Ben Vincent
c46641dafb
Vault/OpenBao secrets engine managing Rancher API tokens via the public tokens.ext.cattle.io API. - config: Rancher connection (URL + TLS) - service-accounts/<name>: seeded root tokens, auto-rotated before Rancher's TTL cap via a PeriodicFunc (default 45d rotation, 90d token TTL); the current token mints its own replacement. Manual /rotate endpoint too. - roles/<name>: mint policy referencing a service account; cluster_name + TTL scoping (Rancher tokens inherit the seeding user's RBAC). - creds/<role>: dynamic, lease-bound tokens deleted from Rancher on revoke. Ports the bind-tsig Woodpecker RPM release, nfpm packaging, and a mock-Rancher e2e (Vault + OpenBao). Unit tests cover the full lifecycle.
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
when:
|
|
- event: tag
|
|
|
|
steps:
|
|
- name: build
|
|
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
|
commands:
|
|
- make build VERSION=${CI_COMMIT_TAG}
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 512Mi, cpu: 1}
|
|
limits: {memory: 2Gi, cpu: 2}
|
|
|
|
- name: package
|
|
image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
|
|
commands:
|
|
- ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
|
|
depends_on: [build]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 512Mi, cpu: 1}
|
|
limits: {memory: 2Gi, cpu: 2}
|
|
|
|
- name: upload
|
|
image: git.unkin.net/unkin/almalinux9-base:20260606
|
|
commands:
|
|
- |
|
|
HOST="https://artifactapi.k8s.syd1.au.unkin.net"
|
|
REPO="rpm-internal"
|
|
for rpm in dist/*.rpm; do
|
|
FILE=$$(basename "$$rpm")
|
|
code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
|
|
if [ "$$code" = "200" ]; then echo "$$FILE exists; skipping"; continue; fi
|
|
echo "Uploading $$FILE (probe $$code)"
|
|
curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
|
|
done
|
|
depends_on: [package]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 128Mi, cpu: 100m}
|
|
limits: {memory: 512Mi, cpu: 500m}
|