unkin/terraform-provider-vault-secrets-netbox
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: authenticate artifactapi provider upload with a vault token #3

Merged
benvin merged 1 commits from benvin/artifactapi-upload-token into main 2026-10-25 22:56:50 +11:00
Conversation 1 Commits 1 Files Changed 1
+8 -1
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.woodpecker/release.yml
+8 -1
View File
@@ -35,9 +35,16 @@ steps:
- |
VERSION=$$(echo ${CI_COMMIT_TAG} | sed 's/^v//')
FILE="terraform-provider-vault-secrets-netbox_$${VERSION}_linux_amd64.zip"
set -o pipefail
VAULT="https://vault.service.consul:8200"
AUTH=$$(mktemp)
VT=$$(jq -n --rawfile jwt /var/run/secrets/kubernetes.io/serviceaccount/token '{role:"woodpecker_artifactapi_writer",jwt:$$jwt}' \
| curl -sf -d @- "$$VAULT/v1/auth/k8s/au/syd1/login" | jq -er .auth.client_token) || exit 1
printf 'X-Vault-Token: %s\n' "$$VT" | curl -sf -H @- "$$VAULT/v1/identity/oidc/token/artifactapi-writer" \
| jq -er '"Authorization: Bearer " + .data.token' > "$$AUTH" || exit 1
curl -f -X PUT \
"https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/terraform-unkin/files/unkin/vault-secrets-netbox/$${FILE}" \
-H "Content-Type: application/zip" \
-H "Content-Type: application/zip" -H @"$$AUTH" \
--data-binary @"$${FILE}"
depends_on: [package]
backend_options: