Grant the Vault access the arrstack engine needs, before any engine
resources exist. Second of three stacked steps (register -> policy ->
resources).
Adds:
- policies/arrstack/admin.yaml: the terraform-vault deployer may
create/read/update/delete arrstack/config and manage arrstack/roles/*.
- policies/kv/.../arrproxy-admin-token/read.yaml: the deployer may read
the KV-seeded arrproxy admin token (data + metadata paths) that the
engine config sources; the existing secret_backends_read policy does
not cover this kubernetes/namespace KV path.
- policies/arrstack/creds/{sonarr,radarr,prowlarr}.yaml: each terraform-
<app> run may read its own arrstack/creds/<app> to mint a scoped key.
Policy YAMLs are auto-discovered by policies/policies.hcl, so no wiring
changes are needed.
Apply order: after PR-1 (register). Safe to apply before the engine
exists since these only grant capabilities on paths.
Import the arrstack secrets plugin (v0.1.0) into the OpenBao plugin
catalog so later PRs can mount the engine. Registration is the first of
three stacked, independently-applied steps (register -> policy ->
resources) per the never-bundle rule.
The plugins map glob and module.plugin already exist, so this only adds
the catalog entry; the sha256 pins the released v0.1.0 binary.
Apply order: run this only AFTER the Puppet plugin-install PR (#521,
merged) has placed the binary at
/opt/openbao-plugins/vault-plugin-secrets-arrstack on the OpenBao nodes.
Registration fails until the binary is present.
unkin-agent