unkinben
07bd94c55a
## Why
NetBox 4.6.5 refuses to save v2 API tokens without `API_TOKEN_PEPPERS` ("Unable to save v2 tokens: API_TOKEN_PEPPERS is not defined"), which blocks creating the superuser token the NetBox Vault engine needs (it defaults to v2 tokens). The chart only auto-generates a pepper when it creates the config secret itself; it does not do that while `existingSecret` (`netbox-secret-key`) is set, so the config secret carries no `api_token_peppers` key.
## Changes
- Document `api_token_peppers` on the `netbox-secret-key` VaultStaticSecret: a JSON pepper map `{"1": "<random>"}` seeded once into Vault alongside `secret_key`. VSO syncs every key at the path into the config secret, which the chart already mounts as an optional file into `API_TOKEN_PEPPERS`.
- Add a reloader annotation via `commonAnnotations` so the `netbox` and `netbox-worker` Deployments roll when `netbox-secret-key` changes, picking up the seeded pepper (and any rotated `secret_key`) without a manual restart.
## Follow-up (out of band)
seed the pepper once (rotating it invalidates existing v2 tokens):
```
PEP=$(openssl rand -base64 48 | tr -d '\n')
vault kv patch kv/kubernetes/namespace/netbox/default/netbox-secret-key \
api_token_peppers="{\"1\": \"$PEP\"}"
```
---------
Co-authored-by: Ben Vincent <neotheo@gmail.com>
Reviewed-on: #346
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
88 lines
2.8 KiB
YAML
88 lines
2.8 KiB
YAML
---
|
|
# CNPG app-user credentials (keys: username, password). Consumed by the Cluster
|
|
# bootstrap (initdb.secret) AND by NetBox (externalDatabase.existingSecretName).
|
|
# One-time Vault seed — see the PR description.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: postgres-credentials
|
|
namespace: netbox
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: postgres-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/netbox/default/postgres-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Config secret. Keys:
|
|
# secret_key : Django SECRET_KEY (50+ random chars). One-time Vault seed.
|
|
# api_token_peppers : JSON object {"1": "<50+ char random>"} used to HMAC-hash
|
|
# v2 API tokens. One-time Vault seed — rotating a pepper
|
|
# invalidates existing v2 tokens, so set it once.
|
|
# VSO syncs every key at the path into the destination Secret, and the NetBox
|
|
# chart mounts both keys from it (existingSecret) — no explicit key mapping needed.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: netbox-secret-key
|
|
namespace: netbox
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: netbox-secret-key
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/netbox/default/netbox-secret-key
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Bootstrap superuser (keys: username, password, email, api_token). Applied by
|
|
# NetBox on first boot. One-time Vault seed.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: netbox-superuser
|
|
namespace: netbox
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: netbox-superuser
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/netbox/default/netbox-superuser
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Authentik OIDC client secret. Two keys at the same Vault path:
|
|
# client_secret : raw secret, read by the terraform-authentik provider runner
|
|
# (policy already grants kv/.../namespace/+/default/oauth-credentials).
|
|
# oidc.yaml : a YAML fragment 'SOCIAL_AUTH_OIDC_SECRET: "<secret>"', mounted
|
|
# into NetBox via values.yaml extraConfig (the chart's config
|
|
# loader globs /run/config/extra/*/*.yaml).
|
|
# One-time Vault seed — see the PR description.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: oauth-credentials
|
|
namespace: netbox
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: oauth-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/netbox/default/oauth-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|