unkin-agent
64d9b89dcd
Mints ephemeral, scoped ghp access tokens via ghp's admin token API
(POST /api/tokens), bound to a Vault lease and revoked on lease
expiry (DELETE /api/tokens/{id}).
- config: base_url + write-only admin_token (ghpsvc_ service token),
TLS settings; verifies the token is a ghp admin on write. No
rotate-root: the service token is static and operator-managed.
- roles: token_type (agent/proxy), installation_id, app_record_id,
repositories, scopes (permission:level), session_prefix, ttl/max_ttl.
- creds: mint a lease-bound token; ghp-side duration bounded by the
lease ceiling as defence in depth.
- secret ghp_token: idempotent revoke + lease renew.
- Unit tests (config/role/creds/client/scopes/revocation), mock-ghp
e2e on Vault + OpenBao, Woodpecker pre-commit/build/test/release,
Makefile patch/minor/major, nfpm RPM packaging.
36 lines
827 B
YAML
36 lines
827 B
YAML
---
|
|
# nfpm config for the vault-plugin-secrets-ghp RPM. Rendered through envsubst
|
|
# (see scripts/build-rpm.sh) then fed to `nfpm pkg`. Built once per target server
|
|
# (Vault, OpenBao); PACKAGE_NAME and PACKAGE_PLUGIN_DIR vary.
|
|
|
|
name: ${PACKAGE_NAME}
|
|
version: ${PACKAGE_VERSION}
|
|
release: ${PACKAGE_RELEASE}
|
|
arch: ${PACKAGE_ARCH}
|
|
platform: ${PACKAGE_PLATFORM}
|
|
section: default
|
|
priority: extra
|
|
description: "${PACKAGE_DESCRIPTION}"
|
|
|
|
maintainer: ${PACKAGE_MAINTAINER}
|
|
homepage: ${PACKAGE_HOMEPAGE}
|
|
license: ${PACKAGE_LICENSE}
|
|
|
|
disable_globbing: false
|
|
|
|
replaces:
|
|
- ${PACKAGE_NAME}
|
|
provides:
|
|
- ${PACKAGE_NAME}
|
|
|
|
contents:
|
|
- src: dist/vault-plugin-secrets-ghp
|
|
dst: ${PACKAGE_PLUGIN_DIR}/vault-plugin-secrets-ghp
|
|
file_info:
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
|
|
scripts:
|
|
preinstall: ${PACKAGE_PREINSTALL}
|