From 73a2d7b17542a2c3bd35befe91799e49f7251dcd Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 9 Aug 2026 11:30:29 +1000 Subject: [PATCH] Drop admin policy + puppet-facts role from netbox engine Why: - The netbox admin policy now lands first in its own PR, and puppet-facts is deferred until puppet-host Vault auth is solved (issue #518), so neither belongs in this engine PR. How: - Remove policies/netbox/admin.yaml (moved to the admin-policy PR). - Remove the puppet-facts role config; keep only the terraform-infra role. - Shorten the terraform-infra role to ttl 120s / max_ttl 300s to match its per-run mint-and-revoke lifecycle. --- .../netbox/puppet-facts.yaml | 16 ------- .../netbox/terraform-infra.yaml | 10 ++--- policies/netbox/admin.yaml | 42 ------------------- 3 files changed, 5 insertions(+), 63 deletions(-) delete mode 100644 config/netbox_secret_backend_role/netbox/puppet-facts.yaml delete mode 100644 policies/netbox/admin.yaml diff --git a/config/netbox_secret_backend_role/netbox/puppet-facts.yaml b/config/netbox_secret_backend_role/netbox/puppet-facts.yaml deleted file mode 100644 index 7b4b014..0000000 --- a/config/netbox_secret_backend_role/netbox/puppet-facts.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# Role minting ephemeral read-only NetBox tokens for the puppet netbox fact. -# The fact (profiles::netbox::facts) only GETs this node's device/VM + interface -# data, so tokens are read-only (write_enabled false). Longer TTLs than the -# terraform-infra role because the token feeds a persistent, cache-backed fact. -# Reading netbox/creds/puppet-facts mints a lease-bound token deleted from -# NetBox on revoke/expiry. -# -# There is no puppet-host -> Vault auth in the estate, so no consumer policy -# binds netbox/creds/puppet-facts: an operator mints from this role by hand and -# seeds the token into hieradata (profiles::netbox::facts::api_token). See the -# PR body for the flagged design choice. ---- -netbox_username: svc-puppet-facts -write_enabled: false -ttl: 86400 # 24h -max_ttl: 259200 # 72h diff --git a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml b/config/netbox_secret_backend_role/netbox/terraform-infra.yaml index 880d607..fb61903 100644 --- a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml +++ b/config/netbox_secret_backend_role/netbox/terraform-infra.yaml @@ -1,10 +1,10 @@ # Role minting ephemeral NetBox tokens for the terraform-infra CI runner. # terraform-infra manages NetBox IPAM/devices, so tokens carry write access -# (write_enabled true). Short TTLs because a token is minted per plan/apply and -# revoked when the run's lease ends. Reading netbox/creds/terraform-infra mints -# a lease-bound token deleted from NetBox on revoke/expiry. +# (write_enabled true). Very short TTLs because a token is minted per plan/apply +# and revoked when the run's lease ends. Reading netbox/creds/terraform-infra +# mints a lease-bound token deleted from NetBox on revoke/expiry. --- netbox_username: svc-terraform-infra write_enabled: true -ttl: 3600 # 1h -max_ttl: 14400 # 4h +ttl: 120 # 2m +max_ttl: 300 # 5m diff --git a/policies/netbox/admin.yaml b/policies/netbox/admin.yaml deleted file mode 100644 index 9a0cc6c..0000000 --- a/policies/netbox/admin.yaml +++ /dev/null @@ -1,42 +0,0 @@ -# Allow the vault deployer to manage the netbox token secrets engine: its -# connection config (seeded admin token), in-place token rotation, and -# token-minting roles. -# -# Scoped to netbox/* only, and deliberately excludes netbox/creds/* - minting -# tokens is for consumers, not the deployer. The plugin-catalog grant needed to -# import the plugin is the shared, sudo-protected wildcard in -# policies/sys/plugins/catalog/admin.yaml (already covers this plugin), and -# mounting the engine uses the deployer's existing sys/mounts/* access, so no -# new catalog/mount grant is added here (mirrors the gitea/rancher engines). ---- -rules: - # Engine connection config (NetBox URL, TLS, token_version, seeded admin token). - - path: "netbox/config" - capabilities: - - create - - read - - update - - delete - # In-place rotation of the seeded admin token (write-only trigger). - - path: "netbox/config/rotate" - capabilities: - - create - - update - # Token-minting roles. - - path: "netbox/roles/*" - capabilities: - - create - - read - - update - - delete - - list - - path: "netbox/roles" - capabilities: - - read - - list - -auth: - approle: - - tf_vault - k8s/au/syd1: - - woodpecker_terraform_vault