feat(cloudflare): automated api-token rotation (Class-B) — SUSPENDED/UNTESTED #305

2026-07-18T22:08:33Z

claude-bot commented

2026-07-18 22:08:33 +00:00

Class-B rotation: rolls the cert-manager DNS-01 Cloudflare token in place (PUT /user/tokens/{id}/value — same scope, new value) → patches OpenBao → ESO syncs (10m). No Reloader (cert-manager reads the Secret fresh per DNS-01 challenge).

⚠️ Suspended + untested (`spec.suspend: true`)

Before enabling:

Provision bootstrap: bao kv put homelab/infrastructure/secret-rotators-bootstrap/cloudflare admin-token=<Edit-User-API-Tokens token> token-id=<id of the cert-manager token> (+ apply rotator-cloudflare policy/role).
Test on-demand, then issue/renew a cert to confirm DNS-01 still works with the rolled token.
Then suspend: false.

Risk: a bad roll breaks TLS cert issuance — hence gated. Same Class-B template as #304 (NetBird). kustomize clean.

Class-B rotation: rolls the cert-manager DNS-01 Cloudflare token **in place** (`PUT /user/tokens/{id}/value` — same scope, new value) → patches OpenBao → ESO syncs (10m). No Reloader (cert-manager reads the Secret fresh per DNS-01 challenge). ### ⚠️ Suspended + untested (`spec.suspend: true`) Before enabling: 1. **Provision bootstrap**: `bao kv put homelab/infrastructure/secret-rotators-bootstrap/cloudflare admin-token=<Edit-User-API-Tokens token> token-id=<id of the cert-manager token>` (+ apply `rotator-cloudflare` policy/role). 2. **Test on-demand**, then issue/renew a cert to confirm DNS-01 still works with the rolled token. 3. Then `suspend: false`. **Risk:** a bad roll breaks TLS cert issuance — hence gated. Same Class-B template as #304 (NetBird). kustomize clean.

claude-bot added 1 commit 2026-07-18 22:08:33 +00:00

feat(cloudflare): automated api-token rotation (Class-B, openbao-ns) — SUSPENDED 0ddef38d31

Rolls the cert-manager DNS-01 Cloudflare token in place (PUT /user/tokens/{id}/value) then patches OpenBao. openbao-ns pattern; per-secret rotator-cloudflare role reads a bootstrap admin-token+token-id and patches the api-token path. refreshInterval 1h->10m; no Reloader (cert-manager reads fresh per challenge).
SHIPPED SUSPENDED + UNTESTED: needs the bootstrap admin-token (Edit User API Tokens perm) + the cert-manager token-id provisioned to homelab/infrastructure/secret-rotators-bootstrap/cloudflare, then a manual test (issue/renew a cert) before spec.suspend=false. Risk: a bad roll breaks TLS issuance.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ

claude-bot referenced this pull request

2026-07-19 06:45:15 +00:00

fix(netbird-rotation): use python:alpine — apk install fails under non-root PSA #307

claude-bot referenced this issue from a commit

2026-07-19 06:45:16 +00:00

fix(netbird-rotation): use python:alpine (apk install fails under non-root PSA)

claude-bot added 2 commits 2026-07-19 07:12:27 +00:00

merge master (netbird kustomization) 589f0e0f0b

fix(cloudflare-rotation): python:alpine (apk fails non-root; lesson from netbird test) 20a1998b95

Applies the same fix proven on netbird (#307/#308): switch alpine+apk to python:3.13-alpine stdlib so the job runs under the non-root restricted PSA. CF's roll is in-place (PUT /tokens/{id}/value) so no key-settings pitfall like netbird had. Still suspended + untested (needs the bootstrap admin-token + token-id).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ

k.renner merged commit 2d57420e1b into master

2026-07-19 07:54:42 +00:00

k.renner referenced this issue from a commit

2026-07-19 07:54:44 +00:00

Merge pull request 'feat(cloudflare): automated api-token rotation (Class-B) — SUSPENDED/UNTESTED' (#305) from feat/cloudflare-token-rotation into master

claude-bot referenced this pull request

2026-07-19 08:31:16 +00:00

fix(cloudflare-rotation): enable — tested; pinned to the dedicated cert-manager token #309

Sign in to join this conversation.