feat(netbird): automated setup-key rotation (Class-B, openbao-ns) — SUSPENDED/UNTESTED #304

2026-07-18T22:06:30Z

claude-bot commented

2026-07-18 22:06:30 +00:00

First Class-B rotation (calls an external API to mint a credential, vs Class-A random values). Rotates the NetBird ingress setup-key via the self-hosted mgmt API (POST /api/setup-keys), then patches OpenBao → ESO → Reloader restarts the netbird-ingress DaemonSet to re-enroll. openbao-ns pattern; rotator-netbird role reads a bootstrap PAT + patches the target path; refreshInterval 1h→10m.

⚠️ Shipped suspended + untested (`spec.suspend: true`)

I can't test this (no bootstrap cred), and it mutates a live system, so it's gated. Before enabling:

Provision the bootstrap PAT: bao kv put homelab/infrastructure/secret-rotators-bootstrap/netbird pat=<NetBird PAT> (+ apply the rotator-netbird policy/role).
Fill NB_AUTO_GROUPS in netbird-ingress.yaml with your real NetBird group IDs (the new key must place peers in the same groups as today — GET /api/groups).
Test on-demand, verify a peer re-enrolls.
Only then flip suspend: false.

This is the template for the Cloudflare + Proxmox Class-B rotations. kustomize clean.

First **Class-B** rotation (calls an external API to mint a credential, vs Class-A random values). Rotates the NetBird ingress `setup-key` via the self-hosted mgmt API (`POST /api/setup-keys`), then patches OpenBao → ESO → Reloader restarts the `netbird-ingress` DaemonSet to re-enroll. openbao-ns pattern; `rotator-netbird` role reads a bootstrap PAT + patches the target path; refreshInterval 1h→10m. ### ⚠️ Shipped **suspended + untested** (`spec.suspend: true`) I can't test this (no bootstrap cred), and it mutates a live system, so it's gated. Before enabling: 1. **Provision the bootstrap PAT**: `bao kv put homelab/infrastructure/secret-rotators-bootstrap/netbird pat=<NetBird PAT>` (+ apply the `rotator-netbird` policy/role). 2. **Fill `NB_AUTO_GROUPS`** in netbird-ingress.yaml with your real NetBird group IDs (the new key must place peers in the same groups as today — `GET /api/groups`). 3. **Test on-demand**, verify a peer re-enrolls. 4. Only then flip `suspend: false`. This is the **template** for the Cloudflare + Proxmox Class-B rotations. kustomize clean.

claude-bot added 1 commit 2026-07-18 22:06:31 +00:00

feat(netbird): automated setup-key rotation (Class-B, openbao-ns) — SUSPENDED 1fc2f84b74

First Class-B rotation: calls the self-hosted NetBird mgmt API to mint a fresh reusable setup key, then patches OpenBao (ESO syncs, Reloader restarts the netbird-ingress DaemonSet to re-enroll). openbao-ns pattern; per-secret rotator-netbird role/policy that reads a bootstrap NetBird PAT + patches the setup-key path. refreshInterval 1h->10m.
SHIPPED SUSPENDED + UNTESTED: needs (1) the bootstrap PAT provisioned to homelab/infrastructure/secret-rotators-bootstrap/netbird, (2) NB_AUTO_GROUPS filled with real NetBird group IDs, (3) a manual on-demand test, before spec.suspend is set false. Class-B template for the cloudflare + proxmox rotations to follow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ

claude-bot referenced this pull request

2026-07-18 22:08:33 +00:00

feat(cloudflare): automated api-token rotation (Class-B) — SUSPENDED/UNTESTED #305

k.renner merged commit ea9eed7216 into master

2026-07-19 06:38:33 +00:00

k.renner referenced this issue from a commit

2026-07-19 06:38:34 +00:00

Merge pull request 'feat(netbird): automated setup-key rotation (Class-B, openbao-ns) — SUSPENDED/UNTESTED' (#304) from feat/netbird-setup-key-rotation into master

claude-bot referenced this pull request

2026-07-19 06:45:15 +00:00

fix(netbird-rotation): use python:alpine — apk install fails under non-root PSA #307

claude-bot referenced this issue from a commit