From 91963520602626f88df263076a1164923e6c8d57 Mon Sep 17 00:00:00 2001
From: Patrick Hermann <patrick.hermann@sva.de>
Date: Wed, 9 Sep 2026 12:41:10 +0000
Subject: [PATCH] fix(terraform-vault): pass vault_ca_bundle only when there is
 one

The cli path sent -var="vault_ca_bundle=..." unconditionally. Terraform ERRORS
on a -var the root module does not declare, so that restricted this workflow to
configs taking a CA bundle -- the cert issuer -- and any other Vault config
failed before it started:

  Error: Value for undeclared variable
  A variable named "vault_ca_bundle" was assigned on the command line, but
  the root module does not declare a variable of that name.

Hit by terraform/vault/eso-secrets, which creates a per-cluster KV mount and
read policy and has no use for a PKI bundle. The credentials it runs with
(openbao-labda.enc.yaml) carry no vaultCaBundle either, so the value would have
been empty even where it was accepted.

The dagger path already passes only cluster_name and kubeconfig_path, so it
never had this limit -- an apply would have worked while a plan could not.
This brings the cli path in line rather than adding a new behaviour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K2rfvVDXWjWZAKMcpwvgLG
---
 .github/workflows/call-terraform-vault.yaml | 26 +++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/call-terraform-vault.yaml b/.github/workflows/call-terraform-vault.yaml
index a5df2d0..f71753f 100644
--- a/.github/workflows/call-terraform-vault.yaml
+++ b/.github/workflows/call-terraform-vault.yaml
@@ -228,16 +228,34 @@ jobs:
             apply|destroy) APPROVE="-auto-approve" ;;
             *)             APPROVE="" ;;
           esac
+          # vault_ca_bundle is passed only when there is one. Terraform ERRORS on
+          # a -var the root module does not declare, so sending it unconditionally
+          # restricts this workflow to configs that take a CA bundle -- i.e. the
+          # cert issuer. A config doing something else in Vault, such as a
+          # per-cluster KV mount and read policy, has no use for it and fails
+          # before it starts.
+          #
+          # The dagger path already passes only cluster_name and kubeconfig_path,
+          # so it never had this limit; this brings the cli path in line rather
+          # than adding a new behaviour.
+          TF_VARS=(
+            -var="cluster_name=${{ inputs.cluster-name }}"
+            -var="kubeconfig_path=/tmp/kubeconfig"
+            -var="vault_addr=${VAULT_ADDR}"
+          )
+          if [[ -s /tmp/vault_ca_bundle ]]; then
+            TF_VARS+=(-var="vault_ca_bundle=$(cat /tmp/vault_ca_bundle)")
+          else
+            echo "no vault_ca_bundle in the credentials -- not passing the variable"
+          fi
+
           MAX_ATTEMPTS=3
           ATTEMPT=1
           until terraform -chdir="${TF_DIR}" \
                   ${{ inputs.operation }} \
                   ${APPROVE} \
                   -compact-warnings \
-                  -var="cluster_name=${{ inputs.cluster-name }}" \
-                  -var="kubeconfig_path=/tmp/kubeconfig" \
-                  -var="vault_addr=${VAULT_ADDR}" \
-                  -var="vault_ca_bundle=$(cat /tmp/vault_ca_bundle)"
+                  "${TF_VARS[@]}"
           do
             if [[ $ATTEMPT -ge $MAX_ATTEMPTS ]]; then
               echo "::error::terraform ${{ inputs.operation }} failed after ${MAX_ATTEMPTS} attempts"