Log in to artifactapi with a Vault identity OIDC token #2

2026-10-25T13:31:04+11:00

unkin-agent commented

2026-10-25 13:31:04 +11:00

artifactapi is moving to require a Vault identity OIDC token for docker push, and ~33 repos push with this plugin without credentials. The plugin now logs itself in so no repo needs changing.

wrap the upstream entrypoint with artifactapi-login.sh: on non-dry-run pushes to artifactapi with no artifactapi creds configured, log in to Vault with the pod SA token and append the OIDC token to PLUGIN_LOGINS
pass tokens via env/stdin, never argv
allow vault_addr, vault_role, vault_oidc_role overrides
warn and push anonymously if the SA token or Vault is unavailable
add curl/jq and a make test harness covering the entrypoint handoff

Requires the terraform-vault artifactapi-writer role applied first.

artifactapi is moving to require a Vault identity OIDC token for docker push, and ~33 repos push with this plugin without credentials. The plugin now logs itself in so no repo needs changing. - wrap the upstream entrypoint with `artifactapi-login.sh`: on non-dry-run pushes to artifactapi with no artifactapi creds configured, log in to Vault with the pod SA token and append the OIDC token to `PLUGIN_LOGINS` - pass tokens via env/stdin, never argv - allow `vault_addr`, `vault_role`, `vault_oidc_role` overrides - warn and push anonymously if the SA token or Vault is unavailable - add `curl`/`jq` and a `make test` harness covering the entrypoint handoff Requires the terraform-vault artifactapi-writer role applied first.

unkin-agent added 1 commit 2026-10-25 13:31:05 +11:00

Log in to artifactapi with a Vault identity OIDC token

ci/woodpecker/pr/build Pipeline was successful

Details

8ab9169c53

unkin-agent commented

2026-10-25 13:32:57 +11:00

artifactapi-login.sh:11 — nit: PLUGIN_USERNAME/PLUGIN_PASSWORD skip the login even when registry: is another host (e.g. git.unkin.net) and repo: also targets artifactapi; upstream applies those creds only to registry:, so the artifactapi push goes anonymous → only skip when PLUGIN_REGISTRY contains $ARTIFACTAPI_HOST.
artifactapi-login.sh:19,26 — nit: SA JWT and OIDC token are passed as jq --arg argv (visible in /proc/*/cmdline) → pass via --rawfile/stdin or env. in jq.
test/login_test.sh:1 — nit: nothing covers the exec handoff (dockerd-entrypoint.sh plugin-docker-buildx "$@") or the Dockerfile ENTRYPOINT, the parts that break every push if wrong → add one test that runs the entrypoint with a stub dockerd-entrypoint.sh and asserts args and PLUGIN_LOGINS reach it.

- artifactapi-login.sh:11 — nit: `PLUGIN_USERNAME`/`PLUGIN_PASSWORD` skip the login even when `registry:` is another host (e.g. git.unkin.net) and `repo:` also targets artifactapi; upstream applies those creds only to `registry:`, so the artifactapi push goes anonymous → only skip when `PLUGIN_REGISTRY` contains `$ARTIFACTAPI_HOST`. - artifactapi-login.sh:19,26 — nit: SA JWT and OIDC token are passed as `jq --arg` argv (visible in `/proc/*/cmdline`) → pass via `--rawfile`/stdin or `env.` in jq. - test/login_test.sh:1 — nit: nothing covers the `exec` handoff (`dockerd-entrypoint.sh plugin-docker-buildx "$@"`) or the Dockerfile ENTRYPOINT, the parts that break every push if wrong → add one test that runs the entrypoint with a stub `dockerd-entrypoint.sh` and asserts args and `PLUGIN_LOGINS` reach it.

unkin-agent added 1 commit 2026-10-25 13:35:09 +11:00

Keep secrets out of argv and scope the explicit-creds skip to artifactapi

ci/woodpecker/pr/build Pipeline was successful

Details

2211a555f9

unkin-agent commented

2026-10-25 13:38:20 +11:00

nit: Dockerfile:10 — exec dockerd-entrypoint.sh plugin-docker-buildx hardcodes upstream ENTRYPOINT while FROM ...:latest is unpinned, and the handoff test uses a stub, so upstream drift passes make test → assert upstream .Config.Entrypoint in the test, or pin the tag.
nit: test/login_test.sh:31 — no case for invalid PLUGIN_LOGINS (artifactapi-login.sh:29 branch), PLUGIN_VAULT_ADDR/PLUGIN_VAULT_OIDC_ROLE overrides, or that the exported PLUGIN_LOGINS reaches the exec'd process → add them; extend the Makefile handoff test with PLUGIN_REGISTRY set and a stub that echoes $PLUGIN_LOGINS.
nit: artifactapi-login.sh:10 — plugin also reads DOCKER_REGISTRY/DOCKER_USERNAME/DOCKER_PASSWORD aliases, so creds set that way are not seen as explicit → also check those or drop the claim of explicit-creds detection.

- nit: Dockerfile:10 — `exec dockerd-entrypoint.sh plugin-docker-buildx` hardcodes upstream ENTRYPOINT while `FROM ...:latest` is unpinned, and the handoff test uses a stub, so upstream drift passes `make test` → assert upstream `.Config.Entrypoint` in the test, or pin the tag. - nit: test/login_test.sh:31 — no case for invalid `PLUGIN_LOGINS` (artifactapi-login.sh:29 branch), `PLUGIN_VAULT_ADDR`/`PLUGIN_VAULT_OIDC_ROLE` overrides, or that the exported `PLUGIN_LOGINS` reaches the exec'd process → add them; extend the Makefile handoff test with `PLUGIN_REGISTRY` set and a stub that echoes `$PLUGIN_LOGINS`. - nit: artifactapi-login.sh:10 — plugin also reads `DOCKER_REGISTRY`/`DOCKER_USERNAME`/`DOCKER_PASSWORD` aliases, so creds set that way are not seen as explicit → also check those or drop the claim of explicit-creds detection.

benvin merged commit b4f811271b into main

2026-10-25 19:00:15 +11:00

benvin deleted branch benvin/artifactapi-vault-login

2026-10-25 19:00:15 +11:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/plugin-docker-buildx#2