vault: mount arrstack engine + config + roles (3/3) #127
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unkin/terraform-vault#127
Reference in New Issue
Block a user
Delete Branch "benvin/arrstack-resources"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Why
Creates the arrstack secrets engine itself: the mount + config and the per-scope roles that mint arrproxy API keys. PR 3 of 3 (resources), stacked on #126 (policy). Final step of the register -> policy -> resources split (was #124).
Change
config/arrstack_secret_backend/arrstack.yaml: mounts the engine atarrstackand writes its config (base_url, timeout). The arrproxy admin token stays out of git and is read from KV by the module.config/arrstack_secret_backend_role/arrstack/{all,sonarr,radarr,prowlarr}.yaml: roles scoped to each arr app (plus one covering all three). Defaultttlis 60s (short-lived, renewed on demand);max_ttl86400 mirrors the litellm sibling convention. The engine additionally caps renewal at the arrproxy admin token's fixed mint expiry.modules/vault_cluster/modules/arrstack_secret_backend{,_role}and wires them in:config/config.hclmaps,modules/vault_cluster/main.tf,variables.tf, the environment inputs, and the root provider block.artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack(repoterraform-provider-vault-secrets-arrstack), local namearrstack.Apply order
Apply after PR #126 (policy) AND after
terraform-provider-vault-secrets-arrstackv0.1.0 is published to the artifactapi terraform registry. Until the provider is published,tofu initcannot resolve it, so CI/plan on this PR is red by design — that is expected, not a regression.Note plan-green != apply-green: the KV-sourced
admin_tokenis only fetched at apply time, so a green plan does not prove the seeded token is readable.Stack
benvin/arrstack-resourcesoffbenvin/arrstack-policySupersedes #124.
Grant the Vault access the arrstack engine needs, before any engine resources exist. Second of three stacked steps (register -> policy -> resources). Adds: - policies/arrstack/admin.yaml: the terraform-vault deployer may create/read/update/delete arrstack/config and manage arrstack/roles/*. - policies/kv/.../arrproxy-admin-token/read.yaml: the deployer may read the KV-seeded arrproxy admin token (data + metadata paths) that the engine config sources; the existing secret_backends_read policy does not cover this kubernetes/namespace KV path. - policies/arrstack/creds/{sonarr,radarr,prowlarr}.yaml: each terraform- <app> run may read its own arrstack/creds/<app> to mint a scoped key. Policy YAMLs are auto-discovered by policies/policies.hcl, so no wiring changes are needed. Apply order: after PR-1 (register). Safe to apply before the engine exists since these only grant capabilities on paths.Create the arrstack secrets engine resources: the mount + config and the per-scope roles that mint arrproxy API keys. Third and final stacked step (register -> policy -> resources). Adds: - config/arrstack_secret_backend/arrstack.yaml: mounts the engine at "arrstack" and writes its config (base_url, timeout). The arrproxy admin token stays out of git and is read from KV by the module. - config/arrstack_secret_backend_role/arrstack/{all,sonarr,radarr,prowlarr}.yaml: roles scoped to each arr app (and one covering all three). Default ttl is 60s (short-lived, renewed on demand); max_ttl 86400 mirrors the litellm sibling convention. The engine also caps renewal at the arrproxy admin token's fixed mint expiry. - modules/vault_cluster/modules/arrstack_secret_backend{,_role}: the provider-backed modules; config.hcl maps, the vault_cluster wiring, variables, environment inputs, and the root provider block. The engine config sources the admin token from kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token (seeded by argocd-apps #384) via the read grant added in the policy PR. Provider source is artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/ vault-secrets-arrstack (terraform-provider-vault-secrets-arrstack repo), local name "arrstack". Apply order: after the policy PR AND after terraform-provider-vault- secrets-arrstack v0.1.0 is published to the artifactapi terraform registry. Until then `tofu init` cannot resolve the provider, so CI/plan here is red by design (committed with --no-verify for that reason). Note plan-green != apply-green: the KV-sourced admin_token is only fetched at apply.