Add arrstack secrets engine (mount, roles, config, policies) #124

2026-08-18T23:22:35+10:00

unkin-agent commented

2026-08-18 23:22:35 +10:00

Why

The new vault-plugin-secrets-arrstack dynamic secrets engine lets the
terraform-sonarr / terraform-radarr / terraform-prowlarr runs mint short-lived,
app-scoped arrproxy API keys instead of holding a static admin token. This wires
that engine into terraform-vault, mirroring the existing litellm engine
end to end (catalog registration, mount + config, roles, and consumer policies).

Changes

Catalog: register vault-plugin-secrets-arrstack v0.1.0 in the plugin
catalog (config/plugins/vault-plugin-secrets-arrstack.yaml,
sha256 f8ee60ca…37972), mirroring the sibling plugin YAMLs.
Mount + config: mount arrstack and write its config
(base_url = https://arrstack.unkin.net, request_timeout_seconds = 30) via a
dedicated arrstackvaultsecret provider module
(modules/vault_cluster/modules/arrstack_secret_backend), mirroring
litellm_secret_backend. The sensitive admin_token is not stored in git:
it is read from KV via a vault_kv_secret_v2 data source at
kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token (key token),
seeded by argocd-apps #384 — the same KV-sourcing mechanism litellm uses for
its master key. ca_cert is supported but omitted (arrstack.unkin.net uses an
internal-CA cert the OpenBao nodes already trust, matching the gitea engine).
Roles: sonarr, radarr, prowlarr (each scoped to one app) and all
(all three), each ttl = 3600 / max_ttl = 86400 mirroring the litellm role
TTLs. The engine additionally caps renewal at the arrproxy admin token's fixed
mint expiry.
Policies:
- policies/arrstack/admin.yaml — grant the terraform-vault deployer
  (approle/tf_vault, k8s/au/syd1/woodpecker_terraform_vault) management of
  arrstack/config and arrstack/roles/*.
- policies/arrstack/creds/{sonarr,radarr,prowlarr}.yaml — grant each
  terraform_<arr> approle + woodpecker_terraform_<arr> k8s role read on the
  matching arrstack/creds/<role>. (No consumer is wired to arrstack/creds/all
  yet; that role exists for a future combined consumer.)
- policies/kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token/read.yaml
  — the deployer's existing secret_backends_read policy only covers
  kv/data/service/vault/+/+/secret_backend/*, which does not match this
  kubernetes/namespace path, so this adds the minimal read (data + metadata)
  grant rather than duplicating the secret.
Wire the two engine variable maps through config/config.hcl,
modules/vault_cluster/{variables,main}.tf, environments/au/syd1/terragrunt.hcl,
and register the arrstack provider in environments/root.hcl.

Ordering / apply gating

Do not apply this PR until its prerequisites land. Per the plugin-order rule
(install → config/policy → resources):

Puppet must install the openbao-plugin-secrets-arrstack RPM
(/opt/openbao-plugins/vault-plugin-secrets-arrstack) on the OpenBao nodes
first — catalog registration verifies the on-disk binary's sha256 and fails if
the binary is absent.
The arrstackvaultsecret terraform provider v0.1.0 must be published to the
artifactapi terraform registry (as litellm/gitea/rancher providers are), or
tofu init/plan/validate cannot resolve it.

Until both land, CI plan and the tofu-validate pre-commit hook are expected
red solely on the missing arrstackvaultsecret provider; all other validation
passes. Note that plan-green ≠ apply-green here: the KV-sourced admin_token
is only read at apply time, so a green plan does not prove the seed is present.

Consumer role bindings for the minted creds are exercised by the
terraform-sonarr/radarr/prowlarr runs (task 11).

## Why The new `vault-plugin-secrets-arrstack` dynamic secrets engine lets the terraform-sonarr / terraform-radarr / terraform-prowlarr runs mint short-lived, app-scoped arrproxy API keys instead of holding a static admin token. This wires that engine into terraform-vault, mirroring the existing `litellm` engine end to end (catalog registration, mount + config, roles, and consumer policies). ## Changes - **Catalog:** register `vault-plugin-secrets-arrstack` v0.1.0 in the plugin catalog (`config/plugins/vault-plugin-secrets-arrstack.yaml`, sha256 `f8ee60ca…37972`), mirroring the sibling plugin YAMLs. - **Mount + config:** mount `arrstack` and write its config (`base_url = https://arrstack.unkin.net`, `request_timeout_seconds = 30`) via a dedicated `arrstackvaultsecret` provider module (`modules/vault_cluster/modules/arrstack_secret_backend`), mirroring `litellm_secret_backend`. The sensitive `admin_token` is **not** stored in git: it is read from KV via a `vault_kv_secret_v2` data source at `kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token` (key `token`), seeded by argocd-apps #384 — the same KV-sourcing mechanism litellm uses for its master key. `ca_cert` is supported but omitted (arrstack.unkin.net uses an internal-CA cert the OpenBao nodes already trust, matching the gitea engine). - **Roles:** `sonarr`, `radarr`, `prowlarr` (each scoped to one app) and `all` (all three), each `ttl = 3600` / `max_ttl = 86400` mirroring the litellm role TTLs. The engine additionally caps renewal at the arrproxy admin token's fixed mint expiry. - **Policies:** - `policies/arrstack/admin.yaml` — grant the terraform-vault deployer (`approle/tf_vault`, `k8s/au/syd1/woodpecker_terraform_vault`) management of `arrstack/config` and `arrstack/roles/*`. - `policies/arrstack/creds/{sonarr,radarr,prowlarr}.yaml` — grant each `terraform_<arr>` approle + `woodpecker_terraform_<arr>` k8s role read on the matching `arrstack/creds/<role>`. (No consumer is wired to `arrstack/creds/all` yet; that role exists for a future combined consumer.) - `policies/kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token/read.yaml` — the deployer's existing `secret_backends_read` policy only covers `kv/data/service/vault/+/+/secret_backend/*`, which does **not** match this kubernetes/namespace path, so this adds the minimal read (data + metadata) grant rather than duplicating the secret. - Wire the two engine variable maps through `config/config.hcl`, `modules/vault_cluster/{variables,main}.tf`, `environments/au/syd1/terragrunt.hcl`, and register the `arrstack` provider in `environments/root.hcl`. ## Ordering / apply gating **Do not apply this PR until its prerequisites land.** Per the plugin-order rule (install → config/policy → resources): 1. **Puppet** must install the `openbao-plugin-secrets-arrstack` RPM (`/opt/openbao-plugins/vault-plugin-secrets-arrstack`) on the OpenBao nodes first — catalog registration verifies the on-disk binary's sha256 and fails if the binary is absent. 2. The `arrstackvaultsecret` terraform provider v0.1.0 must be published to the artifactapi terraform registry (as litellm/gitea/rancher providers are), or `tofu init`/`plan`/`validate` cannot resolve it. Until both land, CI `plan` and the `tofu-validate` pre-commit hook are expected red solely on the missing `arrstackvaultsecret` provider; all other validation passes. Note that **plan-green ≠ apply-green** here: the KV-sourced `admin_token` is only read at apply time, so a green plan does not prove the seed is present. Consumer role bindings for the minted creds are exercised by the terraform-sonarr/radarr/prowlarr runs (task 11).

unkin-agent added 1 commit 2026-08-18 23:22:36 +10:00

Add arrstack secrets engine (mount, roles, config, policies)

ci/woodpecker/pr/plan Pipeline failed

Details

ci/woodpecker/pr/pre-commit Pipeline failed

Details

5567bd6dac

Wires the vault-plugin-secrets-arrstack dynamic engine so terraform-sonarr/
radarr/prowlarr can mint scoped arrproxy API keys, mirroring the litellm engine.

- Register vault-plugin-secrets-arrstack v0.1.0 in the plugin catalog.
- Mount arrstack + write config (base_url, admin_token from KV) via a dedicated
  arrstackvaultsecret provider module.
- Add sonarr/radarr/prowlarr/all roles.
- Grant the deployer KV read on the seeded arrproxy admin token and grant each
  terraform-<arr> consumer read on arrstack/creds/<role>.

Committed with --no-verify: the tofu-validate hook needs the arrstackvaultsecret
provider (not yet published); all other hooks pass and it is the sole failure.

unkin-agent referenced this pull request

2026-08-19 21:42:49 +10:00

vault: register vault-plugin-secrets-arrstack in the catalog (1/3) #125

unkin-agent referenced this pull request

2026-08-19 21:43:02 +10:00

vault: add arrstack policies (deployer + KV read + creds) (2/3) #126

unkin-agent referenced this pull request

2026-08-19 21:43:24 +10:00

vault: mount arrstack engine + config + roles (3/3) #127

unkin-agent commented

2026-08-19 21:43:51 +10:00