From a025819fcd9645eb3e342715f525ea96b7d88dfb Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 9 Aug 2026 00:18:47 +1000 Subject: [PATCH] Mint the NetBox token from the Vault netbox engine Why: - The netbox provider authenticated with a static netbox_token seeded by hand into KV; the vault-plugin-secrets-netbox engine mints a per-run ephemeral token that is lease-revoked when the run ends, removing the manual seed. How: - Read netbox/creds/terraform-infra via vault_generic_secret and pass the minted netbox_token to the netbox provider. - Keep kea_token from KV for now (follow-up: its own ephemeral-token engine). Depends on the netbox engine mount + netbox/creds/terraform-infra role/policy in terraform-vault being applied first. --- modules/infra/providers.tf | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/modules/infra/providers.tf b/modules/infra/providers.tf index f276eed..84d25d2 100644 --- a/modules/infra/providers.tf +++ b/modules/infra/providers.tf @@ -5,8 +5,16 @@ provider "vault" { skip_child_token = true } -# KeaAPI and NetBox tokens live in a single Vault KV v2 secret. The vault -# provider authenticates with the VAULT_TOKEN set by the Makefile. +# NetBox API token: minted per run by the vault-plugin-secrets-netbox engine +# (netbox/creds/terraform-infra), lease-revoked when the run ends. This replaces +# the static netbox_token that was seeded into KV by hand. +data "vault_generic_secret" "netbox" { + path = "netbox/creds/terraform-infra" +} + +# KeaAPI token still lives in the KV v2 secret (follow-up: give Kea its own +# ephemeral-token engine). The vault provider authenticates with the VAULT_TOKEN +# set by the Makefile. data "vault_kv_secret_v2" "tokens" { mount = "kv" name = "service/terraform/infra" @@ -14,7 +22,7 @@ data "vault_kv_secret_v2" "tokens" { provider "netbox" { server_url = var.netbox_server_url - api_token = data.vault_kv_secret_v2.tokens.data["netbox_token"] + api_token = data.vault_generic_secret.netbox.data["netbox_token"] } provider "kea" {