From 7b6dff58e00d16dba6e41540e1cf9c9eeefed572 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 30 Aug 2026 00:47:37 +1000
Subject: [PATCH] Add ephemeral Gitea creds for repospawner

repospawner needs to create and seed Gitea repositories without a static
token. Add the gitea engine role, a Kubernetes auth role for its in-cluster
service account, and the policy binding the two.

- Add gitea_secret_backend_role repospawner (write:repository, write:issue,
  read:user; 1h ttl / 4h max)
- Add auth_kubernetes_role k8s/au/syd1/repospawner bound to
  repospawner/repospawner with the vault audience
- Add policies/gitea/creds/repospawner granting read on
  gitea/creds/repospawner to that Kubernetes role only
---
 .../k8s/au/syd1/repospawner.yaml              |  7 +++++++
 .../gitea/repospawner.yaml                    | 19 +++++++++++++++++++
 policies/gitea/creds/repospawner.yaml         | 16 ++++++++++++++++
 3 files changed, 42 insertions(+)
 create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/repospawner.yaml
 create mode 100644 config/gitea_secret_backend_role/gitea/repospawner.yaml
 create mode 100644 policies/gitea/creds/repospawner.yaml

diff --git a/config/auth_kubernetes_role/k8s/au/syd1/repospawner.yaml b/config/auth_kubernetes_role/k8s/au/syd1/repospawner.yaml
new file mode 100644
index 0000000..baf8bd7
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/repospawner.yaml
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - repospawner
+bound_service_account_namespaces:
+  - repospawner
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
diff --git a/config/gitea_secret_backend_role/gitea/repospawner.yaml b/config/gitea_secret_backend_role/gitea/repospawner.yaml
new file mode 100644
index 0000000..ffcbfc1
--- /dev/null
+++ b/config/gitea_secret_backend_role/gitea/repospawner.yaml
@@ -0,0 +1,19 @@
+# Role minting ephemeral tokens for the repospawner service user. repospawner
+# creates and seeds Gitea repositories on demand, so it gets write on
+# repositories (create + push) and write on issues (issue/PR comments). Read is
+# implied by write. No admin/org/user-write scopes.
+# read:user is required because most API clients validate the login via
+# GET /api/v1/user, which 403s without it.
+# Reading gitea/creds/repospawner mints a lease-bound token deleted from Gitea
+# on revoke/expiry. Consumed by the repospawner pods via Kubernetes auth (see
+# policies/gitea/creds/repospawner.yaml) -- the agents AppRole is CIDR-bound to
+# Ben's workstation and cannot be used from in-cluster.
+---
+username: repospawner
+scopes:
+  - write:repository
+  - write:issue
+  - read:user
+token_name_prefix: vault-repospawner
+ttl: 3600      # 1h
+max_ttl: 14400 # 4h
diff --git a/policies/gitea/creds/repospawner.yaml b/policies/gitea/creds/repospawner.yaml
new file mode 100644
index 0000000..49352c6
--- /dev/null
+++ b/policies/gitea/creds/repospawner.yaml
@@ -0,0 +1,16 @@
+# Lets the repospawner pods mint ephemeral Gitea tokens for the repospawner
+# service user, so the service authenticates to git.unkin.net as its own
+# least-privilege identity. Reading gitea/creds/repospawner returns a
+# lease-bound token scoped by the role (write:repository, write:issue,
+# read:user -- never merge/admin).
+# Kubernetes auth only: repospawner runs in-cluster and the agents AppRole is
+# CIDR-bound to Ben's workstation.
+---
+rules:
+  - path: "gitea/creds/repospawner"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - repospawner