unkin/vault-tools
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Add docker-credential-vault credential helper #9

Merged
benvin merged 2 commits from benvin/docker-credential-vault into main 2026-11-08 12:15:25 +11:00
Conversation 1 Commits 2 Files Changed 10
+489 -7
unkin-agent commented 2026-11-08 11:54:13 +11:00
Member
Copy Link
Copy Source

Docker pushes to artifactapi authenticate with a 15m Vault identity OIDC token, so docker login leaves an expired token stored unencrypted in ~/.docker/config.json.

  • add docker-credential-vault, minting identity/oidc/token/<role> per get from the vcm cached token (fallback VAULT_ADDR + VAULT_TOKEN/~/.vault-token)
  • map artifactapi.k8s.syd1.au.unkin.net to artifactapi-writer/ci by default, overridable under docker: in the vcm config
  • add shared.MintOIDCToken
  • ship the binary in the RPM and release assets; document credHelpers setup
Docker pushes to artifactapi authenticate with a 15m Vault identity OIDC token, so `docker login` leaves an expired token stored unencrypted in ~/.docker/config.json. - add `docker-credential-vault`, minting `identity/oidc/token/<role>` per `get` from the vcm cached token (fallback VAULT_ADDR + VAULT_TOKEN/~/.vault-token) - map `artifactapi.k8s.syd1.au.unkin.net` to `artifactapi-writer`/`ci` by default, overridable under `docker:` in the vcm config - add `shared.MintOIDCToken` - ship the binary in the RPM and release assets; document credHelpers setup
unkin-agent added 1 commit 2026-11-08 11:54:14 +11:00
add docker-credential-vault credential helper
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline failed
Details
c13cda5a77
unkin-agent commented 2026-11-08 11:57:09 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
unkin-agent added 1 commit 2026-11-08 12:03:19 +11:00
Add trailing newline to docker-credential-vault main.go
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
6f6fbcc2c9
benvin merged commit cbc2c53e23 into main 2026-11-08 12:15:25 +11:00
benvin deleted branch benvin/docker-credential-vault 2026-11-08 12:15:25 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/vault-tools#9
Delete Branch "benvin/docker-credential-vault"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?