From 78f909f81f09c0e4082945672485359835a34fc5 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 25 Oct 2026 13:34:28 +1100 Subject: [PATCH] Add artifactapi-writer OIDC role for Woodpecker uploads --- .../au/syd1/woodpecker_artifactapi_writer.yaml | 15 +++++++++++++++ .../artifactapi/artifactapi-writer.yaml | 3 +++ .../identity/oidc/token/artifactapi-writer.yaml | 13 +++++++++++++ 3 files changed, 31 insertions(+) create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml create mode 100644 config/identity_oidc_role/artifactapi/artifactapi-writer.yaml create mode 100644 policies/identity/oidc/token/artifactapi-writer.yaml diff --git a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml new file mode 100644 index 0000000..e34a967 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml @@ -0,0 +1,15 @@ +bound_service_account_names: + - default + - arrproxy-ci + - autobackup-operator-ci + - ghp + - jellyfin-plugin-sso + - kea-operator-ci + - mediamark-ci + - plugin-docker-buildx + - repospawner-ci +bound_service_account_namespaces: + - woodpecker +token_ttl: 600 +token_max_ttl: 600 +audience: https://kubernetes.default.svc.cluster.local diff --git a/config/identity_oidc_role/artifactapi/artifactapi-writer.yaml b/config/identity_oidc_role/artifactapi/artifactapi-writer.yaml new file mode 100644 index 0000000..8970509 --- /dev/null +++ b/config/identity_oidc_role/artifactapi/artifactapi-writer.yaml @@ -0,0 +1,3 @@ +--- +client_id: artifactapi +ttl: 900 diff --git a/policies/identity/oidc/token/artifactapi-writer.yaml b/policies/identity/oidc/token/artifactapi-writer.yaml new file mode 100644 index 0000000..91f213f --- /dev/null +++ b/policies/identity/oidc/token/artifactapi-writer.yaml @@ -0,0 +1,13 @@ +--- +rules: + - path: "identity/oidc/token/artifactapi-writer" + capabilities: + - read + +auth: + k8s/au/syd1: + - woodpecker_artifactapi_writer + ldap: + - vault_admin + oidc: + - akP-vault-admin -- 2.47.3