From a8027c0794f3f17284f0e3df56904d1f9c4beeea Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 9 Aug 2026 12:50:52 +1000 Subject: [PATCH] Derive the netbox role's username from its filename Why: - The role file named its NetBox user in a netbox_username field that repeated the filename stem, and the value (svc-terraform-infra) drifted from the role name, so the engine role and the user it mints tokens for could disagree. How: - Derive netbox_username from the filename in config.hcl, alongside the role name, so the role name and NetBox username are the same value by construction. - Drop the netbox_username field from the role yaml so nothing in the file repeats what the filename already encodes. --- config/config.hcl | 5 +++-- .../netbox/terraform-infra.yaml | 13 +++++++------ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/config/config.hcl b/config/config.hcl index 5566cfb..cb6193f 100644 --- a/config/config.hcl +++ b/config/config.hcl @@ -260,8 +260,9 @@ locals { netbox_secret_backend_role = { for file_path, content in local.all_configs : trimsuffix(replace(file_path, "netbox_secret_backend_role/", ""), ".yaml") => merge(content, { - name = trimsuffix(basename(file_path), ".yaml") - backend = dirname(replace(file_path, "netbox_secret_backend_role/", "")) + name = trimsuffix(basename(file_path), ".yaml") + netbox_username = trimsuffix(basename(file_path), ".yaml") + backend = dirname(replace(file_path, "netbox_secret_backend_role/", "")) }) if startswith(file_path, "netbox_secret_backend_role/") } diff --git a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml b/config/netbox_secret_backend_role/netbox/terraform-infra.yaml index fb61903..0147b18 100644 --- a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml +++ b/config/netbox_secret_backend_role/netbox/terraform-infra.yaml @@ -1,10 +1,11 @@ -# Role minting ephemeral NetBox tokens for the terraform-infra CI runner. -# terraform-infra manages NetBox IPAM/devices, so tokens carry write access -# (write_enabled true). Very short TTLs because a token is minted per plan/apply -# and revoked when the run's lease ends. Reading netbox/creds/terraform-infra -# mints a lease-bound token deleted from NetBox on revoke/expiry. +# Role minting ephemeral NetBox tokens for the terraform-infra CI runner. The +# filename stem is the engine role name AND the NetBox username (config.hcl +# derives both), so neither is repeated below. terraform-infra manages NetBox +# IPAM/devices, so tokens carry write access (write_enabled true). Very short +# TTLs because a token is minted per plan/apply and revoked when the run's lease +# ends. Reading netbox/creds/terraform-infra mints a lease-bound token deleted +# from NetBox on revoke/expiry. --- -netbox_username: svc-terraform-infra write_enabled: true ttl: 120 # 2m max_ttl: 300 # 5m