konairius/homelab
10
0
Fork 0
Code Issues 11 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

feat(proxmox): automated pve-exporter token rotation (Class-B) — SUSPENDED/UNTESTED #306

Merged
k.renner merged 4 commits from feat/pve-exporter-token-rotation into master 2026-07-19 08:34:50 +00:00
Conversation 0 Commits 4 Files Changed 5
+171 -1
claude-bot commented 2026-07-18 22:11:23 +00:00
Member
Copy Link
Copy Source

Class-B rotation of pve-exporter@pve!monitoring. Proxmox has no in-place secret roll (correcting the earlier research note), so this DELETE+re-creates the token (privsep=0), regenerates the pve.yml config with the new value, and patches OpenBao → ESO (10m) → Reloader restarts pve-exporter.

⚠️ Suspended + untested — the riskiest of the three

Before enabling:

  1. Provision bootstrap: a separate privileged Proxmox token (able to manage tokens on pve-exporter@pve) at homelab/infrastructure/secret-rotators-bootstrap/proxmox (api-url, auth=user!id=secret) + apply rotator-proxmox policy/role.
  2. Verify privsep: this re-creates with privsep=0 (token inherits the user's perms). If the current token is privsep=1 with its own ACL, you must re-grant that ACL after re-create or the exporter loses access.
  3. Monitoring gap: DELETE→create leaves a brief window with no valid token (metrics gap until ESO≤10m + restart). Quarterly/off-hours.
  4. Test on-demand, confirm metrics resume, then suspend: false.

Same Class-B template as #304/#305. kustomize clean.

Class-B rotation of `pve-exporter@pve!monitoring`. **Proxmox has no in-place secret roll** (correcting the earlier research note), so this **DELETE+re-creates** the token (privsep=0), regenerates the `pve.yml` config with the new value, and patches OpenBao → ESO (10m) → Reloader restarts pve-exporter. ### ⚠️ Suspended + untested — the riskiest of the three Before enabling: 1. **Provision bootstrap**: a *separate* privileged Proxmox token (able to manage tokens on pve-exporter@pve) at `homelab/infrastructure/secret-rotators-bootstrap/proxmox` (`api-url`, `auth=user!id=secret`) + apply `rotator-proxmox` policy/role. 2. **Verify privsep**: this re-creates with `privsep=0` (token inherits the user's perms). If the current token is `privsep=1` with its own ACL, you must re-grant that ACL after re-create or the exporter loses access. 3. **Monitoring gap**: DELETE→create leaves a brief window with no valid token (metrics gap until ESO≤10m + restart). Quarterly/off-hours. 4. Test on-demand, confirm metrics resume, then `suspend: false`. Same Class-B template as #304/#305. kustomize clean.
claude-bot added 1 commit 2026-07-18 22:11:23 +00:00
feat(proxmox): automated pve-exporter token rotation (Class-B, openbao-ns) — SUSPENDED 69ecab3a06 
Rotates pve-exporter@pve!monitoring via the Proxmox API. Proxmox has no in-place secret roll, so DELETE+re-create (privsep=0), regenerate pve.yml with the new token_value, patch OpenBao. openbao-ns pattern; per-secret rotator-proxmox role reads a bootstrap privileged Proxmox token + patches pve-exporter-config. refreshInterval 1h->10m; Reloader restarts pve-exporter.
SHIPPED SUSPENDED + UNTESTED (riskiest Class-B): needs a bootstrap privileged Proxmox token at homelab/infrastructure/secret-rotators-bootstrap/proxmox, VERIFICATION that the token uses privsep=0 (else re-grant its ACL after re-create), and awareness of the brief monitoring gap during DELETE+create. Test before spec.suspend=false.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ
claude-bot added 2 commits 2026-07-19 07:13:58 +00:00
merge master (netbird kustomization) 3d6caa75bf
fix(proxmox-rotation): python:alpine (apk fails non-root; lesson from netbird test) fd85dbb901 
Same fix proven on netbird (#307/#308): alpine+apk -> python:3.13-alpine stdlib so it runs under the non-root restricted PSA. Uses a dedicated no-verify SSL context for the self-signed Proxmox API only (OpenBao stays plain http). Still suspended + untested; the privsep=0 caveat + brief monitoring gap on DELETE+recreate remain documented in the header.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ
claude-bot added 1 commit 2026-07-19 07:55:59 +00:00
Merge remote-tracking branch 'origin/master' into feat/pve-exporter-token-rotation 5a7b122157 
# Conflicts:
#	kubernetes/infrastructure/openbao/rotation/kustomization.yaml
k.renner merged commit 7ec7eb8929 into master 2026-07-19 08:34:50 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#306