From 72c4105c0fb4da75b53b0f9a3a8f6e64cae21286 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 25 Oct 2026 23:08:58 +1100 Subject: [PATCH] ci: authenticate artifactapi rpm upload with a vault token (#23) artifactapi is about to enforce auth on file uploads (`ARTIFACTAPI_AUTH_UPLOADS`), and the release upload currently PUTs anonymously. - mint an `artifactapi-writer` OIDC token via Vault k8s auth (role `woodpecker_artifactapi_writer`) using the step SA token - fail the step if minting fails (`set -o pipefail`) - send the token as `Authorization: Bearer` via a header file, never in argv or logs Reviewed-on: https://git.unkin.net/unkin/node-lookup/pulls/23 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- .woodpecker/release.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml index 018953d..20ea6a7 100644 --- a/.woodpecker/release.yaml +++ b/.woodpecker/release.yaml @@ -98,6 +98,13 @@ steps: - | HOST="https://artifactapi.k8s.syd1.au.unkin.net" REPO="rpm-internal" + set -o pipefail + VAULT="https://vault.service.consul:8200" + AUTH=$$(mktemp) + VT=$$(jq -n --rawfile jwt /var/run/secrets/kubernetes.io/serviceaccount/token '{role:"woodpecker_artifactapi_writer",jwt:$$jwt}' \ + | curl -sf -d @- "$$VAULT/v1/auth/k8s/au/syd1/login" | jq -er .auth.client_token) || exit 1 + printf 'X-Vault-Token: %s\n' "$$VT" | curl -sf -H @- "$$VAULT/v1/identity/oidc/token/artifactapi-writer" \ + | jq -er '"Authorization: Bearer " + .data.token' > "$$AUTH" || exit 1 for rpm in dist/*.rpm; do FILE=$$(basename "$$rpm") # artifactapi has no HEAD route (returns 405); probe with GET against @@ -110,7 +117,7 @@ steps: echo "Uploading $$FILE to $$REPO (existence probe returned $$code)" curl -f -X PUT \ "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \ - -H "Content-Type: application/x-rpm" \ + -H "Content-Type: application/x-rpm" -H @"$$AUTH" \ --data-binary @"$$rpm" done depends_on: [package]