Wire the bearer-protected /api/admin/ route so OpenBao on the VMs can
machine-mint arrproxy tokens through the ingress.
- Add arrproxy-admin-token VaultStaticSecret (default VaultAuth, k8s-auth
default-SA) syncing kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token
- Set ARRPROXY_ADMIN_TOKEN on arrproxy-api from that Secret; add it to the
Reloader reload annotation so the pod rolls on rotation
- Skip-auth /api/admin/ in oauth2-proxy (route stays bearer-protected by
arrproxy's own token); /api/tokens and /api/me stay oauth-gated
- Bump arrproxy-api and arrproxy-ui images to v0.2.0
unkin-agent
4f79141638