Add agentvault with a seed-outpost subcommand #7

2026-08-29T21:05:18+10:00

unkin-agent commented

2026-08-29 21:05:18 +10:00

Interactive agents are classifier-blocked from plumbing credentials through a shell, so seeding an Authentik outpost token into Vault KV has to happen inside a single binary invocation that never exposes the secret — the same reason agentpr mints its Gitea token internally.

Adds agentvault, a fourth CLI sharing the existing Vault AppRole login (role_id only; VAULT_ADDR / AGENT_APPROLE_ROLE_ID defaults unchanged).
Adds agentvault seed-outpost: reads the Authentik API token from kv/service/authentik/agent-api-token (field token, falling back to api_token), exact-matches the outpost via /api/v3/outposts/instances/?search=, fetches its key from /api/v3/core/tokens/<identifier>/view_key/, and writes it to --dest-path under --dest-key (default token).
Prints only the outpost name, token identifier, dest path and new KV version; secret material stays out of stdout, errors and logs. Re-running is idempotent — it writes a new KV version.
Distinguishes each failure stage (AppRole login, KV read denied, secret missing, outpost not found, view_key, KV write denied) with actionable messages built on ErrVaultDenied / ErrVaultNotFound / ErrOutpostNotFound.
Adds internal/agent/vaultkv.go (AppRole-authenticated KV-v2 client) and internal/agent/authentik.go so future deterministic flows land as sibling subcommands.
Tests cover the happy path, idempotent re-run, api_token fallback, custom dest key and every failure mode against httptest servers, plus a check that no error string leaks a secret.
Wires agentvault into the Makefile, build-rpm.sh, nfpm contents and completions, the release cross-builds/assets, README and AGENTS.md.

Usage:

agentvault seed-outpost --outpost <name> --dest-path kubernetes/<ns>/authentik/default/outpost-token

Interactive agents are classifier-blocked from plumbing credentials through a shell, so seeding an Authentik outpost token into Vault KV has to happen inside a single binary invocation that never exposes the secret — the same reason `agentpr` mints its Gitea token internally. - Adds `agentvault`, a fourth CLI sharing the existing Vault AppRole login (role_id only; `VAULT_ADDR` / `AGENT_APPROLE_ROLE_ID` defaults unchanged). - Adds `agentvault seed-outpost`: reads the Authentik API token from `kv/service/authentik/agent-api-token` (field `token`, falling back to `api_token`), exact-matches the outpost via `/api/v3/outposts/instances/?search=`, fetches its key from `/api/v3/core/tokens/<identifier>/view_key/`, and writes it to `--dest-path` under `--dest-key` (default `token`). - Prints only the outpost name, token identifier, dest path and new KV version; secret material stays out of stdout, errors and logs. Re-running is idempotent — it writes a new KV version. - Distinguishes each failure stage (AppRole login, KV read denied, secret missing, outpost not found, `view_key`, KV write denied) with actionable messages built on `ErrVaultDenied` / `ErrVaultNotFound` / `ErrOutpostNotFound`. - Adds `internal/agent/vaultkv.go` (AppRole-authenticated KV-v2 client) and `internal/agent/authentik.go` so future deterministic flows land as sibling subcommands. - Tests cover the happy path, idempotent re-run, `api_token` fallback, custom dest key and every failure mode against httptest servers, plus a check that no error string leaks a secret. - Wires `agentvault` into the Makefile, `build-rpm.sh`, nfpm contents and completions, the release cross-builds/assets, README and AGENTS.md. Usage: ``` agentvault seed-outpost --outpost <name> --dest-path kubernetes/<ns>/authentik/default/outpost-token ```

unkin-agent added 1 commit 2026-08-29 21:05:18 +10:00

Add agentvault with a seed-outpost subcommand

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

61bb464e32

Interactive agents are classifier-blocked from plumbing credentials through
a shell, so seeding an Authentik outpost token into Vault KV needs to happen
inside one binary invocation that never exposes the secret.

- Add cmd/agentvault, a fourth CLI sharing the agentpr Vault AppRole login
  (role_id only, VAULT_ADDR/AGENT_APPROLE_ROLE_ID defaults unchanged).
- Add `agentvault seed-outpost`: read the Authentik API token from
  kv/service/authentik/agent-api-token (field `token`, falling back to
  `api_token`), exact-match the outpost by name via the instances search,
  fetch its key from /api/v3/core/tokens/<identifier>/view_key/ and write it
  to --dest-path under --dest-key.
- Print only the outpost name, token identifier, dest path and new KV
  version; keep secret material out of results, errors and logs.
- Distinguish the failure stages (login, KV read denied, outpost missing,
  view_key, KV write denied) with ErrVaultDenied/ErrVaultNotFound/
  ErrOutpostNotFound sentinels and actionable messages.
- Add internal/agent vaultkv.go (AppRole-authenticated KV-v2 client) and
  authentik.go (outpost search + view_key) for reuse by future flows.
- Cover the happy path, idempotent re-run, field fallback and every failure
  mode with httptest servers, including a leak check on error strings.
- Wire agentvault into the Makefile, build-rpm.sh, nfpm contents, release
  cross-builds/assets, README and AGENTS.md.

benvin merged commit 68805a8cde into main

2026-08-29 21:58:02 +10:00

benvin deleted branch benvin/agentvault-seed-outpost

2026-08-29 21:58:02 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/agent-tools#7