unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

Wire API_TOKEN_PEPPERS into NetBox config (#346)

Browse Source 
## Why

NetBox 4.6.5 refuses to save v2 API tokens without `API_TOKEN_PEPPERS` ("Unable to save v2 tokens: API_TOKEN_PEPPERS is not defined"), which blocks creating the superuser token the NetBox Vault engine needs (it defaults to v2 tokens). The chart only auto-generates a pepper when it creates the config secret itself; it does not do that while `existingSecret` (`netbox-secret-key`) is set, so the config secret carries no `api_token_peppers` key.

## Changes

- Document `api_token_peppers` on the `netbox-secret-key` VaultStaticSecret: a JSON pepper map `{"1": "<random>"}` seeded once into Vault alongside `secret_key`. VSO syncs every key at the path into the config secret, which the chart already mounts as an optional file into `API_TOKEN_PEPPERS`.
- Add a reloader annotation via `commonAnnotations` so the `netbox` and `netbox-worker` Deployments roll when `netbox-secret-key` changes, picking up the seeded pepper (and any rotated `secret_key`) without a manual restart.

## Follow-up (out of band)

seed the pepper once (rotating it invalidates existing v2 tokens):

```
PEP=$(openssl rand -base64 48 | tr -d '\n')
vault kv patch kv/kubernetes/namespace/netbox/default/netbox-secret-key \
  api_token_peppers="{\"1\": \"$PEP\"}"
```

---------

Co-authored-by: Ben Vincent <neotheo@gmail.com>
Reviewed-on: #346
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
This commit was merged in pull request #346.
This commit is contained in:
Ben Vincent
2026-08-09 12:33:30 +10:00
committed by BenVincent
parent 2739a29778
commit 07bd94c55a
2 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/netbox/vaultstaticsecret.yaml
+7 -1
View File
@@ -19,7 +19,13 @@ spec:
type: kv-v2
vaultAuthRef: default
---
# Django SECRET_KEY (key: secret_key). One-time Vault seed.
# Config secret. Keys:
# secret_key : Django SECRET_KEY (50+ random chars). One-time Vault seed.
# api_token_peppers : JSON object {"1": "<50+ char random>"} used to HMAC-hash
# v2 API tokens. One-time Vault seed — rotating a pepper
# invalidates existing v2 tokens, so set it once.
# VSO syncs every key at the path into the destination Secret, and the NetBox
# chart mounts both keys from it (existingSecret) — no explicit key mapping needed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata: