ghp: deploy service-token fork image + wire GHP_AUTH_SERVICE_TOKENS #372

2026-08-15T18:03:31+10:00

unkin-agent commented

2026-08-15 18:03:31 +10:00

Why: P4 step 3. Now that the CA-baked buildx plugin lets docker-internal/ghp push succeed, deploy the in-house ghp fork (v0.20.0-unkin4) which adds static admin service tokens — the mechanism the forthcoming Vault ghp secrets engine uses to authenticate as admin and mint scoped tokens.

How:

image: ghcr.io/goodtune/ghp:0.20.0 -> artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4 (a LOCAL registry image, not the ghcr pull-through that previously ImagePullBackOff-ed).
add env GHP_AUTH_SERVICE_TOKENS from Secret ghp-app key service_token, optional: true — ghp runs unchanged until the token is seeded.

Requires (Ben, runbook): seed service_token into kv/kubernetes/namespace/ghp/default/app (same pattern as encryption_key/github-app). The default role's templated policy already grants read; no terraform-vault change. The existing ghp-app reloader annotation rolls the Deployment once the key appears. This same token value later becomes the Vault ghp engine admin_token (P4 steps 5-6).

Why: P4 step 3. Now that the CA-baked buildx plugin lets `docker-internal/ghp` push succeed, deploy the in-house ghp fork (`v0.20.0-unkin4`) which adds static admin service tokens — the mechanism the forthcoming Vault ghp secrets engine uses to authenticate as admin and mint scoped tokens. How: - image: ghcr.io/goodtune/ghp:0.20.0 -> artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4 (a LOCAL registry image, not the ghcr pull-through that previously ImagePullBackOff-ed). - add env GHP_AUTH_SERVICE_TOKENS from Secret ghp-app key `service_token`, `optional: true` — ghp runs unchanged until the token is seeded. Requires (Ben, runbook): seed `service_token` into kv/kubernetes/namespace/ghp/default/app (same pattern as encryption_key/github-app). The default role's templated policy already grants read; no terraform-vault change. The existing ghp-app reloader annotation rolls the Deployment once the key appears. This same token value later becomes the Vault ghp engine admin_token (P4 steps 5-6).

unkin-agent added 1 commit 2026-08-15 18:03:32 +10:00

ghp: deploy the service-token fork image + wire GHP_AUTH_SERVICE_TOKENS

ci/woodpecker/pr/vector-test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

17a1eb4f2d

Switch ghp from ghcr.io/goodtune/ghp:0.20.0 to the in-house fork image
artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4 (built now
that the CA-baked buildx plugin lets the push to the internal-CA registry
succeed). The fork is behavior-identical to upstream except it accepts static
admin service tokens (GHP_AUTH_SERVICE_TOKENS), used by the forthcoming Vault ghp
secrets engine to authenticate as admin and mint scoped tokens.

The env is sourced from the ghp-app Secret key service_token with optional: true,
so ghp keeps running until Ben seeds service_token into
kv/kubernetes/namespace/ghp/default/app; the existing ghp-app reloader annotation
then rolls the Deployment to activate it.

benvin merged commit a4808f5528 into main

2026-08-15 18:18:22 +10:00

benvin deleted branch benvin/ghp-fork-service-token

2026-08-15 18:18:23 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#372