unkinben
483fd21acb
Replace the second static user_mgmt_token with a Vault-minted, user-admin-capable token so only ONE static NetBox admin credential exists. A dedicated engine role (netbox/roles/vault-user-mgmt) mints a short-lived token for a pre-existing NetBox superuser (user_mgmt_username); netbox_user_management authenticates the e-breuninger provider with that minted token to reconcile the service users. This also resolves rotation-divergence structurally: the credential is always derived from the current static admin token, so rotating it never strands user management. Constraints this design works within (documented in the module): - The hashicorp/vault provider ships ephemeral resources for KV only, not dynamic engine creds, so the mint is read via the vault_generic_secret data source; the short-lived token transits state (sensitive, lease-revoked) and is re-minted each plan. Migrate to an ephemeral resource once the provider ships one. - A provider cannot be configured from a role created in the same fresh apply, so a brand-new backend needs a one-time targeted bootstrap of the mount + role. - Add user_mgmt_username to the netbox backend config; when set, mint dynamically, else fall back to the single static admin_token (a check block warns that rotation would then break user management). - Add module.netbox_user_mgmt_role (vault-user-mgmt, write-enabled, short TTL). - Grant the deployer read on netbox/creds/vault-user-mgmt (the one deliberate exception to the admin policy's creds exclusion). - Keep the bare-token + token_version postconditions on the single admin token.
terraform-vault
A repository to manage the configuration of Vault secret engines, authentication modes and policies.
Usage
- Initialize Terraform
Once you have your backend block configured, you need to initialize your Terraform working directory to configure the backend:
terraform init
This command initializes the backend and checks the connection to Consul. If everything is set up correctly, Terraform will start using Consul as its backend for storing the state.
- Common terraform init Errors
If you encounter errors while running terraform init, check the following:
Consul server is reachable: Make sure that the address is correct and that you can connect to the Consul server.
Consul token (if using ACLs): Verify that the token has the correct permissions to write to the specified path in the Consul KV store.
- Example Consul KV Structure
In Consul, the state file will be stored in the KV store under the specified path:
terraform/state
You can check the Consul KV store by accessing the Consul UI or using the consul kv command to see the stored Terraform state:
consul kv get terraform/state