#306 landed suspended pending a privsep check and a bootstrap credential.
Both are now done and the job is verified, so enable the schedule.
privsep caveat RESOLVED: pve-exporter@pve!monitoring is privsep=0 and its
ACL (/ -> PVEAuditor) is on the USER, not the token. DELETE+re-create with
privsep=0 therefore loses no permission and needs no ACL re-grant.
Bootstrap credential is a dedicated least-privilege PVE identity rather than
root@pam. PVE rejects per-user ACL paths and authorises the token endpoints
via a userid-group check, so the tightest available scope is a group whose
only member is the target user:
role SecretRotator (User.Modify)
user secret-rotator@pve
ACL /access/groups/secret-rotated -> SecretRotator
Verified it can mint/delete pve-exporter tokens, sees no VMs or storage,
and gets 403 minting a root@pam token.
api-url is the in-cluster Service (all three nodes back it). The external
name pve.renner.uno cannot be used from a pod: pods cannot hairpin to their
own cluster's ingress LB, which hangs the job. A node IP or single node
FQDN would be a needless SPOF.
Tested: two full rotations; OpenBao patched, ESO synced, Reloader restarted
the exporter, pve_up returned 1.0 for all three nodes both times.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
claude-botandClaude Opus 4.8