refactor(rotation): port pve-exporter to proxmox-token mode #341

2026-07-22T05:06:50Z

claude-bot commented

2026-07-22 05:06:50 +00:00

Step 2 of 2 for the last rotator. Ports pve-exporter from inline python to the binary's proxmox-token mode (merged in #339). Net -48 lines — and with this, inline Python is fully retired: all 12 rotators run the one binary, and the openbao image is left only to the raft-snapshot job.

Tested live end-to-end — the destructive test

Unlike every prior port (throwaway-token or roll-in-place), this one rotates the real monitoring token, so it briefly breaks pve-exporter metrics. Ran it and verified full recovery:

job Complete: DELETE+recreated pve-exporter@pve!monitoring (privsep=0)
OpenBao pve.yml: 529d7f66 -> f7ca2141, document well-formed
no-verify TLS path worked vs the real in-cluster Service (valid LE cert, hostname mismatch)
  -> this was the only piece that could not be unit/throwaway tested
PVE token recreated privsep=0 (inherits the user's PVEAuditor ACL)
ESO synced -> Reloader restarted pve-exporter -> RECOVERED:
  OpenBao and k8s token_values MATCH
  new token authenticates: /version 8.4.18
  pve_up=1.0 for cluster + jupiter + neptune + saturn

The brief gap between delete and Reloader-restart is inherent to Proxmox having no atomic roll (documented in the header); off-hours quarterly makes it acceptable — the same tradeoff the python had.

Flux strips the old python command on apply (verified on the earlier ports); port via Flux, not kubectl apply. Image digest sha256:97c22bcf….

After this merges

12/12 rotators on the secret-rotator binary
  random          (5): paperless, authentik, woodpecker, crowdsec, shelly-manager
  ha-token        (3): prometheus, config-sync, shelly-manager-llat
  cloudflare-roll (2): cloudflare, external-dns
  netbird-key     (1): netbird-ingress
  proxmox-token   (1): pve-exporter
inline Python: retired

🤖 Generated with Claude Code

Step 2 of 2 for the **last** rotator. Ports pve-exporter from inline python to the binary's `proxmox-token` mode (merged in #339). **Net -48 lines** — and with this, **inline Python is fully retired**: all 12 rotators run the one binary, and the openbao image is left only to the raft-snapshot job. ## Tested live end-to-end — the destructive test Unlike every prior port (throwaway-token or roll-in-place), this one rotates the **real** `monitoring` token, so it briefly breaks pve-exporter metrics. Ran it and verified full recovery: ``` job Complete: DELETE+recreated pve-exporter@pve!monitoring (privsep=0) OpenBao pve.yml: 529d7f66 -> f7ca2141, document well-formed no-verify TLS path worked vs the real in-cluster Service (valid LE cert, hostname mismatch) -> this was the only piece that could not be unit/throwaway tested PVE token recreated privsep=0 (inherits the user's PVEAuditor ACL) ESO synced -> Reloader restarted pve-exporter -> RECOVERED: OpenBao and k8s token_values MATCH new token authenticates: /version 8.4.18 pve_up=1.0 for cluster + jupiter + neptune + saturn ``` The brief gap between delete and Reloader-restart is inherent to Proxmox having no atomic roll (documented in the header); off-hours quarterly makes it acceptable — the same tradeoff the python had. Flux strips the old python `command` on apply (verified on the earlier ports); port via Flux, not kubectl apply. Image digest `sha256:97c22bcf…`. ## After this merges ``` 12/12 rotators on the secret-rotator binary random (5): paperless, authentik, woodpecker, crowdsec, shelly-manager ha-token (3): prometheus, config-sync, shelly-manager-llat cloudflare-roll (2): cloudflare, external-dns netbird-key (1): netbird-ingress proxmox-token (1): pve-exporter inline Python: retired ``` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-07-22 05:06:50 +00:00

refactor(rotation): port pve-exporter to proxmox-token mode 810b68b11f

The LAST rotator. Replaces the inline python with the secret-rotator binary's
proxmox-token mode. Net -48 lines; inline Python is now fully retired — every
rotator runs the one binary, and the openbao image is left only to the
raft-snapshot job.

Tested live end-to-end via the real binary image — the destructive test that
could not be zero-blast-radius, since it rotates the real monitoring token:
  - job Complete: DELETE+recreated pve-exporter@pve!monitoring (privsep=0),
    OpenBao pve.yml rotated 529d7f66 -> f7ca2141, document well-formed
  - the no-verify TLS path worked against the real in-cluster Service (valid LE
    cert, hostname mismatch) — the piece that could only be compile-proven
  - PVE token recreated privsep=0 (inherits the user's PVEAuditor ACL)
  - ESO synced, Reloader restarted pve-exporter, and it recovered: OpenBao and
    k8s token_values match, the new token authenticates (/version 8.4.18), and
    pve_up=1.0 for the cluster and all three nodes

The brief metrics gap between delete and Reloader-restart is inherent to
Proxmox having no atomic roll (documented in the header); off-hours quarterly
makes it acceptable.

Flux strips the old python `command` on apply (verified on the earlier ports);
port via Flux, not kubectl apply.

Image digest sha256:97c22bcf…

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 25281137cd into master

2026-07-22 05:09:39 +00:00

k.renner referenced this issue from a commit

2026-07-22 05:09:41 +00:00

Merge pull request 'refactor(rotation): port pve-exporter to proxmox-token mode' (#341) from feat/port-proxmox-rotator into master

claude-bot referenced this pull request

2026-07-22 05:22:03 +00:00

fix(flux): point GitRepository at the renamed k.renner/homelab URL #342

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#341