unkin-agent
61bb464e32
Interactive agents are classifier-blocked from plumbing credentials through a shell, so seeding an Authentik outpost token into Vault KV needs to happen inside one binary invocation that never exposes the secret. - Add cmd/agentvault, a fourth CLI sharing the agentpr Vault AppRole login (role_id only, VAULT_ADDR/AGENT_APPROLE_ROLE_ID defaults unchanged). - Add `agentvault seed-outpost`: read the Authentik API token from kv/service/authentik/agent-api-token (field `token`, falling back to `api_token`), exact-match the outpost by name via the instances search, fetch its key from /api/v3/core/tokens/<identifier>/view_key/ and write it to --dest-path under --dest-key. - Print only the outpost name, token identifier, dest path and new KV version; keep secret material out of results, errors and logs. - Distinguish the failure stages (login, KV read denied, outpost missing, view_key, KV write denied) with ErrVaultDenied/ErrVaultNotFound/ ErrOutpostNotFound sentinels and actionable messages. - Add internal/agent vaultkv.go (AppRole-authenticated KV-v2 client) and authentik.go (outpost search + view_key) for reuse by future flows. - Cover the happy path, idempotent re-run, field fallback and every failure mode with httptest servers, including a leak check on error strings. - Wire agentvault into the Makefile, build-rpm.sh, nfpm contents, release cross-builds/assets, README and AGENTS.md.
99 lines
3.1 KiB
Go
99 lines
3.1 KiB
Go
// Package agent holds the plumbing shared by the agent-tools CLIs (agentpr,
|
|
// watchpr, agentws and agentvault): the Vault AppRole login and its KV-v2
|
|
// client, talking to the Gitea and Authentik APIs, parsing PR references, and
|
|
// deciding when a watched PR changed meaningfully. Every tool authenticates to
|
|
// Vault the same way, so that logic lives here once.
|
|
package agent
|
|
|
|
import (
|
|
"os"
|
|
"sync"
|
|
)
|
|
|
|
const (
|
|
// DefaultVaultAddr is the OpenBao/Vault address used when VAULT_ADDR is unset.
|
|
DefaultVaultAddr = "https://vault.service.consul:8200"
|
|
// DefaultRoleID is the agent AppRole role_id used when AGENT_APPROLE_ROLE_ID
|
|
// is unset. Login uses role_id only (no secret_id).
|
|
DefaultRoleID = "ababbcd3-9c77-5c6a-be2d-287fce9214a6"
|
|
// GiteaCredsPath is the Vault path that mints a scoped Gitea token.
|
|
GiteaCredsPath = "gitea/creds/unkin-agent"
|
|
// DefaultGiteaURL is the Gitea base URL used when GITEA_URL is unset.
|
|
DefaultGiteaURL = "https://git.unkin.net"
|
|
// DefaultAgentLogin is the Gitea login of the agent whose own comments are
|
|
// ignored by watchpr. Overridable via AGENT_LOGIN.
|
|
DefaultAgentLogin = "unkin-agent"
|
|
// DefaultAuthentikURL is the Authentik base URL used when AUTHENTIK_URL is
|
|
// unset. identity.unkin.net has no DNS record; the k8s name is the real one.
|
|
DefaultAuthentikURL = "https://identity.k8s.syd1.au.unkin.net"
|
|
)
|
|
|
|
// VaultAddr returns the configured Vault address (env VAULT_ADDR or the default).
|
|
func VaultAddr() string {
|
|
if v := os.Getenv("VAULT_ADDR"); v != "" {
|
|
return v
|
|
}
|
|
return DefaultVaultAddr
|
|
}
|
|
|
|
// RoleID returns the configured AppRole role_id (env AGENT_APPROLE_ROLE_ID or
|
|
// the default).
|
|
func RoleID() string {
|
|
if v := os.Getenv("AGENT_APPROLE_ROLE_ID"); v != "" {
|
|
return v
|
|
}
|
|
return DefaultRoleID
|
|
}
|
|
|
|
// GiteaURL returns the configured Gitea base URL (env GITEA_URL or the default).
|
|
func GiteaURL() string {
|
|
if v := os.Getenv("GITEA_URL"); v != "" {
|
|
return v
|
|
}
|
|
return DefaultGiteaURL
|
|
}
|
|
|
|
// AgentLogin returns the login whose comments watchpr ignores (env AGENT_LOGIN
|
|
// or the default).
|
|
func AgentLogin() string {
|
|
if v := os.Getenv("AGENT_LOGIN"); v != "" {
|
|
return v
|
|
}
|
|
return DefaultAgentLogin
|
|
}
|
|
|
|
// AuthentikURL returns the configured Authentik base URL (env AUTHENTIK_URL or
|
|
// the default).
|
|
func AuthentikURL() string {
|
|
if v := os.Getenv("AUTHENTIK_URL"); v != "" {
|
|
return v
|
|
}
|
|
return DefaultAuthentikURL
|
|
}
|
|
|
|
var (
|
|
tokenOnce sync.Once
|
|
tokenValue string
|
|
tokenErr error
|
|
)
|
|
|
|
// GiteaToken returns a Gitea token, minting it via Vault AppRole on first call
|
|
// and caching it in-process for the lifetime of the command.
|
|
func GiteaToken() (string, error) {
|
|
tokenOnce.Do(func() {
|
|
tokenValue, tokenErr = fetchGiteaToken(VaultAddr(), RoleID())
|
|
})
|
|
return tokenValue, tokenErr
|
|
}
|
|
|
|
// fetchGiteaToken performs the AppRole login and reads the Gitea creds. It is
|
|
// separated from GiteaToken so tests can exercise it directly against an
|
|
// httptest server without touching the process-wide cache.
|
|
func fetchGiteaToken(vaultAddr, roleID string) (string, error) {
|
|
clientToken, err := approleLogin(vaultAddr, roleID)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return readGiteaCreds(vaultAddr, clientToken)
|
|
}
|