CI images move off the packer-images monorepo to semver-released container-* repos.
- run RPM build steps on docker-internal/rpmbuilder:0.1.0-alma9
Reviewed-on: #3
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
Why: standardize Go CI on the estate gobuilder image and cut cold build/test
time with the shared S3 build cache.
- build/test/pre-commit/release(build) now use gobuilder:0.1.2-alma9
- add GOCACHE_* env + AWS creds (org secrets) to those steps
- cache dir is absolute (/tmp/gocache), metrics enabled
- bump k8s resource requests/limits for compile+cache overhead
- packaging/upload steps (nfpm, no Go) left untouched
Reviewed-on: #2
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
Implement a generic Vault/OpenBao secrets engine that issues short-lived
signed JWTs for self-made services, replacing per-app static bearer
Secrets. Per-app roles set the audience, TTLs, subject allowlist and
custom claims; creds/<role> mints an EdDSA (or RS256) token. Apps
validate offline against the unauthenticated JWKS + OIDC-metadata paths,
so there is no Vault round-trip per request. Signing keys are seal-wrapped
in the barrier and rotate with a configurable JWKS grace window.
Mirrors the other vault-plugin-secrets-* engines: cmd ServeMultiplex,
Makefile with patch|minor|major tags, .woodpecker CI (k8s resources + SA),
dual-flavour nfpm RPM to artifactapi rpm-internal. Tests (-race) cover
issuance+JWKS validation for both algorithms, rotation grace/trim, role
isolation, subject allowlist and the unauthenticated/seal-wrap wiring.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkin-agent
benvin
unkinben
gitadmin