Ben Vincent
f1d37f3b6e
NetBox 4.6.5 refuses to save v2 API tokens without API_TOKEN_PEPPERS
("Unable to save v2 tokens: API_TOKEN_PEPPERS is not defined"), blocking
creation of the superuser token the NetBox Vault engine needs. The chart
only auto-generates a pepper when it creates the config secret itself,
which it does not do while existingSecret (netbox-secret-key) is set, so
the config secret carries no api_token_peppers key.
- Document api_token_peppers on the netbox-secret-key VaultStaticSecret: a
JSON pepper map {"1": "<random>"} seeded once into Vault alongside
secret_key; VSO syncs it into the config secret the chart already mounts.
- Add a reloader annotation (commonAnnotations) so the web and worker
Deployments roll when netbox-secret-key changes, picking up the seeded
pepper without a manual restart.
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |
| ca-rotation.md | Rolling the internal unkin.net PKI CA (vault-ca-cert): what Reloader restarts automatically vs. manual/CNPG restarts. |