unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add the netbox secrets engine modules and wiring #115

Merged
benvin merged 3 commits from benvin/netbox-secrets-engine into master 2026-08-09 16:36:18 +10:00
Conversation 0 Commits 3 Files Changed 15
+456
unkinben commented 2026-08-09 00:16:23 +10:00
Owner
Copy Link
Copy Source

Why

  • Managing NetBox from Vault needs three capabilities the repo does not yet have: mounting the netbox engine, minting scoped tokens through roles, and creating the NetBox service users those roles mint tokens for. Landing the modules and config scaffolding before any backend or role data lets each concrete identity be added as pure data later.

How

  • Add three modules under modules/vault_cluster/modules: netbox_secret_backend (mount + engine config, admin token read from KV), netbox_secret_backend_role (mint ephemeral scoped tokens for a filename-derived NetBox username), and netbox_user_management (mirror consul_acl_management: read the seeded admin token, drive one e-breuninger/netbox provider per backend, and synthesize the NetBox user + object permissions from the role map's inline permissions).
  • Derive the netbox_secret_backend and netbox_secret_backend_role maps in config.hcl, deriving each role's name and netbox_username from its filename so the engine role and NetBox username match by construction.
  • Wire the three module blocks and their variables through vault_cluster and the syd1 terragrunt inputs, reusing the sanitized backend-alias pattern the Consul providers use.
  • Leave the backend and role maps empty: the modules stand ready and create nothing until backend and role config data are added.

Dependency order

  • Stacked on the plugin registration PR (branch benvin/netbox-plugin); merge that first, then this, then the backend + role PR (#117). Plans clean with empty netbox maps.
## Why - Managing NetBox from Vault needs three capabilities the repo does not yet have: mounting the netbox engine, minting scoped tokens through roles, and creating the NetBox service users those roles mint tokens for. Landing the modules and config scaffolding before any backend or role data lets each concrete identity be added as pure data later. ## How - Add three modules under `modules/vault_cluster/modules`: `netbox_secret_backend` (mount + engine config, admin token read from KV), `netbox_secret_backend_role` (mint ephemeral scoped tokens for a filename-derived NetBox username), and `netbox_user_management` (mirror consul_acl_management: read the seeded admin token, drive one e-breuninger/netbox provider per backend, and synthesize the NetBox user + object permissions from the role map's inline permissions). - Derive the `netbox_secret_backend` and `netbox_secret_backend_role` maps in `config.hcl`, deriving each role's name and netbox_username from its filename so the engine role and NetBox username match by construction. - Wire the three module blocks and their variables through `vault_cluster` and the syd1 terragrunt inputs, reusing the sanitized backend-alias pattern the Consul providers use. - Leave the backend and role maps empty: the modules stand ready and create nothing until backend and role config data are added. ## Dependency order - Stacked on the plugin registration PR (branch `benvin/netbox-plugin`); merge that first, then this, then the backend + role PR (#117). Plans clean with empty netbox maps.
unkinben changed title from Add NetBox secrets engine: mount, roles, policies to Add the netbox secrets engine modules and wiring 2026-08-09 13:15:34 +10:00
unkinben changed target branch from master to benvin/netbox-plugin 2026-08-09 13:34:42 +10:00
benvin changed target branch from benvin/netbox-plugin to master 2026-08-09 16:30:13 +10:00
benvin added 2 commits 2026-08-09 16:30:13 +10:00
Register the netbox secrets plugin in the catalog
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
f1b6751257 
Why:
- The netbox secrets engine cannot be mounted until its plugin binary is
  registered in the OpenBao catalog, so the catalog entry must land before any
  engine mount or role config references it.

How:
- Add config/plugins/vault-plugin-secrets-netbox.yaml registering the plugin as
  a secret plugin, pinned to the released v0.1.0 binary sha256 that Puppet
  installs on the OpenBao nodes. Bump the sha in lockstep with any RPM upgrade.
Add the netbox secrets engine modules and wiring
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
e2cd80e222 
Why:
- Managing NetBox from Vault needs three capabilities the repo does not yet
  have: mounting the netbox engine, minting scoped tokens through roles, and
  creating the NetBox service users those roles mint tokens for. Landing the
  modules and config scaffolding before any backend or role data lets each
  concrete identity be added as pure data later.

How:
- Add three modules under modules/vault_cluster/modules: netbox_secret_backend
  (mount + engine config, admin token read from KV), netbox_secret_backend_role
  (mint ephemeral scoped tokens for a filename-derived NetBox username), and
  netbox_user_management (mirror consul_acl_management: read the seeded admin
  token, drive one e-breuninger/netbox provider per backend, and synthesize the
  NetBox user + object permissions from the role map's inline permissions).
- Derive the netbox_secret_backend and netbox_secret_backend_role maps in
  config.hcl, deriving each role's name and netbox_username from its filename so
  the engine role and NetBox username match by construction.
- Wire the three module blocks and their variables through vault_cluster and the
  syd1 terragrunt inputs, reusing the sanitized backend-alias pattern the Consul
  providers use.
- Leave the backend and role maps empty: the modules stand ready and create
  nothing until backend and role config data are added.
benvin added 1 commit 2026-08-09 16:32:04 +10:00
Merge branch 'master' into benvin/netbox-secrets-engine
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
2eca239284
benvin merged commit 521ef4f0f3 into master 2026-08-09 16:36:18 +10:00
benvin deleted branch benvin/netbox-secrets-engine 2026-08-09 16:36:19 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#115
Delete Branch "benvin/netbox-secrets-engine"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?