NetBox 4.6.5 refuses to save v2 API tokens without API_TOKEN_PEPPERS
("Unable to save v2 tokens: API_TOKEN_PEPPERS is not defined"), blocking
creation of the superuser token the NetBox Vault engine needs. The chart
only auto-generates a pepper when it creates the config secret itself,
which it does not do while existingSecret (netbox-secret-key) is set, so
the config secret carries no api_token_peppers key.
- Document api_token_peppers on the netbox-secret-key VaultStaticSecret: a
JSON pepper map {"1": "<random>"} seeded once into Vault alongside
secret_key; VSO syncs it into the config secret the chart already mounts.
- Add a reloader annotation (commonAnnotations) so the web and worker
Deployments roll when netbox-secret-key changes, picking up the seeded
pepper without a manual restart.
Ben Vincent