unkinben
28d0a6ed79
The netbox secrets engine seeds its admin_token from KV once and then rotates it in place (netbox/config/rotate), which mints a fresh admin token and deletes the old one. netbox_user_management re-reads that same KV admin_token on every apply to drive the e-breuninger provider, so after the first rotation it authenticates with a token NetBox has already deleted and the apply fails. A separate failure mode compounds this: a KV admin token carrying a literal "Bearer "/"Token " scheme prefix produces a malformed three-part Authorization header and a 403, because NetBox derives the token version from the value's nbt_ prefix (not the keyword) and expects a bare token. - Read a dedicated, never-rotated user_mgmt_token for user management, falling back to admin_token only as a bootstrap convenience until it is seeded. - Add a check block that warns when only the rotating seed is present, nudging operators to seed user_mgmt_token before enabling engine rotation. - Add data-source postconditions on both modules rejecting a scheme-prefixed admin credential with a clear message instead of a downstream 403. - Document the two KV keys and the bare-token contract in the backend config.
terraform-vault
A repository to manage the configuration of Vault secret engines, authentication modes and policies.
Usage
- Initialize Terraform
Once you have your backend block configured, you need to initialize your Terraform working directory to configure the backend:
terraform init
This command initializes the backend and checks the connection to Consul. If everything is set up correctly, Terraform will start using Consul as its backend for storing the state.
- Common terraform init Errors
If you encounter errors while running terraform init, check the following:
Consul server is reachable: Make sure that the address is correct and that you can connect to the Consul server.
Consul token (if using ACLs): Verify that the token has the correct permissions to write to the specified path in the Consul KV store.
- Example Consul KV Structure
In Consul, the state file will be stored in the KV store under the specified path:
terraform/state
You can check the Consul KV store by accessing the Consul UI or using the consul kv command to see the stored Terraform state:
consul kv get terraform/state