Replace the terraform-infra Vault identity with terraform-netbox (#161)

terraform-netbox supersedes terraform-infra but has no identity to run as: the terraform-infra policies bind to a terraform_infra approle and a woodpecker_terraform_infra k8s role that were never created. - rename the netbox and consul creds policies, the engine role and the consul ACL rules to terraform-netbox - add the terraform_netbox approle and woodpecker_terraform_netbox k8s role - grant the engine role extras.customfield, dcim.platform and the device inventory types the module creates (manufacturer, devicetype, devicerole, tag, ipam.role) — the old scope would have 403ed on first apply - drop the kv/service/terraform/infra policy: the kea_token is gone with Kea and the NetBox token is minted per run Needs the terraform-netbox woodpecker ServiceAccount in argocd-apps before CI can auth. Reviewed-on: #161 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
2026-10-03 09:39:10 +10:00
parent 096d677129
commit e2c07a8c83
10 changed files with 63 additions and 56 deletions
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -1,5 +1,5 @@
 bound_service_account_names:
-  - terraform-infra
+  - terraform-netbox
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
@@ -1,5 +1,5 @@
 consul_roles:
-  - terraform-infra
+  - terraform-netbox
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -1,25 +1,44 @@
-# Single declarative source for the terraform-infra NetBox service identity. The
+# Single declarative source for the terraform-netbox NetBox service identity. The
 # filename stem is the engine role name AND the NetBox username (1:1); config.hcl
 # derives both from it, so neither is repeated below. Creating this file creates
 # the user: the netbox_user_management module synthesizes the NetBox user + object
 # permissions from the permissions block, and the engine role mints ephemeral
-# tokens for that same user. write_enabled true because terraform-infra manages
+# tokens for that same user. write_enabled true because terraform-netbox manages
 # NetBox IPAM/DCIM; very short TTLs because a token is minted per plan/apply and
 # revoked when the run's lease ends.
+#
+# extras.customfield is what lets the runner declare the custom fields bootapi
+# reads (pxe_enabled, provision_template, domain, gateway, nameservers), and
+# dcim.platform is how a device gets the platform slug bootapi selects a distro
+# catalog entry by.
 ---
 write_enabled: true
 ttl: 120     # 2m
 max_ttl: 300 # 5m
 permissions:
-  - object_types:
+  - name: terraform-netbox-write
+    object_types:
      - ipam.prefix
      - ipam.ipaddress
      - ipam.iprange
+      - ipam.role
      - dcim.device
+      - dcim.devicerole
+      - dcim.devicetype
      - dcim.interface
      - dcim.macaddress
+      - dcim.manufacturer
+      - dcim.platform
+      - extras.customfield
+      - extras.tag
    actions:
      - view
      - add
      - change
      - delete
+  # Sites are looked up with a data source, never created here.
+  - name: terraform-netbox-read
+    object_types:
+      - dcim.site
+    actions:
+      - view
@@ -1,11 +0,0 @@
---
-rules:
-  - path: "consul_root/au/syd1/creds/terraform-infra"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_infra
-  k8s/au/syd1:
-    - woodpecker_terraform_infra
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-netbox"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_netbox
+  k8s/au/syd1:
+    - woodpecker_terraform_netbox
@@ -1,18 +0,0 @@
-# Allow the terraform-infra runner to read the NetBox + KeaAPI tokens
-# (netbox_token / kea_token fields) used by the netbox and kea providers.
---
-rules:
-  - path: "kv/data/service/terraform/infra"
-    capabilities:
-      - read
-  # vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
-  # metadata path on every plan/apply; a 403 here fails the plan.
-  - path: "kv/metadata/service/terraform/infra"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_infra
-  k8s/au/syd1:
-    - woodpecker_terraform_infra
@@ -1,21 +0,0 @@
-# Allow the terraform-infra runner to mint an ephemeral NetBox token from the
-# terraform-infra role (netbox/creds/terraform-infra), replacing the static
-# netbox_token it used to read from kv/service/terraform/*. The e-breuninger
-# netbox provider authenticates with the minted token; the lease revokes it when
-# the run ends.
-#
-# Bound to both the terraform-infra AppRole and its Woodpecker k8s auth role,
-# mirroring the terraform-ipam pattern. Both principals are created by the
-# terraform-infra Vault onboarding (separate from this netbox change); until
-# that onboarding lands this policy exists but attaches to nothing.
---
-rules:
-  - path: "netbox/creds/terraform-infra"
-    capabilities:
-      - read
-
-auth:
-  approle:
-    - terraform_infra
-  k8s/au/syd1:
-    - woodpecker_terraform_infra
@@ -0,0 +1,18 @@
+# Allow the terraform-netbox runner to mint an ephemeral NetBox token from the
+# terraform-netbox role (netbox/creds/terraform-netbox). The e-breuninger netbox
+# provider authenticates with the minted token; the lease revokes it when the
+# run ends.
+#
+# Bound to the terraform-netbox AppRole and its Woodpecker k8s auth role, both
+# declared alongside this policy.
+---
+rules:
+  - path: "netbox/creds/terraform-netbox"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_netbox
+  k8s/au/syd1:
+    - woodpecker_terraform_netbox
@@ -1,4 +1,4 @@
-key_prefix "infra/terraform/infra/" {
+key_prefix "infra/terraform/netbox/" {
  policy = "write"
 }