/data/secretspec/occ/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 7 to add, 1 to change, 7 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p openbao
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p openbao
```

Plan: 7 to add, 1 to change, 7 to destroy.

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 0.13s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
- destroy

OpenTofu will perform the following actions:

  # keycloak_group.project_occ will be created
+ resource "keycloak_group" "project_occ" {
+       id        = (known after apply)
+       name      = "occ"
+       parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25"
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group.project_occ_admins will be created
+ resource "keycloak_group" "project_occ_admins" {
+       id        = (known after apply)
+       name      = "admins"
+       parent_id = (known after apply)
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group.project_occ_occ-main will be destroyed
  # (because keycloak_group.project_occ_occ-main is not in configuration)
- resource "keycloak_group" "project_occ_occ-main" {
-       attributes = {} -> null
-       id         = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null
-       name       = "occ-main" -> null
-       parent_id  = "9e6890c8-50a0-4b82-86b9-91791fffac25" -> null
-       path       = "/projects/occ-main" -> null
-       realm_id   = "scottylabs" -> null
    }

  # keycloak_group.project_occ_occ-main_admins will be destroyed
  # (because keycloak_group.project_occ_occ-main_admins is not in configuration)
- resource "keycloak_group" "project_occ_occ-main_admins" {
-       attributes = {} -> null
-       id         = "d764fe02-0506-4875-88c1-fc86c524fb20" -> null
-       name       = "admins" -> null
-       parent_id  = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null
-       path       = "/projects/occ-main/admins" -> null
-       realm_id   = "scottylabs" -> null
    }

  # keycloak_group_memberships.project_occ will be created
+ resource "keycloak_group_memberships" "project_occ" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "apallati",
+           "azzhou",
+           "dcrodrig",
+           "spola2",
        ]
+       realm_id = "scottylabs"
    }

  # keycloak_group_memberships.project_occ_admins will be created
+ resource "keycloak_group_memberships" "project_occ_admins" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "apallati",
+           "dcrodrig",
        ]
+       realm_id = "scottylabs"
    }

  # keycloak_group_memberships.project_occ_occ-main will be destroyed
  # (because keycloak_group_memberships.project_occ_occ-main is not in configuration)
- resource "keycloak_group_memberships" "project_occ_occ-main" {
-       group_id = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null
-       id       = "scottylabs/group-memberships/a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null
-       members  = [
-           "apallati",
-           "azzhou",
-           "dcrodrig",
-           "spola2",
        ] -> null
-       realm_id = "scottylabs" -> null
    }

  # keycloak_group_memberships.project_occ_occ-main_admins will be destroyed
  # (because keycloak_group_memberships.project_occ_occ-main_admins is not in configuration)
- resource "keycloak_group_memberships" "project_occ_occ-main_admins" {
-       group_id = "d764fe02-0506-4875-88c1-fc86c524fb20" -> null
-       id       = "scottylabs/group-memberships/d764fe02-0506-4875-88c1-fc86c524fb20" -> null
-       members  = [
-           "apallati",
-           "dcrodrig",
        ] -> null
-       realm_id = "scottylabs" -> null
    }

Plan: 4 to add, 0 to change, 4 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p keycloak
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p keycloak
```

Plan: 4 to add, 0 to change, 4 to destroy.

3. project: `git` dir: `tofu/git` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 0.15s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
! update in-place (current -> planned)
- destroy

OpenTofu will perform the following actions:

  # forgejo_team.occ-main_leads will be destroyed
  # (because forgejo_team.occ-main_leads is not in configuration)
- resource "forgejo_team" "occ-main_leads" {
-       can_create_org_repo       = false -> null
-       description               = "OCC leads" -> null
-       id                        = 32 -> null
-       includes_all_repositories = false -> null
-       name                      = "occ-main-leads" -> null
-       organization              = "ScottyLabs" -> null
-       organization_id           = 3 -> null
-       permission                = "admin" -> null
-       units_map                 = {
          - "repo.actions"    = "admin"
          - "repo.code"       = "admin"
          - "repo.ext_issues" = "admin"
          - "repo.ext_wiki"   = "admin"
          - "repo.issues"     = "admin"
          - "repo.packages"   = "admin"
          - "repo.projects"   = "admin"
          - "repo.pulls"      = "admin"
          - "repo.releases"   = "admin"
          - "repo.wiki"       = "admin"
        } -> null
    }

  # forgejo_team.occ_leads will be created
+ resource "forgejo_team" "occ_leads" {
+       can_create_org_repo       = false
+       description               = "OCC leads"
+       id                        = (known after apply)
+       includes_all_repositories = false
+       name                      = "occ-leads"
+       organization              = (known after apply)
+       organization_id           = 3
+       permission                = "admin"
+       units_map                 = {
          + "repo.actions"    = "admin"
          + "repo.code"       = "admin"
          + "repo.ext_issues" = "admin"
          + "repo.ext_wiki"   = "admin"
          + "repo.issues"     = "admin"
          + "repo.packages"   = "admin"
          + "repo.projects"   = "admin"
          + "repo.pulls"      = "admin"
          + "repo.releases"   = "admin"
          + "repo.wiki"       = "admin"
        }
    }

  # forgejo_team_member.occ-main_leads_anish will be destroyed
  # (because forgejo_team_member.occ-main_leads_anish is not in configuration)
- resource "forgejo_team_member" "occ-main_leads_anish" {
-       team_id = 32 -> null
-       user    = "anish" -> null
    }

  # forgejo_team_member.occ-main_leads_dcrodrig will be destroyed
  # (because forgejo_team_member.occ-main_leads_dcrodrig is not in configuration)
- resource "forgejo_team_member" "occ-main_leads_dcrodrig" {
-       team_id = 32 -> null
-       user    = "dcrodrig" -> null
    }

  # forgejo_team_member.occ_leads_anish will be created
+ resource "forgejo_team_member" "occ_leads_anish" {
+       team_id = (known after apply)
+       user    = "anish"
    }

  # forgejo_team_member.occ_leads_dcrodrig will be created
+ resource "forgejo_team_member" "occ_leads_dcrodrig" {
+       team_id = (known after apply)
+       user    = "dcrodrig"
    }

  # forgejo_team_repository.occ-main_leads_occ will be destroyed
  # (because forgejo_team_repository.occ-main_leads_occ is not in configuration)
- resource "forgejo_team_repository" "occ-main_leads_occ" {
-       owner      = "ScottyLabs" -> null
-       repository = "occ" -> null
-       team_id    = 32 -> null
    }

  # forgejo_team_repository.occ_leads_occ will be created
+ resource "forgejo_team_repository" "occ_leads_occ" {
+       owner      = "ScottyLabs"
+       repository = "occ"
+       team_id    = (known after apply)
    }

  # github_repository.slai_cmugpt_agent will be updated in-place
! resource "github_repository" "slai_cmugpt_agent" {
        id                                      = "cmugpt-agent"
        name                                    = "cmugpt-agent"
        # (39 unchanged attributes hidden)

-       template {
-           include_all_branches = false -> null
-           owner                = "ScottyLabs" -> null
-           repository           = "python-template" -> null
        }

        # (1 unchanged block hidden)
    }

  # restapi_object.occ_occ_docs_webhook will be created
+ resource "restapi_object" "occ_occ_docs_webhook" {
+       api_data        = (known after apply)
+       api_response    = (known after apply)
+       create_response = (known after apply)
+       data            = jsonencode(
            {
+               active = true
+               config = {
+                   content_type = "json"
+                   url          = "https://webhooks.scottylabs.org/hooks/docs-diagrams"
                }
+               events = [
+                   "push",
                ]
+               type   = "forgejo"
            }
        )
+       id              = (known after apply)
+       id_attribute    = "id"
+       path            = "/api/v1/repos/ScottyLabs/occ/hooks"
+       update_method   = "PATCH"
    }

  # restapi_object.occ_occ_kennel_webhook will be created
+ resource "restapi_object" "occ_occ_kennel_webhook" {
+       api_data        = (known after apply)
+       api_response    = (known after apply)
+       create_response = (known after apply)
+       data            = (sensitive value)
+       id              = (known after apply)
+       id_attribute    = "id"
+       path            = "/api/v1/repos/ScottyLabs/occ/hooks"
+       update_method   = "PATCH"
    }

Plan: 6 to add, 1 to change, 4 to destroy.

▶️ To apply this plan, comment:
```
atlantis apply -p git
```
🚮 To delete this plan and lock, click here
🔁 To plan this project again, comment:
```
atlantis plan -p git
```

Plan: 6 to add, 1 to change, 4 to destroy.

Plan Summary

3 projects, 3 with changes, 0 with no changes, 0 failed

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

Ran Plan for 3 projects: 1. project: `openbao` dir: `tofu/openbao` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `git` dir: `tofu/git` workspace: `default` --- ### 1. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Finished `release` profile [optimized] target(s) in 0.12s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) - destroy OpenTofu will perform the following actions: # vault_identity_entity.occ_ci will be updated in-place ! resource "vault_identity_entity" "occ_ci" { id = "69cf8230-f1ae-42ba-09e6-668620d78889" name = "ci-occ" ! policies = [ - "ci-occ-main", + "ci-occ", ] # (3 unchanged attributes hidden) } # vault_identity_group.occ-main_admins will be destroyed # (because vault_identity_group.occ-main_admins is not in configuration) - resource "vault_identity_group" "occ-main_admins" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null - member_entity_ids = [] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "occ-main-admins" -> null - policies = [ - "occ-main-prod", ] -> null - type = "external" -> null } # vault_identity_group.occ-main_members will be destroyed # (because vault_identity_group.occ-main_members is not in configuration) - resource "vault_identity_group" "occ-main_members" { - external_member_entity_ids = false -> null - external_member_group_ids = false -> null - external_policies = false -> null - id = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null - member_entity_ids = [ - "2d55e58a-77b6-5153-e47c-22debc528d82", ] -> null - member_group_ids = [] -> null - metadata = {} -> null - name = "occ-main-members" -> null - policies = [ - "occ-main-dev", ] -> null - type = "external" -> null } # vault_identity_group.occ_admins will be created + resource "vault_identity_group" "occ_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "occ-admins" + policies = [ + "occ-prod", ] + type = "external" } # vault_identity_group.occ_members will be created + resource "vault_identity_group" "occ_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "occ-members" + policies = [ + "occ-dev", ] + type = "external" } # vault_identity_group_alias.occ-main_admins will be destroyed # (because vault_identity_group_alias.occ-main_admins is not in configuration) - resource "vault_identity_group_alias" "occ-main_admins" { - canonical_id = "4d40db70-1bac-505e-ec8d-5a9d5cf15ac7" -> null - id = "c8dc72bc-9884-1686-49d8-cecb82e0486c" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/occ-main/admins" -> null } # vault_identity_group_alias.occ-main_members will be destroyed # (because vault_identity_group_alias.occ-main_members is not in configuration) - resource "vault_identity_group_alias" "occ-main_members" { - canonical_id = "50f2ddd4-6176-1f31-874a-d6964ba6db30" -> null - id = "5015685b-a07d-7b14-87aa-855ac72441a9" -> null - mount_accessor = "auth_oidc_375ac979" -> null - name = "/projects/occ-main" -> null } # vault_identity_group_alias.occ_admins will be created + resource "vault_identity_group_alias" "occ_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/occ/admins" } # vault_identity_group_alias.occ_members will be created + resource "vault_identity_group_alias" "occ_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/occ" } # vault_policy.occ-main_ci will be destroyed # (because vault_policy.occ-main_ci is not in configuration) - resource "vault_policy" "occ-main_ci" { - id = "ci-occ-main" -> null - name = "ci-occ-main" -> null - policy = <<-EOT path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["read"] } EOT -> null } # vault_policy.occ-main_dev will be destroyed # (because vault_policy.occ-main_dev is not in configuration) - resource "vault_policy" "occ-main_dev" { - id = "occ-main-dev" -> null - name = "occ-main-dev" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ-main" { capabilities = ["list"] } path "secret/data/secretspec/occ-main/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.occ-main_prod will be destroyed # (because vault_policy.occ-main_prod is not in configuration) - resource "vault_policy" "occ-main_prod" { - id = "occ-main-prod" -> null - name = "occ-main-prod" -> null - policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ-main" { capabilities = ["list"] } path "secret/data/secretspec/occ-main/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT -> null } # vault_policy.occ_ci will be created + resource "vault_policy" "occ_ci" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "ci-occ" + policy = <<-EOT path "secret/data/secretspec/occ/ci/*" { capabilities = ["read"] } EOT } # vault_policy.occ_dev will be created + resource "vault_policy" "occ_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "occ-dev" + policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ" { capabilities = ["list"] } path "secret/data/secretspec/occ/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ_prod will be created + resource "vault_policy" "occ_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "occ-prod" + policy = <<-EOT path "secret/metadata/secretspec" { capabilities = ["list"] } path "secret/metadata/secretspec/occ" { capabilities = ["list"] } path "secret/data/secretspec/occ/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 7 to add, 1 to change, 7 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 7 to add, 1 to change, 7 to destroy. --- ### 2. project: `keycloak` dir: `tofu/keycloak` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 0.13s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create - destroy OpenTofu will perform the following actions: # keycloak_group.project_occ will be created + resource "keycloak_group" "project_occ" { + id = (known after apply) + name = "occ" + parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25" + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group.project_occ_admins will be created + resource "keycloak_group" "project_occ_admins" { + id = (known after apply) + name = "admins" + parent_id = (known after apply) + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group.project_occ_occ-main will be destroyed # (because keycloak_group.project_occ_occ-main is not in configuration) - resource "keycloak_group" "project_occ_occ-main" { - attributes = {} -> null - id = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null - name = "occ-main" -> null - parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25" -> null - path = "/projects/occ-main" -> null - realm_id = "scottylabs" -> null } # keycloak_group.project_occ_occ-main_admins will be destroyed # (because keycloak_group.project_occ_occ-main_admins is not in configuration) - resource "keycloak_group" "project_occ_occ-main_admins" { - attributes = {} -> null - id = "d764fe02-0506-4875-88c1-fc86c524fb20" -> null - name = "admins" -> null - parent_id = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null - path = "/projects/occ-main/admins" -> null - realm_id = "scottylabs" -> null } # keycloak_group_memberships.project_occ will be created + resource "keycloak_group_memberships" "project_occ" { + group_id = (known after apply) + id = (known after apply) + members = [ + "apallati", + "azzhou", + "dcrodrig", + "spola2", ] + realm_id = "scottylabs" } # keycloak_group_memberships.project_occ_admins will be created + resource "keycloak_group_memberships" "project_occ_admins" { + group_id = (known after apply) + id = (known after apply) + members = [ + "apallati", + "dcrodrig", ] + realm_id = "scottylabs" } # keycloak_group_memberships.project_occ_occ-main will be destroyed # (because keycloak_group_memberships.project_occ_occ-main is not in configuration) - resource "keycloak_group_memberships" "project_occ_occ-main" { - group_id = "a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null - id = "scottylabs/group-memberships/a4e98eec-77cf-49f8-8ea6-32cf6332cf36" -> null - members = [ - "apallati", - "azzhou", - "dcrodrig", - "spola2", ] -> null - realm_id = "scottylabs" -> null } # keycloak_group_memberships.project_occ_occ-main_admins will be destroyed # (because keycloak_group_memberships.project_occ_occ-main_admins is not in configuration) - resource "keycloak_group_memberships" "project_occ_occ-main_admins" { - group_id = "d764fe02-0506-4875-88c1-fc86c524fb20" -> null - id = "scottylabs/group-memberships/d764fe02-0506-4875-88c1-fc86c524fb20" -> null - members = [ - "apallati", - "dcrodrig", ] -> null - realm_id = "scottylabs" -> null } Plan: 4 to add, 0 to change, 4 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p keycloak ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fkeycloak%252Fdefault%252Fkeycloak) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p keycloak ``` Plan: 4 to add, 0 to change, 4 to destroy. --- ### 3. project: `git` dir: `tofu/git` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 0.15s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create ! update in-place (current -> planned) - destroy OpenTofu will perform the following actions: # forgejo_team.occ-main_leads will be destroyed # (because forgejo_team.occ-main_leads is not in configuration) - resource "forgejo_team" "occ-main_leads" { - can_create_org_repo = false -> null - description = "OCC leads" -> null - id = 32 -> null - includes_all_repositories = false -> null - name = "occ-main-leads" -> null - organization = "ScottyLabs" -> null - organization_id = 3 -> null - permission = "admin" -> null - units_map = { - "repo.actions" = "admin" - "repo.code" = "admin" - "repo.ext_issues" = "admin" - "repo.ext_wiki" = "admin" - "repo.issues" = "admin" - "repo.packages" = "admin" - "repo.projects" = "admin" - "repo.pulls" = "admin" - "repo.releases" = "admin" - "repo.wiki" = "admin" } -> null } # forgejo_team.occ_leads will be created + resource "forgejo_team" "occ_leads" { + can_create_org_repo = false + description = "OCC leads" + id = (known after apply) + includes_all_repositories = false + name = "occ-leads" + organization = (known after apply) + organization_id = 3 + permission = "admin" + units_map = { + "repo.actions" = "admin" + "repo.code" = "admin" + "repo.ext_issues" = "admin" + "repo.ext_wiki" = "admin" + "repo.issues" = "admin" + "repo.packages" = "admin" + "repo.projects" = "admin" + "repo.pulls" = "admin" + "repo.releases" = "admin" + "repo.wiki" = "admin" } } # forgejo_team_member.occ-main_leads_anish will be destroyed # (because forgejo_team_member.occ-main_leads_anish is not in configuration) - resource "forgejo_team_member" "occ-main_leads_anish" { - team_id = 32 -> null - user = "anish" -> null } # forgejo_team_member.occ-main_leads_dcrodrig will be destroyed # (because forgejo_team_member.occ-main_leads_dcrodrig is not in configuration) - resource "forgejo_team_member" "occ-main_leads_dcrodrig" { - team_id = 32 -> null - user = "dcrodrig" -> null } # forgejo_team_member.occ_leads_anish will be created + resource "forgejo_team_member" "occ_leads_anish" { + team_id = (known after apply) + user = "anish" } # forgejo_team_member.occ_leads_dcrodrig will be created + resource "forgejo_team_member" "occ_leads_dcrodrig" { + team_id = (known after apply) + user = "dcrodrig" } # forgejo_team_repository.occ-main_leads_occ will be destroyed # (because forgejo_team_repository.occ-main_leads_occ is not in configuration) - resource "forgejo_team_repository" "occ-main_leads_occ" { - owner = "ScottyLabs" -> null - repository = "occ" -> null - team_id = 32 -> null } # forgejo_team_repository.occ_leads_occ will be created + resource "forgejo_team_repository" "occ_leads_occ" { + owner = "ScottyLabs" + repository = "occ" + team_id = (known after apply) } # github_repository.slai_cmugpt_agent will be updated in-place ! resource "github_repository" "slai_cmugpt_agent" { id = "cmugpt-agent" name = "cmugpt-agent" # (39 unchanged attributes hidden) - template { - include_all_branches = false -> null - owner = "ScottyLabs" -> null - repository = "python-template" -> null } # (1 unchanged block hidden) } # restapi_object.occ_occ_docs_webhook will be created + resource "restapi_object" "occ_occ_docs_webhook" { + api_data = (known after apply) + api_response = (known after apply) + create_response = (known after apply) + data = jsonencode( { + active = true + config = { + content_type = "json" + url = "https://webhooks.scottylabs.org/hooks/docs-diagrams" } + events = [ + "push", ] + type = "forgejo" } ) + id = (known after apply) + id_attribute = "id" + path = "/api/v1/repos/ScottyLabs/occ/hooks" + update_method = "PATCH" } # restapi_object.occ_occ_kennel_webhook will be created + resource "restapi_object" "occ_occ_kennel_webhook" { + api_data = (known after apply) + api_response = (known after apply) + create_response = (known after apply) + data = (sensitive value) + id = (known after apply) + id_attribute = "id" + path = "/api/v1/repos/ScottyLabs/occ/hooks" + update_method = "PATCH" } Plan: 6 to add, 1 to change, 4 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p git ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fgit%252Fdefault%252Fgit) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p git ``` Plan: 6 to add, 1 to change, 4 to destroy. --- ### Plan Summary 3 projects, 3 with changes, 0 with no changes, 0 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

anish commented

2026-10-16 23:32:19 +00:00

Author

Member

atlantis apply

scottylabs-bot commented

2026-10-16 23:32:33 +00:00

Owner

Ran Apply for 3 projects:

project: openbao dir: tofu/openbao workspace: default
project: git dir: tofu/git workspace: default
project: keycloak dir: tofu/keycloak workspace: default

1. project: `openbao` dir: `tofu/openbao` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 0.14s

╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI
│ configuration:
│  - svalabs/forgejo in /tmp/forgejo-provider
│ 
│ The behavior may therefore not match any released version of the provider
│ and applying changes may cause the state to become incompatible with
│ published releases.
╵
vault_policy.occ-main_dev: Destroying... [id=occ-main-dev]
vault_identity_group_alias.occ-main_admins: Destroying... [id=c8dc72bc-9884-1686-49d8-cecb82e0486c]
vault_identity_group_alias.occ-main_members: Destroying... [id=5015685b-a07d-7b14-87aa-855ac72441a9]
vault_policy.occ-main_ci: Destroying... [id=ci-occ-main]
vault_policy.occ-main_prod: Destroying... [id=occ-main-prod]
vault_policy.occ_dev: Creating...
vault_policy.occ_ci: Creating...
vault_policy.occ_prod: Creating...
vault_identity_group.occ_admins: Creating...
vault_identity_group.occ_members: Creating...
vault_policy.occ-main_prod: Destruction complete after 0s
vault_identity_group_alias.occ-main_admins: Destruction complete after 0s
vault_policy.occ-main_dev: Destruction complete after 0s
vault_identity_group.occ-main_admins: Destroying... [id=4d40db70-1bac-505e-ec8d-5a9d5cf15ac7]
vault_policy.occ-main_ci: Destruction complete after 0s
vault_identity_group.occ_members: Creation complete after 0s [id=eeedf712-5c02-6f24-a362-b91f71dc2766]
vault_identity_group.occ_admins: Creation complete after 0s [id=91a05119-5777-7538-0e89-8256d86f80b2]
vault_identity_group_alias.occ_members: Creating...
vault_identity_group_alias.occ_admins: Creating...
vault_identity_group.occ-main_admins: Destruction complete after 0s
vault_identity_group_alias.occ-main_members: Destruction complete after 0s
vault_identity_group.occ-main_members: Destroying... [id=50f2ddd4-6176-1f31-874a-d6964ba6db30]
vault_policy.occ_dev: Creation complete after 0s [id=occ-dev]
vault_policy.occ_prod: Creation complete after 0s [id=occ-prod]
vault_policy.occ_ci: Creation complete after 0s [id=ci-occ]
vault_identity_entity.occ_ci: Modifying... [id=69cf8230-f1ae-42ba-09e6-668620d78889]
vault_identity_group.occ-main_members: Destruction complete after 0s
vault_identity_group_alias.occ_members: Creation complete after 0s [id=cff1d94a-f910-4f10-5d11-115887a9118a]
vault_identity_entity.occ_ci: Modifications complete after 0s [id=69cf8230-f1ae-42ba-09e6-668620d78889]
vault_identity_group_alias.occ_admins: Creation complete after 0s [id=3768a447-feea-4b3d-bead-53eb312941c2]

Apply complete! Resources: 7 added, 1 changed, 7 destroyed.

2. project: `git` dir: `tofu/git` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Finished `release` profile [optimized] target(s) in 0.12s

╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI
│ configuration:
│  - svalabs/forgejo in /tmp/forgejo-provider
│ 
│ The behavior may therefore not match any released version of the provider
│ and applying changes may cause the state to become incompatible with
│ published releases.
╵
github_repository.slai_cmugpt_agent: Modifying... [id=cmugpt-agent]
forgejo_team_member.occ-main_leads_anish: Destroying...
forgejo_team_member.occ-main_leads_dcrodrig: Destroying...
forgejo_team_repository.occ-main_leads_occ: Destroying...
forgejo_team.occ_leads: Creating...
restapi_object.occ_occ_docs_webhook: Creating...
restapi_object.occ_occ_kennel_webhook: Creating...
forgejo_team_member.occ-main_leads_anish: Destruction complete after 0s
forgejo_team_member.occ-main_leads_dcrodrig: Destruction complete after 0s
forgejo_team_repository.occ-main_leads_occ: Destruction complete after 0s
forgejo_team.occ-main_leads: Destroying... [name=occ-main-leads]
restapi_object.occ_occ_docs_webhook: Creation complete after 0s [id=37]
restapi_object.occ_occ_kennel_webhook: Creation complete after 0s [id=38]
forgejo_team.occ-main_leads: Destruction complete after 0s
forgejo_team.occ_leads: Creation complete after 0s [name=occ-leads]
forgejo_team_repository.occ_leads_occ: Creating...
forgejo_team_member.occ_leads_anish: Creating...
forgejo_team_member.occ_leads_dcrodrig: Creating...
forgejo_team_repository.occ_leads_occ: Creation complete after 0s
forgejo_team_member.occ_leads_anish: Creation complete after 0s
forgejo_team_member.occ_leads_dcrodrig: Creation complete after 0s
github_repository.slai_cmugpt_agent: Modifications complete after 2s [id=cmugpt-agent]

Apply complete! Resources: 6 added, 1 changed, 4 destroyed.

3. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

Show Output

Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 0.15s

╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI
│ configuration:
│  - svalabs/forgejo in /tmp/forgejo-provider
│ 
│ The behavior may therefore not match any released version of the provider
│ and applying changes may cause the state to become incompatible with
│ published releases.
╵
keycloak_group_memberships.project_occ_occ-main_admins: Destroying... [id=scottylabs/group-memberships/d764fe02-0506-4875-88c1-fc86c524fb20]
keycloak_group_memberships.project_occ_occ-main: Destroying... [id=scottylabs/group-memberships/a4e98eec-77cf-49f8-8ea6-32cf6332cf36]
keycloak_group.project_occ: Creating...
keycloak_group.project_occ: Creation complete after 0s [id=e54bf9c5-1db3-482d-9b0d-b396e38264ea]
keycloak_group.project_occ_admins: Creating...
keycloak_group_memberships.project_occ: Creating...
keycloak_group.project_occ_admins: Creation complete after 0s [id=b6c50ae8-acf8-40d2-a05d-4c57ed3acf7d]
keycloak_group_memberships.project_occ_admins: Creating...
keycloak_group_memberships.project_occ_admins: Creation complete after 4s [id=scottylabs/group-memberships/b6c50ae8-acf8-40d2-a05d-4c57ed3acf7d]
keycloak_group_memberships.project_occ_occ-main_admins: Destruction complete after 6s
keycloak_group.project_occ_occ-main_admins: Destroying... [id=d764fe02-0506-4875-88c1-fc86c524fb20]
keycloak_group.project_occ_occ-main_admins: Destruction complete after 0s
keycloak_group_memberships.project_occ: Creation complete after 9s [id=scottylabs/group-memberships/e54bf9c5-1db3-482d-9b0d-b396e38264ea]
keycloak_group_memberships.project_occ_occ-main: Still destroying... [id=scottylabs/group-memberships/a4e98eec-77cf-49f8-8ea6-32cf6332cf36, 10s elapsed]
keycloak_group_memberships.project_occ_occ-main: Destruction complete after 12s
keycloak_group.project_occ_occ-main: Destroying... [id=a4e98eec-77cf-49f8-8ea6-32cf6332cf36]
keycloak_group.project_occ_occ-main: Destruction complete after 0s

Apply complete! Resources: 4 added, 0 changed, 4 destroyed.

Apply Summary

3 projects, 3 successful, 0 failed, 0 errored

Ran Apply for 3 projects: 1. project: `openbao` dir: `tofu/openbao` workspace: `default` 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` --- ### 1. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 0.14s ╷ │ Warning: Provider development overrides are in effect │ │ The following provider development overrides are set in the CLI │ configuration: │ - svalabs/forgejo in /tmp/forgejo-provider │ │ The behavior may therefore not match any released version of the provider │ and applying changes may cause the state to become incompatible with │ published releases. ╵ vault_policy.occ-main_dev: Destroying... [id=occ-main-dev] vault_identity_group_alias.occ-main_admins: Destroying... [id=c8dc72bc-9884-1686-49d8-cecb82e0486c] vault_identity_group_alias.occ-main_members: Destroying... [id=5015685b-a07d-7b14-87aa-855ac72441a9] vault_policy.occ-main_ci: Destroying... [id=ci-occ-main] vault_policy.occ-main_prod: Destroying... [id=occ-main-prod] vault_policy.occ_dev: Creating... vault_policy.occ_ci: Creating... vault_policy.occ_prod: Creating... vault_identity_group.occ_admins: Creating... vault_identity_group.occ_members: Creating... vault_policy.occ-main_prod: Destruction complete after 0s vault_identity_group_alias.occ-main_admins: Destruction complete after 0s vault_policy.occ-main_dev: Destruction complete after 0s vault_identity_group.occ-main_admins: Destroying... [id=4d40db70-1bac-505e-ec8d-5a9d5cf15ac7] vault_policy.occ-main_ci: Destruction complete after 0s vault_identity_group.occ_members: Creation complete after 0s [id=eeedf712-5c02-6f24-a362-b91f71dc2766] vault_identity_group.occ_admins: Creation complete after 0s [id=91a05119-5777-7538-0e89-8256d86f80b2] vault_identity_group_alias.occ_members: Creating... vault_identity_group_alias.occ_admins: Creating... vault_identity_group.occ-main_admins: Destruction complete after 0s vault_identity_group_alias.occ-main_members: Destruction complete after 0s vault_identity_group.occ-main_members: Destroying... [id=50f2ddd4-6176-1f31-874a-d6964ba6db30] vault_policy.occ_dev: Creation complete after 0s [id=occ-dev] vault_policy.occ_prod: Creation complete after 0s [id=occ-prod] vault_policy.occ_ci: Creation complete after 0s [id=ci-occ] vault_identity_entity.occ_ci: Modifying... [id=69cf8230-f1ae-42ba-09e6-668620d78889] vault_identity_group.occ-main_members: Destruction complete after 0s vault_identity_group_alias.occ_members: Creation complete after 0s [id=cff1d94a-f910-4f10-5d11-115887a9118a] vault_identity_entity.occ_ci: Modifications complete after 0s [id=69cf8230-f1ae-42ba-09e6-668620d78889] vault_identity_group_alias.occ_admins: Creation complete after 0s [id=3768a447-feea-4b3d-bead-53eb312941c2] Apply complete! Resources: 7 added, 1 changed, 7 destroyed. ``` </details> --- ### 2. project: `git` dir: `tofu/git` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Finished `release` profile [optimized] target(s) in 0.12s ╷ │ Warning: Provider development overrides are in effect │ │ The following provider development overrides are set in the CLI │ configuration: │ - svalabs/forgejo in /tmp/forgejo-provider │ │ The behavior may therefore not match any released version of the provider │ and applying changes may cause the state to become incompatible with │ published releases. ╵ github_repository.slai_cmugpt_agent: Modifying... [id=cmugpt-agent] forgejo_team_member.occ-main_leads_anish: Destroying... forgejo_team_member.occ-main_leads_dcrodrig: Destroying... forgejo_team_repository.occ-main_leads_occ: Destroying... forgejo_team.occ_leads: Creating... restapi_object.occ_occ_docs_webhook: Creating... restapi_object.occ_occ_kennel_webhook: Creating... forgejo_team_member.occ-main_leads_anish: Destruction complete after 0s forgejo_team_member.occ-main_leads_dcrodrig: Destruction complete after 0s forgejo_team_repository.occ-main_leads_occ: Destruction complete after 0s forgejo_team.occ-main_leads: Destroying... [name=occ-main-leads] restapi_object.occ_occ_docs_webhook: Creation complete after 0s [id=37] restapi_object.occ_occ_kennel_webhook: Creation complete after 0s [id=38] forgejo_team.occ-main_leads: Destruction complete after 0s forgejo_team.occ_leads: Creation complete after 0s [name=occ-leads] forgejo_team_repository.occ_leads_occ: Creating... forgejo_team_member.occ_leads_anish: Creating... forgejo_team_member.occ_leads_dcrodrig: Creating... forgejo_team_repository.occ_leads_occ: Creation complete after 0s forgejo_team_member.occ_leads_anish: Creation complete after 0s forgejo_team_member.occ_leads_dcrodrig: Creation complete after 0s github_repository.slai_cmugpt_agent: Modifications complete after 2s [id=cmugpt-agent] Apply complete! Resources: 6 added, 1 changed, 4 destroyed. ``` </details> --- ### 3. project: `keycloak` dir: `tofu/keycloak` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 0.15s ╷ │ Warning: Provider development overrides are in effect │ │ The following provider development overrides are set in the CLI │ configuration: │ - svalabs/forgejo in /tmp/forgejo-provider │ │ The behavior may therefore not match any released version of the provider │ and applying changes may cause the state to become incompatible with │ published releases. ╵ keycloak_group_memberships.project_occ_occ-main_admins: Destroying... [id=scottylabs/group-memberships/d764fe02-0506-4875-88c1-fc86c524fb20] keycloak_group_memberships.project_occ_occ-main: Destroying... [id=scottylabs/group-memberships/a4e98eec-77cf-49f8-8ea6-32cf6332cf36] keycloak_group.project_occ: Creating... keycloak_group.project_occ: Creation complete after 0s [id=e54bf9c5-1db3-482d-9b0d-b396e38264ea] keycloak_group.project_occ_admins: Creating... keycloak_group_memberships.project_occ: Creating... keycloak_group.project_occ_admins: Creation complete after 0s [id=b6c50ae8-acf8-40d2-a05d-4c57ed3acf7d] keycloak_group_memberships.project_occ_admins: Creating... keycloak_group_memberships.project_occ_admins: Creation complete after 4s [id=scottylabs/group-memberships/b6c50ae8-acf8-40d2-a05d-4c57ed3acf7d] keycloak_group_memberships.project_occ_occ-main_admins: Destruction complete after 6s keycloak_group.project_occ_occ-main_admins: Destroying... [id=d764fe02-0506-4875-88c1-fc86c524fb20] keycloak_group.project_occ_occ-main_admins: Destruction complete after 0s keycloak_group_memberships.project_occ: Creation complete after 9s [id=scottylabs/group-memberships/e54bf9c5-1db3-482d-9b0d-b396e38264ea] keycloak_group_memberships.project_occ_occ-main: Still destroying... [id=scottylabs/group-memberships/a4e98eec-77cf-49f8-8ea6-32cf6332cf36, 10s elapsed] keycloak_group_memberships.project_occ_occ-main: Destruction complete after 12s keycloak_group.project_occ_occ-main: Destroying... [id=a4e98eec-77cf-49f8-8ea6-32cf6332cf36] keycloak_group.project_occ_occ-main: Destruction complete after 0s Apply complete! Resources: 4 added, 0 changed, 4 destroyed. ``` </details> --- ### Apply Summary 3 projects, 3 successful, 0 failed, 0 errored

anish merged commit 4b58f51855 into main

2026-10-16 23:32:44 +00:00

anish deleted branch occ-slug-kennel-docs

2026-10-16 23:32:44 +00:00

scottylabs-bot commented

2026-10-16 23:32:44 +00:00

Owner

Locks and plans deleted for the projects and workspaces modified in this pull request:

dir: tofu/git workspace: default
dir: tofu/keycloak workspace: default
dir: tofu/openbao workspace: default

Locks and plans deleted for the projects and workspaces modified in this pull request: - dir: `tofu/git` workspace: `default` - dir: `tofu/keycloak` workspace: `default` - dir: `tofu/openbao` workspace: `default`

anish referenced this pull request from a commit

2026-10-16 23:32:45 +00:00

feat: rename occ project slug and enable kennel and docs (#522)

Rows
Columns

feat: rename occ project slug and enable kennel and docs #522

1. project: keycloak dir: tofu/keycloak workspace: default

2. project: git dir: tofu/git workspace: default

3. project: openbao dir: tofu/openbao workspace: default

Plan Summary

1. project: git dir: tofu/git workspace: default

2. project: keycloak dir: tofu/keycloak workspace: default

3. project: openbao dir: tofu/openbao workspace: default

Plan Summary

1. project: git dir: tofu/git workspace: default

2. project: openbao dir: tofu/openbao workspace: default

3. project: keycloak dir: tofu/keycloak workspace: default

Plan Summary

1. project: openbao dir: tofu/openbao workspace: default

2. project: keycloak dir: tofu/keycloak workspace: default

3. project: git dir: tofu/git workspace: default

Plan Summary

1. project: openbao dir: tofu/openbao workspace: default

2. project: git dir: tofu/git workspace: default

3. project: keycloak dir: tofu/keycloak workspace: default

Apply Summary

1. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

2. project: `git` dir: `tofu/git` workspace: `default`

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

1. project: `git` dir: `tofu/git` workspace: `default`

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

3. project: `openbao` dir: `tofu/openbao` workspace: `default`

1. project: `git` dir: `tofu/git` workspace: `default`

2. project: `openbao` dir: `tofu/openbao` workspace: `default`

3. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

1. project: `openbao` dir: `tofu/openbao` workspace: `default`

2. project: `keycloak` dir: `tofu/keycloak` workspace: `default`

3. project: `git` dir: `tofu/git` workspace: `default`

1. project: `openbao` dir: `tofu/openbao` workspace: `default`

2. project: `git` dir: `tofu/git` workspace: `default`

3. project: `keycloak` dir: `tofu/keycloak` workspace: `default`