Wire API_TOKEN_PEPPERS into NetBox config #346

2026-08-09T12:19:36+10:00

unkinben commented

2026-08-09 12:19:36 +10:00

Why

NetBox 4.6.5 refuses to save v2 API tokens without API_TOKEN_PEPPERS ("Unable to save v2 tokens: API_TOKEN_PEPPERS is not defined"), which blocks creating the superuser token the NetBox Vault engine needs (it defaults to v2 tokens). The chart only auto-generates a pepper when it creates the config secret itself; it does not do that while existingSecret (netbox-secret-key) is set, so the config secret carries no api_token_peppers key.

Changes

Document api_token_peppers on the netbox-secret-key VaultStaticSecret: a JSON pepper map {"1": "<random>"} seeded once into Vault alongside secret_key. VSO syncs every key at the path into the config secret, which the chart already mounts as an optional file into API_TOKEN_PEPPERS.
Add a reloader annotation via commonAnnotations so the netbox and netbox-worker Deployments roll when netbox-secret-key changes, picking up the seeded pepper (and any rotated secret_key) without a manual restart.

Follow-up (out of band)

Ben seeds the pepper once (rotating it invalidates existing v2 tokens):

PEP=$(openssl rand -base64 48 | tr -d '\n')
vault kv patch kv/kubernetes/namespace/netbox/default/netbox-secret-key \
  api_token_peppers="{\"1\": \"$PEP\"}"

## Why NetBox 4.6.5 refuses to save v2 API tokens without `API_TOKEN_PEPPERS` ("Unable to save v2 tokens: API_TOKEN_PEPPERS is not defined"), which blocks creating the superuser token the NetBox Vault engine needs (it defaults to v2 tokens). The chart only auto-generates a pepper when it creates the config secret itself; it does not do that while `existingSecret` (`netbox-secret-key`) is set, so the config secret carries no `api_token_peppers` key. ## Changes - Document `api_token_peppers` on the `netbox-secret-key` VaultStaticSecret: a JSON pepper map `{"1": "<random>"}` seeded once into Vault alongside `secret_key`. VSO syncs every key at the path into the config secret, which the chart already mounts as an optional file into `API_TOKEN_PEPPERS`. - Add a reloader annotation via `commonAnnotations` so the `netbox` and `netbox-worker` Deployments roll when `netbox-secret-key` changes, picking up the seeded pepper (and any rotated `secret_key`) without a manual restart. ## Follow-up (out of band) Ben seeds the pepper once (rotating it invalidates existing v2 tokens): ``` PEP=$(openssl rand -base64 48 | tr -d '\n') vault kv patch kv/kubernetes/namespace/netbox/default/netbox-secret-key \ api_token_peppers="{\"1\": \"$PEP\"}" ```

unkinben added 1 commit 2026-08-09 12:19:36 +10:00

Wire API_TOKEN_PEPPERS into NetBox config

ci/woodpecker/pr/vector-test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

f1d37f3b6e

NetBox 4.6.5 refuses to save v2 API tokens without API_TOKEN_PEPPERS
("Unable to save v2 tokens: API_TOKEN_PEPPERS is not defined"), blocking
creation of the superuser token the NetBox Vault engine needs. The chart
only auto-generates a pepper when it creates the config secret itself,
which it does not do while existingSecret (netbox-secret-key) is set, so
the config secret carries no api_token_peppers key.

- Document api_token_peppers on the netbox-secret-key VaultStaticSecret: a
  JSON pepper map {"1": "<random>"} seeded once into Vault alongside
  secret_key; VSO syncs it into the config secret the chart already mounts.
- Add a reloader annotation (commonAnnotations) so the web and worker
  Deployments roll when netbox-secret-key changes, picking up the seeded
  pepper without a manual restart.

benvin merged commit 07bd94c55a into main

2026-08-09 12:33:31 +10:00

benvin deleted branch benvin/netbox-token-peppers

2026-08-09 12:33:31 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#346