Vault is the source of truth for the sonarr/radarr/prowlarr API keys
(override bootstrap): keys are minted in Vault and enforced into each
app's /config/config.xml on startup, replacing the images'
self-generated keys.
- add a VaultAuth 'default' in the arrstack namespace (k8s auth, mount
k8s/au/syd1, role default, SA default) mirroring the jellyfin pattern
- add a per-app VaultStaticSecret syncing
kv/kubernetes/namespace/arrstack/default/<app> (key apitoken) into the
<app>-apikey Secret; the default k8s role's templated policy already
grants read there, so no terraform-vault change is needed
- add an apikey-init initContainer to each deployment that fails closed
on a missing/non-hex key and writes/updates only the <ApiKey> element
in /config/config.xml (busybox via artifactapi, runs as root)
- wire the new manifests into the base and per-app kustomizations
nzbget is out of scope (no config.xml <ApiKey>; uses ControlPassword).
unkin-agent