unkin-agent
61bb464e32
Interactive agents are classifier-blocked from plumbing credentials through a shell, so seeding an Authentik outpost token into Vault KV needs to happen inside one binary invocation that never exposes the secret. - Add cmd/agentvault, a fourth CLI sharing the agentpr Vault AppRole login (role_id only, VAULT_ADDR/AGENT_APPROLE_ROLE_ID defaults unchanged). - Add `agentvault seed-outpost`: read the Authentik API token from kv/service/authentik/agent-api-token (field `token`, falling back to `api_token`), exact-match the outpost by name via the instances search, fetch its key from /api/v3/core/tokens/<identifier>/view_key/ and write it to --dest-path under --dest-key. - Print only the outpost name, token identifier, dest path and new KV version; keep secret material out of results, errors and logs. - Distinguish the failure stages (login, KV read denied, outpost missing, view_key, KV write denied) with ErrVaultDenied/ErrVaultNotFound/ ErrOutpostNotFound sentinels and actionable messages. - Add internal/agent vaultkv.go (AppRole-authenticated KV-v2 client) and authentik.go (outpost search + view_key) for reuse by future flows. - Cover the happy path, idempotent re-run, field fallback and every failure mode with httptest servers, including a leak check on error strings. - Wire agentvault into the Makefile, build-rpm.sh, nfpm contents, release cross-builds/assets, README and AGENTS.md.
101 lines
2.5 KiB
YAML
101 lines
2.5 KiB
YAML
---
|
|
# nfpm config for building the agent-tools RPM.
|
|
# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
|
|
|
|
name: ${PACKAGE_NAME}
|
|
version: ${PACKAGE_VERSION}
|
|
release: ${PACKAGE_RELEASE}
|
|
arch: ${PACKAGE_ARCH}
|
|
platform: ${PACKAGE_PLATFORM}
|
|
section: default
|
|
priority: extra
|
|
description: "${PACKAGE_DESCRIPTION}"
|
|
|
|
maintainer: ${PACKAGE_MAINTAINER}
|
|
homepage: ${PACKAGE_HOMEPAGE}
|
|
license: ${PACKAGE_LICENSE}
|
|
|
|
disable_globbing: false
|
|
|
|
replaces:
|
|
- agent-tools
|
|
provides:
|
|
- agent-tools
|
|
|
|
contents:
|
|
# The CLI binaries.
|
|
- src: dist/agentpr
|
|
dst: /usr/bin/agentpr
|
|
file_info:
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
- src: dist/watchpr
|
|
dst: /usr/bin/watchpr
|
|
file_info:
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
- src: dist/agentws
|
|
dst: /usr/bin/agentws
|
|
file_info:
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
- src: dist/agentvault
|
|
dst: /usr/bin/agentvault
|
|
file_info:
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
|
|
# Shell completions (generated by scripts/build-rpm.sh before packaging).
|
|
- src: dist/completions/agentpr.bash
|
|
dst: /usr/share/bash-completion/completions/agentpr
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/_agentpr
|
|
dst: /usr/share/zsh/site-functions/_agentpr
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/agentpr.fish
|
|
dst: /usr/share/fish/vendor_completions.d/agentpr.fish
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/watchpr.bash
|
|
dst: /usr/share/bash-completion/completions/watchpr
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/_watchpr
|
|
dst: /usr/share/zsh/site-functions/_watchpr
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/watchpr.fish
|
|
dst: /usr/share/fish/vendor_completions.d/watchpr.fish
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/agentws.bash
|
|
dst: /usr/share/bash-completion/completions/agentws
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/_agentws
|
|
dst: /usr/share/zsh/site-functions/_agentws
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/agentws.fish
|
|
dst: /usr/share/fish/vendor_completions.d/agentws.fish
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/agentvault.bash
|
|
dst: /usr/share/bash-completion/completions/agentvault
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/_agentvault
|
|
dst: /usr/share/zsh/site-functions/_agentvault
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/agentvault.fish
|
|
dst: /usr/share/fish/vendor_completions.d/agentvault.fish
|
|
file_info:
|
|
mode: 0644
|