From a4efca8ee57b82102307e90e9dbea5c40461b52d Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 26 Oct 2026 20:33:29 +1100 Subject: [PATCH] Require tokens for artifactapi uploads (#574) Woodpecker uploaders now mint Vault OIDC tokens, so anonymous local-repo writes can be rejected. - set `ARTIFACTAPI_AUTH_UPLOADS: "true"` in the artifactapi `api-env` configmap Merge after unkin/vault-plugin-secrets-litellm#6. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/574 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/artifactapi/configmap.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/apps/base/artifactapi/configmap.yaml b/apps/base/artifactapi/configmap.yaml index f1ad42e..dce875d 100644 --- a/apps/base/artifactapi/configmap.yaml +++ b/apps/base/artifactapi/configmap.yaml @@ -5,6 +5,7 @@ metadata: name: api-env namespace: artifactapi data: + ARTIFACTAPI_AUTH_UPLOADS: "true" ARTIFACTAPI_OIDC_AUDIENCE: artifactapi ARTIFACTAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc DBHOST: postgres-pooler