unkinben
ec12dfb84f
Implement a generic Vault/OpenBao secrets engine that issues short-lived signed JWTs for self-made services, replacing per-app static bearer Secrets. Per-app roles set the audience, TTLs, subject allowlist and custom claims; creds/<role> mints an EdDSA (or RS256) token. Apps validate offline against the unauthenticated JWKS + OIDC-metadata paths, so there is no Vault round-trip per request. Signing keys are seal-wrapped in the barrier and rotate with a configurable JWKS grace window. Mirrors the other vault-plugin-secrets-* engines: cmd ServeMultiplex, Makefile with patch|minor|major tags, .woodpecker CI (k8s resources + SA), dual-flavour nfpm RPM to artifactapi rpm-internal. Tests (-race) cover issuance+JWKS validation for both algorithms, rotation grace/trim, role isolation, subject allowlist and the unauthenticated/seal-wrap wiring. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
when:
|
|
- event: tag
|
|
|
|
steps:
|
|
- name: build
|
|
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
|
commands:
|
|
- make build VERSION=${CI_COMMIT_TAG}
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 512Mi, cpu: 1}
|
|
limits: {memory: 2Gi, cpu: 2}
|
|
|
|
- name: package
|
|
image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
|
|
commands:
|
|
- ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
|
|
depends_on: [build]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 512Mi, cpu: 1}
|
|
limits: {memory: 2Gi, cpu: 2}
|
|
|
|
- name: upload
|
|
image: git.unkin.net/unkin/almalinux9-base:20260606
|
|
commands:
|
|
- |
|
|
HOST="https://artifactapi.k8s.syd1.au.unkin.net"
|
|
REPO="rpm-internal"
|
|
for rpm in dist/*.rpm; do
|
|
FILE=$$(basename "$$rpm")
|
|
code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
|
|
if [ "$$code" = "200" ]; then echo "$$FILE exists; skipping"; continue; fi
|
|
echo "Uploading $$FILE (probe $$code)"
|
|
curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
|
|
done
|
|
depends_on: [package]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 128Mi, cpu: 100m}
|
|
limits: {memory: 512Mi, cpu: 500m}
|