Initial NetBox token secrets engine #1

2026-08-08T20:10:00+10:00

unkinben commented

2026-08-08 20:10:00 +10:00

Why

CI jobs and Puppet fact collectors hold long-lived NetBox tokens that are hard to rotate and easy to leak; a leaked token is standing API access until someone notices and hand-rotates it.

How

Seed one admin token in config; roles/<name> names a pre-existing NetBox service user plus write_enabled (default false) and ttl/max_ttl.
creds/<role> mints a per-user token whose NetBox expires is aligned to the Vault lease; revoke deletes it, renew PATCHes expires forward.
config/rotate reissues the seeded admin token (NetBox has no in-place rotate).
Build the credential for NetBox 4.6 v2 tokens (Bearer nbt_<key>.<secret>) and legacy v1 (Token <value>); token_version is selectable for peppers-less servers.
Ship dual Vault/OpenBao RPMs via nfpm on tag to artifactapi rpm-internal.

## Why CI jobs and Puppet fact collectors hold long-lived NetBox tokens that are hard to rotate and easy to leak; a leaked token is standing API access until someone notices and hand-rotates it. ## How - Seed one admin token in `config`; `roles/<name>` names a pre-existing NetBox service user plus `write_enabled` (default false) and `ttl`/`max_ttl`. - `creds/<role>` mints a per-user token whose NetBox `expires` is aligned to the Vault lease; revoke deletes it, renew PATCHes `expires` forward. - `config/rotate` reissues the seeded admin token (NetBox has no in-place rotate). - Build the credential for NetBox 4.6 v2 tokens (`Bearer nbt_<key>.<secret>`) and legacy v1 (`Token <value>`); `token_version` is selectable for peppers-less servers. - Ship dual Vault/OpenBao RPMs via nfpm on tag to artifactapi `rpm-internal`.

unkinben added 1 commit 2026-08-08 22:15:07 +10:00

Initial vault-plugin-secrets-netbox

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

cfbc06669e

Vault/OpenBao secrets engine that mints NetBox API tokens via
/api/users/tokens/. A single seeded admin token (config) mints short-lived,
per-user tokens (roles -> creds) whose NetBox expiry is aligned to the Vault
lease; revoke deletes the token, renew extends its expiry. config/rotate
reissues the seeded admin token. Handles NetBox 4.6 v2 tokens (Bearer
nbt_<key>.<secret>) and legacy v1. Unit tests against an httptest NetBox mock;
dual Vault/OpenBao RPMs via nfpm; tag-driven release to artifactapi.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

unkinben force-pushed benvin/netbox-secrets-engine from 979f42a578 to cfbc06669e

2026-08-08 22:15:07 +10:00

Compare

benvin merged commit 8a715f8cec into main

2026-08-08 22:19:05 +10:00

benvin deleted branch benvin/netbox-secrets-engine

2026-08-08 22:19:06 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-plugin-secrets-netbox#1