unkin-agent
7b6dff58e0
repospawner needs to create and seed Gitea repositories without a static token. Add the gitea engine role, a Kubernetes auth role for its in-cluster service account, and the policy binding the two. - Add gitea_secret_backend_role repospawner (write:repository, write:issue, read:user; 1h ttl / 4h max) - Add auth_kubernetes_role k8s/au/syd1/repospawner bound to repospawner/repospawner with the vault audience - Add policies/gitea/creds/repospawner granting read on gitea/creds/repospawner to that Kubernetes role only
20 lines
850 B
YAML
20 lines
850 B
YAML
# Role minting ephemeral tokens for the repospawner service user. repospawner
|
|
# creates and seeds Gitea repositories on demand, so it gets write on
|
|
# repositories (create + push) and write on issues (issue/PR comments). Read is
|
|
# implied by write. No admin/org/user-write scopes.
|
|
# read:user is required because most API clients validate the login via
|
|
# GET /api/v1/user, which 403s without it.
|
|
# Reading gitea/creds/repospawner mints a lease-bound token deleted from Gitea
|
|
# on revoke/expiry. Consumed by the repospawner pods via Kubernetes auth (see
|
|
# policies/gitea/creds/repospawner.yaml) -- the agents AppRole is CIDR-bound to
|
|
# Ben's workstation and cannot be used from in-cluster.
|
|
---
|
|
username: repospawner
|
|
scopes:
|
|
- write:repository
|
|
- write:issue
|
|
- read:user
|
|
token_name_prefix: vault-repospawner
|
|
ttl: 3600 # 1h
|
|
max_ttl: 14400 # 4h
|