Ben Vincent
cfbc06669e
Vault/OpenBao secrets engine that mints NetBox API tokens via /api/users/tokens/. A single seeded admin token (config) mints short-lived, per-user tokens (roles -> creds) whose NetBox expiry is aligned to the Vault lease; revoke deletes the token, renew extends its expiry. config/rotate reissues the seeded admin token. Handles NetBox 4.6 v2 tokens (Bearer nbt_<key>.<secret>) and legacy v1. Unit tests against an httptest NetBox mock; dual Vault/OpenBao RPMs via nfpm; tag-driven release to artifactapi. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
when:
|
|
- event: tag
|
|
|
|
steps:
|
|
- name: build
|
|
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
|
commands:
|
|
- make build VERSION=${CI_COMMIT_TAG}
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 512Mi, cpu: 1}
|
|
limits: {memory: 2Gi, cpu: 2}
|
|
|
|
- name: package
|
|
image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
|
|
commands:
|
|
- ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
|
|
depends_on: [build]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 512Mi, cpu: 1}
|
|
limits: {memory: 2Gi, cpu: 2}
|
|
|
|
- name: upload
|
|
image: git.unkin.net/unkin/almalinux9-base:20260606
|
|
commands:
|
|
- |
|
|
HOST="https://artifactapi.k8s.syd1.au.unkin.net"
|
|
REPO="rpm-internal"
|
|
for rpm in dist/*.rpm; do
|
|
FILE=$$(basename "$$rpm")
|
|
code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
|
|
if [ "$$code" = "200" ]; then echo "$$FILE exists; skipping"; continue; fi
|
|
echo "Uploading $$FILE (probe $$code)"
|
|
curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
|
|
done
|
|
depends_on: [package]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 128Mi, cpu: 100m}
|
|
limits: {memory: 512Mi, cpu: 500m}
|