vault: add arrstack policies (deployer + KV read + creds) (2/3) #126

Merged

benvin merged 2 commits from benvin/arrstack-policy into master 2026-08-19 22:54:14 +10:00

Conversation 0 Commits 2 Files Changed 6

+98

unkin-agent commented 2026-08-19 21:43:02 +10:00

Member

Copy Link

Copy Source

Why

Grants the Vault access the arrstack engine needs, before any engine resources exist. PR 2 of 3 (policy), stacked on #125 (register). Keeping policy separate from resources honours the never-bundle / sequential-apply rule.

Change

• Adds policies/arrstack/admin.yaml: the terraform-vault deployer (tf_vault approle + woodpecker_terraform_vault k8s role) may create/read/update/delete arrstack/config and manage arrstack/roles/*.
• Adds policies/kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token/read.yaml: the deployer may read the KV-seeded arrproxy admin token (both kv/data/... and kv/metadata/...) that the engine config sources. The existing secret_backends_read policy does not cover this kubernetes/namespace KV path.
• Adds policies/arrstack/creds/{sonarr,radarr,prowlarr}.yaml: each terraform-<app> run may read its own arrstack/creds/<app> to mint a scoped key.
• Policy YAMLs are auto-discovered by policies/policies.hcl, so no wiring changes are needed.

Apply order

Apply after PR #125 (register). Safe to apply before the engine exists — these only grant capabilities on paths.

Stack

1. register -> vault: register vault-plugin-secrets-arrstack in the catalog (1/3) (#125)
2. policy (this PR) -> benvin/arrstack-policy off benvin/arrstack-register
3. resources -> benvin/arrstack-resources

Supersedes #124.

## Why Grants the Vault access the arrstack engine needs, before any engine resources exist. **PR 2 of 3 (policy)**, stacked on #125 (register). Keeping policy separate from resources honours the never-bundle / sequential-apply rule. ## Change - Adds `policies/arrstack/admin.yaml`: the terraform-vault deployer (`tf_vault` approle + `woodpecker_terraform_vault` k8s role) may create/read/update/delete `arrstack/config` and manage `arrstack/roles/*`. - Adds `policies/kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token/read.yaml`: the deployer may read the KV-seeded arrproxy admin token (both `kv/data/...` and `kv/metadata/...`) that the engine config sources. The existing `secret_backends_read` policy does not cover this `kubernetes/namespace` KV path. - Adds `policies/arrstack/creds/{sonarr,radarr,prowlarr}.yaml`: each `terraform-<app>` run may read its own `arrstack/creds/<app>` to mint a scoped key. - Policy YAMLs are auto-discovered by `policies/policies.hcl`, so no wiring changes are needed. ## Apply order Apply **after PR #125 (register)**. Safe to apply before the engine exists — these only grant capabilities on paths. ## Stack 1. register -> #125 2. **policy (this PR)** -> `benvin/arrstack-policy` off `benvin/arrstack-register` 3. resources -> `benvin/arrstack-resources` Supersedes #124.

unkin-agent referenced this pull request 2026-08-19 21:43:24 +10:00

vault: mount arrstack engine + config + roles (3/3) #127

benvin changed target branch from benvin/arrstack-register to master 2026-08-19 21:50:59 +10:00

benvin added 2 commits 2026-08-19 21:50:59 +10:00

Register vault-plugin-secrets-arrstack in the plugin catalog ... f0a61dc352

Import the arrstack secrets plugin (v0.1.0) into the OpenBao plugin
catalog so later PRs can mount the engine. Registration is the first of
three stacked, independently-applied steps (register -> policy ->
resources) per the never-bundle rule.

The plugins map glob and module.plugin already exist, so this only adds
the catalog entry; the sha256 pins the released v0.1.0 binary.

Apply order: run this only AFTER the Puppet plugin-install PR (#521,
merged) has placed the binary at
/opt/openbao-plugins/vault-plugin-secrets-arrstack on the OpenBao nodes.
Registration fails until the binary is present.

Add arrstack Vault policies (deployer, KV read, consumer creds) ... 5862ae974c

Grant the Vault access the arrstack engine needs, before any engine
resources exist. Second of three stacked steps (register -> policy ->
resources).

Adds:
- policies/arrstack/admin.yaml: the terraform-vault deployer may
  create/read/update/delete arrstack/config and manage arrstack/roles/*.
- policies/kv/.../arrproxy-admin-token/read.yaml: the deployer may read
  the KV-seeded arrproxy admin token (data + metadata paths) that the
  engine config sources; the existing secret_backends_read policy does
  not cover this kubernetes/namespace KV path.
- policies/arrstack/creds/{sonarr,radarr,prowlarr}.yaml: each terraform-
  <app> run may read its own arrstack/creds/<app> to mint a scoped key.

Policy YAMLs are auto-discovered by policies/policies.hcl, so no wiring
changes are needed.

Apply order: after PR-1 (register). Safe to apply before the engine
exists since these only grant capabilities on paths.

benvin merged commit 31a7abec99 into master 2026-08-19 22:54:14 +10:00

benvin deleted branch benvin/arrstack-policy 2026-08-19 22:54:14 +10:00

benvin referenced this issue from a commit 2026-08-21 00:09:48 +10:00

vault: mount arrstack engine + config + roles (3/3) (#127)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-vault#126