Add ephemeral Gitea creds for repospawner #142

2026-08-30T00:48:03+10:00

unkin-agent commented

2026-08-30 00:48:03 +10:00

Why

repospawner creates and seeds Gitea repositories on demand from in-cluster. It needs a Gitea token, and it should not carry a static one -- it gets ephemeral, lease-bound creds like every other service. The agents AppRole is CIDR-bound to Ben's workstation, so pods authenticate via Kubernetes auth instead.

How

config/gitea_secret_backend_role/gitea/repospawner.yaml -- gitea engine role for the repospawner user. Scopes write:repository, write:issue, read:user (read:user is mandatory: clients validate the login via GET /api/v1/user, which 403s without it). ttl 1h / max_ttl 4h. Mirrors unkin-agent.yaml.
config/auth_kubernetes_role/k8s/au/syd1/repospawner.yaml -- k8s auth role bound to serviceaccount repospawner in namespace repospawner, 600s ttl, audience: vault (VSO/projected-token flavor, same as media-apps / logging_logarchiver).
policies/gitea/creds/repospawner.yaml -- read on gitea/creds/repospawner, bound to k8s/au/syd1: [repospawner] only. Deliberately not bound to the agents AppRole: the service runs in-cluster only.

Depends on

The terraform-git PR that creates the repospawner Gitea user. The engine role cannot mint creds until the user exists -- merge that one first.

## Why `repospawner` creates and seeds Gitea repositories on demand from in-cluster. It needs a Gitea token, and it should not carry a static one -- it gets ephemeral, lease-bound creds like every other service. The `agents` AppRole is CIDR-bound to Ben's workstation, so pods authenticate via Kubernetes auth instead. ## How - `config/gitea_secret_backend_role/gitea/repospawner.yaml` -- gitea engine role for the `repospawner` user. Scopes `write:repository`, `write:issue`, `read:user` (`read:user` is mandatory: clients validate the login via `GET /api/v1/user`, which 403s without it). ttl 1h / max_ttl 4h. Mirrors `unkin-agent.yaml`. - `config/auth_kubernetes_role/k8s/au/syd1/repospawner.yaml` -- k8s auth role bound to serviceaccount `repospawner` in namespace `repospawner`, 600s ttl, `audience: vault` (VSO/projected-token flavor, same as `media-apps` / `logging_logarchiver`). - `policies/gitea/creds/repospawner.yaml` -- `read` on `gitea/creds/repospawner`, bound to `k8s/au/syd1: [repospawner]` only. Deliberately **not** bound to the `agents` AppRole: the service runs in-cluster only. ## Depends on The terraform-git PR that creates the `repospawner` Gitea user. The engine role cannot mint creds until the user exists -- **merge that one first**.

unkin-agent added 1 commit 2026-08-30 00:48:03 +10:00

Add ephemeral Gitea creds for repospawner

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

7b6dff58e0

repospawner needs to create and seed Gitea repositories without a static
token. Add the gitea engine role, a Kubernetes auth role for its in-cluster
service account, and the policy binding the two.

- Add gitea_secret_backend_role repospawner (write:repository, write:issue,
  read:user; 1h ttl / 4h max)
- Add auth_kubernetes_role k8s/au/syd1/repospawner bound to
  repospawner/repospawner with the vault audience
- Add policies/gitea/creds/repospawner granting read on
  gitea/creds/repospawner to that Kubernetes role only

benvin merged commit 5879fbd2d8 into master

2026-08-30 09:29:26 +10:00

benvin deleted branch benvin/repospawner-gitea-creds

2026-08-30 09:29:27 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-vault#142