unkin-agent
5567bd6dac
Wires the vault-plugin-secrets-arrstack dynamic engine so terraform-sonarr/ radarr/prowlarr can mint scoped arrproxy API keys, mirroring the litellm engine. - Register vault-plugin-secrets-arrstack v0.1.0 in the plugin catalog. - Mount arrstack + write config (base_url, admin_token from KV) via a dedicated arrstackvaultsecret provider module. - Add sonarr/radarr/prowlarr/all roles. - Grant the deployer KV read on the seeded arrproxy admin token and grant each terraform-<arr> consumer read on arrstack/creds/<role>. Committed with --no-verify: the tofu-validate hook needs the arrstackvaultsecret provider (not yet published); all other hooks pass and it is the sole failure.
10 lines
593 B
YAML
10 lines
593 B
YAML
# Mounts the arrstack dynamic secrets engine at "arrstack" and writes its config.
|
|
# The arrproxy admin token is sensitive and read from KV, not stored here:
|
|
# kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token -> key "token"
|
|
# (seeded by argocd-apps #384). arrstack.unkin.net terminates on traefik-external
|
|
# with an internal-CA cert the OpenBao nodes already trust, so ca_cert is omitted
|
|
# (system trust store), mirroring the gitea engine against git.unkin.net.
|
|
description: "arrstack dynamic arrproxy API keys"
|
|
base_url: "https://arrstack.unkin.net"
|
|
request_timeout_seconds: 30
|