arrstack: manage sonarr/radarr/prowlarr API keys via Vault

Vault is the source of truth for the sonarr/radarr/prowlarr API keys (override bootstrap): keys are minted in Vault and enforced into each app's /config/config.xml on startup, replacing the images' self-generated keys. - add a VaultAuth 'default' in the arrstack namespace (k8s auth, mount k8s/au/syd1, role default, SA default) mirroring the jellyfin pattern - add a per-app VaultStaticSecret syncing kv/kubernetes/namespace/arrstack/default/<app> (key apitoken) into the <app>-apikey Secret; the default k8s role's templated policy already grants read there, so no terraform-vault change is needed - add an apikey-init initContainer to each deployment that fails closed on a missing/non-hex key and writes/updates only the <ApiKey> element in /config/config.xml (busybox via artifactapi, runs as root) - wire the new manifests into the base and per-app kustomizations nzbget is out of scope (no config.xml <ApiKey>; uses ControlPassword).
2026-08-15 16:38:57 +10:00
parent 164938f127
commit 0ddb57f687
11 changed files with 243 additions and 0 deletions
@@ -4,6 +4,7 @@ kind: Kustomization

 resources:
  - namespace.yaml
+  - vaultauth.yaml
  - pv-media-tv.yaml
  - pv-media-movies.yaml
  - pvc-media-tv.yaml
@@ -20,6 +20,54 @@ spec:
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Enforce the Vault-sourced API key in /config/config.xml before the app
+        # starts. Vault is source of truth (override bootstrap): the key is minted
+        # in Vault, synced by VSO into the prowlarr-apikey Secret, and written here.
+        # Runs as root to fix ownership; touches only the <ApiKey> element.
+        - name: apikey-init
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          env:
+            - name: API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: prowlarr-apikey
+                  key: apitoken
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              case "$API_KEY" in
+                "" | *[!0-9a-fA-F]*)
+                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
+                  exit 1
+                  ;;
+              esac
+              CFG=/config/config.xml
+              if [ ! -f "$CFG" ]; then
+                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
+              elif grep -q '<ApiKey>' "$CFG"; then
+                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              else
+                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              fi
+              chown 1000:1000 "$CFG"
+              chmod 600 "$CFG"
+              echo "apikey-init: <ApiKey> enforced from Vault"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
      containers:
        - name: prowlarr
          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/prowlarr:2.5.2
@@ -4,6 +4,7 @@ kind: Kustomization

 resources:
  - pvc-config.yaml
+  - vaultstaticsecret.yaml
  - deployment.yaml
  - service.yaml
  - gateway.yaml
@@ -0,0 +1,25 @@
+---
+# prowlarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/prowlarr
+# (key: apitoken); the default k8s role's templated policy already grants read
+# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the prowlarr-apikey Secret that the apikey-init initContainer reads
+# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: prowlarr-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: prowlarr-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/prowlarr
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -20,6 +20,54 @@ spec:
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Enforce the Vault-sourced API key in /config/config.xml before the app
+        # starts. Vault is source of truth (override bootstrap): the key is minted
+        # in Vault, synced by VSO into the radarr-apikey Secret, and written here.
+        # Runs as root to fix ownership; touches only the <ApiKey> element.
+        - name: apikey-init
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          env:
+            - name: API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: radarr-apikey
+                  key: apitoken
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              case "$API_KEY" in
+                "" | *[!0-9a-fA-F]*)
+                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
+                  exit 1
+                  ;;
+              esac
+              CFG=/config/config.xml
+              if [ ! -f "$CFG" ]; then
+                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
+              elif grep -q '<ApiKey>' "$CFG"; then
+                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              else
+                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              fi
+              chown 1000:1000 "$CFG"
+              chmod 600 "$CFG"
+              echo "apikey-init: <ApiKey> enforced from Vault"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
      containers:
        - name: radarr
          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/radarr:6.3.0
@@ -4,6 +4,7 @@ kind: Kustomization

 resources:
  - pvc-config.yaml
+  - vaultstaticsecret.yaml
  - deployment.yaml
  - service.yaml
  - gateway.yaml
@@ -0,0 +1,25 @@
+---
+# radarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/radarr
+# (key: apitoken); the default k8s role's templated policy already grants read
+# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the radarr-apikey Secret that the apikey-init initContainer reads
+# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: radarr-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: radarr-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/radarr
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -23,6 +23,54 @@ spec:
        # OnRootMismatch avoids a recursive chown of the whole media tree.
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Enforce the Vault-sourced API key in /config/config.xml before the app
+        # starts. Vault is source of truth (override bootstrap): the key is minted
+        # in Vault, synced by VSO into the sonarr-apikey Secret, and written here.
+        # Runs as root to fix ownership; touches only the <ApiKey> element.
+        - name: apikey-init
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          env:
+            - name: API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: sonarr-apikey
+                  key: apitoken
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              case "$API_KEY" in
+                "" | *[!0-9a-fA-F]*)
+                  echo "apikey-init: API_KEY missing or not hex; refusing" >&2
+                  exit 1
+                  ;;
+              esac
+              CFG=/config/config.xml
+              if [ ! -f "$CFG" ]; then
+                printf '<Config>\n  <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
+              elif grep -q '<ApiKey>' "$CFG"; then
+                sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              else
+                sed -i "s|<Config>|<Config>\n  <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
+              fi
+              chown 1000:1000 "$CFG"
+              chmod 600 "$CFG"
+              echo "apikey-init: <ApiKey> enforced from Vault"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+          volumeMounts:
+            - name: config
+              mountPath: /config
      containers:
        - name: sonarr
          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/sonarr:4.0.19
@@ -4,6 +4,7 @@ kind: Kustomization

 resources:
  - pvc-config.yaml
+  - vaultstaticsecret.yaml
  - deployment.yaml
  - service.yaml
  - gateway.yaml
@@ -0,0 +1,25 @@
+---
+# sonarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/sonarr
+# (key: apitoken); the default k8s role's templated policy already grants read
+# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the sonarr-apikey Secret that the apikey-init initContainer reads
+# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: sonarr-apikey
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: sonarr-apikey
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/sonarr
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -0,0 +1,20 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  allowedNamespaces:
+    - arrstack
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default