diff --git a/config/auth_approle_role/approle/terraform_netbox.yaml b/config/auth_approle_role/approle/terraform_netbox.yaml new file mode 100644 index 0000000..cec109a --- /dev/null +++ b/config/auth_approle_role/approle/terraform_netbox.yaml @@ -0,0 +1,9 @@ +token_ttl: 120 +token_max_ttl: 120 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" + - "198.18.25.102/32" + - "198.18.26.91/32" + - "198.18.27.40/32" +use_deterministic_role_id: true diff --git a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_netbox.yaml similarity index 88% rename from config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml rename to config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_netbox.yaml index 1beda15..48e26c8 100644 --- a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_infra.yaml +++ b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_netbox.yaml @@ -1,5 +1,5 @@ bound_service_account_names: - - terraform-infra + - terraform-netbox bound_service_account_namespaces: - woodpecker token_ttl: 600 diff --git a/config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-netbox.yaml similarity index 71% rename from config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml rename to config/consul_secret_backend_role/consul_root/au/syd1/terraform-netbox.yaml index 6d3954d..db1c5aa 100644 --- a/config/consul_secret_backend_role/consul_root/au/syd1/terraform-infra.yaml +++ b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-netbox.yaml @@ -1,5 +1,5 @@ consul_roles: - - terraform-infra + - terraform-netbox ttl: 120 max_ttl: 300 datacenters: [] diff --git a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml b/config/netbox_secret_backend_role/netbox/terraform-netbox.yaml similarity index 51% rename from config/netbox_secret_backend_role/netbox/terraform-infra.yaml rename to config/netbox_secret_backend_role/netbox/terraform-netbox.yaml index ac390ac..a88f3f7 100644 --- a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml +++ b/config/netbox_secret_backend_role/netbox/terraform-netbox.yaml @@ -1,25 +1,44 @@ -# Single declarative source for the terraform-infra NetBox service identity. The +# Single declarative source for the terraform-netbox NetBox service identity. The # filename stem is the engine role name AND the NetBox username (1:1); config.hcl # derives both from it, so neither is repeated below. Creating this file creates # the user: the netbox_user_management module synthesizes the NetBox user + object # permissions from the permissions block, and the engine role mints ephemeral -# tokens for that same user. write_enabled true because terraform-infra manages +# tokens for that same user. write_enabled true because terraform-netbox manages # NetBox IPAM/DCIM; very short TTLs because a token is minted per plan/apply and # revoked when the run's lease ends. +# +# extras.customfield is what lets the runner declare the custom fields bootapi +# reads (pxe_enabled, provision_template, domain, gateway, nameservers), and +# dcim.platform is how a device gets the platform slug bootapi selects a distro +# catalog entry by. --- write_enabled: true ttl: 120 # 2m max_ttl: 300 # 5m permissions: - - object_types: + - name: terraform-netbox-write + object_types: - ipam.prefix - ipam.ipaddress - ipam.iprange + - ipam.role - dcim.device + - dcim.devicerole + - dcim.devicetype - dcim.interface - dcim.macaddress + - dcim.manufacturer + - dcim.platform + - extras.customfield + - extras.tag actions: - view - add - change - delete + # Sites are looked up with a data source, never created here. + - name: terraform-netbox-read + object_types: + - dcim.site + actions: + - view diff --git a/policies/consul_root/au/syd1/creds/terraform-infra.yaml b/policies/consul_root/au/syd1/creds/terraform-infra.yaml deleted file mode 100644 index ecee6a8..0000000 --- a/policies/consul_root/au/syd1/creds/terraform-infra.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -rules: - - path: "consul_root/au/syd1/creds/terraform-infra" - capabilities: - - read - -auth: - approle: - - terraform_infra - k8s/au/syd1: - - woodpecker_terraform_infra diff --git a/policies/consul_root/au/syd1/creds/terraform-netbox.yaml b/policies/consul_root/au/syd1/creds/terraform-netbox.yaml new file mode 100644 index 0000000..857dffd --- /dev/null +++ b/policies/consul_root/au/syd1/creds/terraform-netbox.yaml @@ -0,0 +1,11 @@ +--- +rules: + - path: "consul_root/au/syd1/creds/terraform-netbox" + capabilities: + - read + +auth: + approle: + - terraform_netbox + k8s/au/syd1: + - woodpecker_terraform_netbox diff --git a/policies/kv/service/terraform/infra.yaml b/policies/kv/service/terraform/infra.yaml deleted file mode 100644 index a0dd735..0000000 --- a/policies/kv/service/terraform/infra.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Allow the terraform-infra runner to read the NetBox + KeaAPI tokens -# (netbox_token / kea_token fields) used by the netbox and kea providers. ---- -rules: - - path: "kv/data/service/terraform/infra" - capabilities: - - read - # vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2 - # metadata path on every plan/apply; a 403 here fails the plan. - - path: "kv/metadata/service/terraform/infra" - capabilities: - - read - -auth: - approle: - - terraform_infra - k8s/au/syd1: - - woodpecker_terraform_infra diff --git a/policies/netbox/creds/terraform-infra.yaml b/policies/netbox/creds/terraform-infra.yaml deleted file mode 100644 index d7ff814..0000000 --- a/policies/netbox/creds/terraform-infra.yaml +++ /dev/null @@ -1,21 +0,0 @@ -# Allow the terraform-infra runner to mint an ephemeral NetBox token from the -# terraform-infra role (netbox/creds/terraform-infra), replacing the static -# netbox_token it used to read from kv/service/terraform/*. The e-breuninger -# netbox provider authenticates with the minted token; the lease revokes it when -# the run ends. -# -# Bound to both the terraform-infra AppRole and its Woodpecker k8s auth role, -# mirroring the terraform-ipam pattern. Both principals are created by the -# terraform-infra Vault onboarding (separate from this netbox change); until -# that onboarding lands this policy exists but attaches to nothing. ---- -rules: - - path: "netbox/creds/terraform-infra" - capabilities: - - read - -auth: - approle: - - terraform_infra - k8s/au/syd1: - - woodpecker_terraform_infra diff --git a/policies/netbox/creds/terraform-netbox.yaml b/policies/netbox/creds/terraform-netbox.yaml new file mode 100644 index 0000000..832e93e --- /dev/null +++ b/policies/netbox/creds/terraform-netbox.yaml @@ -0,0 +1,18 @@ +# Allow the terraform-netbox runner to mint an ephemeral NetBox token from the +# terraform-netbox role (netbox/creds/terraform-netbox). The e-breuninger netbox +# provider authenticates with the minted token; the lease revokes it when the +# run ends. +# +# Bound to the terraform-netbox AppRole and its Woodpecker k8s auth role, both +# declared alongside this policy. +--- +rules: + - path: "netbox/creds/terraform-netbox" + capabilities: + - read + +auth: + approle: + - terraform_netbox + k8s/au/syd1: + - woodpecker_terraform_netbox diff --git a/resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl b/resources/secret_backend/consul_root/au/syd1/terraform-netbox.hcl similarity index 61% rename from resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl rename to resources/secret_backend/consul_root/au/syd1/terraform-netbox.hcl index ff21a9f..722b4ec 100644 --- a/resources/secret_backend/consul_root/au/syd1/terraform-infra.hcl +++ b/resources/secret_backend/consul_root/au/syd1/terraform-netbox.hcl @@ -1,4 +1,4 @@ -key_prefix "infra/terraform/infra/" { +key_prefix "infra/terraform/netbox/" { policy = "write" }