unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Deploy arrproxy v0.2.0 machine-mint admin route #384

Merged
benvin merged 1 commits from benvin/arrproxy-v0.2.0-admin into main 2026-08-18 22:37:07 +10:00
Conversation 0 Commits 1 Files Changed 4
+47 -6
unkin-agent commented 2026-08-18 21:49:14 +10:00
Member
Copy Link
Copy Source

Why

The future Vault engine needs to machine-mint arrproxy tokens without an interactive Authentik session. arrproxy v0.2.0 adds an admin route (POST /api/admin/...) protected by its own bearer token; OpenBao running on the VMs calls it through the arrstack ingress. This deploys that route.

Changes

  • Add an arrproxy-admin-token VaultStaticSecret (mirrors the arrproxy-pepper VSO: same default VaultAuth, k8s-auth default-SA pattern) syncing kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token into the arrproxy-admin-token Secret. The token is seeded in Vault KV as the shared source of truth for the future Vault engine.
  • Set ARRPROXY_ADMIN_TOKEN on the arrproxy-api Deployment via secretKeyRef (key token), and add arrproxy-admin-token to the Reloader secret.reloader.stakater.com/reload annotation so the pod rolls on rotation.
  • Skip-auth the /api/admin/ route in oauth2-proxy: OAUTH2_PROXY_SKIP_AUTH_REGEX becomes ^/[^/]+/api,^/api/admin/. The admin route is intentionally oauth-skipped because it is protected by arrproxy's OWN bearer token so OpenBao can reach it machine-to-machine. /api/tokens and /api/me are NOT matched and stay oauth-gated. /api/admin/* already routes to the arrproxy-api upstream via the existing catch-all /api/ upstream, so no upstream change is needed.
  • Bump arrproxy-api and arrproxy-ui images to v0.2.0 (kept in lockstep).

Validation

  • kustomize build --enable-helm apps/overlays/au-syd1/arrstack succeeds.
  • pre-commit passes, including the plain-Secret guard (only the VSO CRD is used; no plain Secret objects added).
## Why The future Vault engine needs to machine-mint arrproxy tokens without an interactive Authentik session. arrproxy v0.2.0 adds an admin route (`POST /api/admin/...`) protected by its own bearer token; OpenBao running on the VMs calls it through the arrstack ingress. This deploys that route. ## Changes - Add an `arrproxy-admin-token` VaultStaticSecret (mirrors the `arrproxy-pepper` VSO: same `default` VaultAuth, k8s-auth default-SA pattern) syncing `kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token` into the `arrproxy-admin-token` Secret. The token is seeded in Vault KV as the shared source of truth for the future Vault engine. - Set `ARRPROXY_ADMIN_TOKEN` on the arrproxy-api Deployment via `secretKeyRef` (key `token`), and add `arrproxy-admin-token` to the Reloader `secret.reloader.stakater.com/reload` annotation so the pod rolls on rotation. - Skip-auth the `/api/admin/` route in oauth2-proxy: `OAUTH2_PROXY_SKIP_AUTH_REGEX` becomes `^/[^/]+/api,^/api/admin/`. The admin route is intentionally oauth-skipped because it is protected by arrproxy's OWN bearer token so OpenBao can reach it machine-to-machine. `/api/tokens` and `/api/me` are NOT matched and stay oauth-gated. `/api/admin/*` already routes to the arrproxy-api upstream via the existing catch-all `/api/` upstream, so no upstream change is needed. - Bump arrproxy-api and arrproxy-ui images to `v0.2.0` (kept in lockstep). ## Validation - `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` succeeds. - pre-commit passes, including the plain-Secret guard (only the VSO CRD is used; no plain Secret objects added).
unkin-agent added 1 commit 2026-08-18 21:49:15 +10:00
Deploy arrproxy v0.2.0 machine-mint admin route
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
4f79141638 
Wire the bearer-protected /api/admin/ route so OpenBao on the VMs can
machine-mint arrproxy tokens through the ingress.

- Add arrproxy-admin-token VaultStaticSecret (default VaultAuth, k8s-auth
  default-SA) syncing kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token
- Set ARRPROXY_ADMIN_TOKEN on arrproxy-api from that Secret; add it to the
  Reloader reload annotation so the pod rolls on rotation
- Skip-auth /api/admin/ in oauth2-proxy (route stays bearer-protected by
  arrproxy's own token); /api/tokens and /api/me stay oauth-gated
- Bump arrproxy-api and arrproxy-ui images to v0.2.0
benvin merged commit e0d47295f2 into main 2026-08-18 22:37:07 +10:00
benvin deleted branch benvin/arrproxy-v0.2.0-admin 2026-08-18 22:37:07 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#384
Delete Branch "benvin/arrproxy-v0.2.0-admin"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?