From 4f3be7ef79d80848b72c2011ae96868e7826d664 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sun, 16 Aug 2026 22:41:02 -0500 Subject: [PATCH] docs(sops): exact Cloudflare token creation steps (Zone scope, not Account) The terse 'Zone->DNS->Edit + Zone->Read' sent the operator to the Account permission scope. Spell out switching the scope dropdown to Zone + the exact two Zone-scoped rows + Specific-zone resource. Co-Authored-By: Claude Opus 4.8 (1M context) --- bootstrap/sops/CREDENTIALS.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/bootstrap/sops/CREDENTIALS.md b/bootstrap/sops/CREDENTIALS.md index eec4aa9..a13ece8 100644 --- a/bootstrap/sops/CREDENTIALS.md +++ b/bootstrap/sops/CREDENTIALS.md @@ -58,8 +58,20 @@ kubectl kustomize platform/ >/dev/null && git add -A && git commit | `oauth2-proxy-credentials` | `oauth2-proxy` | `client-id`, `client-secret`, `cookie-secret` ⚠️verify chart keys | oauth2-proxy forward-auth | 6 | `oauth2-proxy-credentials.yaml.example` | | `pia-credentials` | *(Phase-3 VPN ns, TBA)* | `username`, `password` | Gluetun VPN egress (protocol ≠ TCP) — **not wired yet** | 3 | `pia-credentials.yaml.example` | -**Cloudflare token scope:** one API token with **Zone → DNS → Edit** + **Zone → Read** on the -`keithjackson.dev` zone serves both cert-manager (DNS-01) and ExternalDNS. Same value in both namespace copies. +**Cloudflare token — exact creation steps** (My Profile → API Tokens → Create Token → **Custom token**): +one token serves both cert-manager (DNS-01 `_acme-challenge` TXT) and ExternalDNS (A/CNAME), same value +in both namespace copies. In each Permissions row, the left dropdown defaults to **Account** — switch it +to **Zone** (Account-scope groups like "Account DNS Settings"/"DNS Firewall"/"Registrar Domains" are the +wrong scope and not needed). Set: + +| Scope | Group | Access | +|---|---|---| +| Zone | DNS | Edit | +| Zone | Zone | Read | + +- **Zone Resources:** Include → Specific zone → `keithjackson.dev`. +- Leave Client-IP/TTL filtering blank → Continue to summary → Create Token → copy the value into the + `api-token` field of **both** `cloudflare-api-token` secret copies. ---