Switch unpoller to API key auth from 1Password item 'unpoller'

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

argocd/manifests/unpoller/deployment.yaml

@@ -22,16 +22,11 @@ spec:
             - containerPort: 9130
               name: metrics
           env:
-            - name: UP_UNIFI_DEFAULT_USER
+            - name: UP_UNIFI_DEFAULT_API_KEY
               valueFrom:
                 secretKeyRef:
                   name: unpoller-unifi
-                  key: username
-            - name: UP_UNIFI_DEFAULT_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: unpoller-unifi
-                  key: password
+                  key: api-key
           volumeMounts:
             - name: config
               mountPath: /etc/unpoller

argocd/manifests/unpoller/external-secret.yaml

@@ -12,11 +12,7 @@ spec:
     name: unpoller-unifi
     creationPolicy: Owner
   data:
-    - secretKey: username
+    - secretKey: api-key
       remoteRef:
-        key: unifi
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: unifi
-        property: password
+        key: unpoller
+        property: credential

argocd/manifests/unpoller/up.conf

@@ -9,8 +9,7 @@
   dynamic = false
 
 [unifi.defaults]
-  # Credentials come from environment variables:
-  # UP_UNIFI_DEFAULT_USER and UP_UNIFI_DEFAULT_PASS
+  # API key comes from environment variable: UP_UNIFI_DEFAULT_API_KEY
   url = "https://192.168.1.1"
   verify_ssl = false
   save_sites = true

docs/reference/infrastructure/unifi.md

@@ -71,11 +71,11 @@ Attempted Feb 2026 with the `ubiquiti-community/unifi` Terraform provider via Pu
 
 ## Monitoring
 
-UniFi metrics are exported to Prometheus via [UnPoller](https://github.com/unpoller/unpoller), running as a k8s deployment in the `monitoring` namespace on indri. UnPoller polls the UX7 controller API using a read-only local account (`blumeops`) and exposes metrics on port 9130.
+UniFi metrics are exported to Prometheus via [UnPoller](https://github.com/unpoller/unpoller), running as a k8s deployment in the `monitoring` namespace on indri. UnPoller polls the UX7 controller API using an API key and exposes metrics on port 9130.
 
 - **Prometheus job:** `unpoller`
 - **Metrics prefix:** `unifi_`
-- **Credentials:** 1Password item `unifi` (vault `blumeops`)
+- **Credentials:** 1Password item `unpoller` (vault `blumeops`, API key)
 
 ## Related