bitborg/bitborg-infra

Bevaka

Avgrena 0

v16 eval: Authorized Integrations (JWT auth) vs static service-account PATs #80

Nytt ärende

Stängd

öppnade 2026-07-17 11:52:22 +00:00 av supernaut · 1 kommentar

supernaut kommenterad

2026-07-17 11:52:22 +00:00

Ägare

Tier 2 v16 follow-up — evaluation (gated on #73 landing). v16 introduces Authorized Integrations: JWT-based authentication for the API and Git that avoids long-lived static secrets (from the v16.0 release announcement; not in our original upgrade plan — discovered during release-day verification).

Evaluate whether it can reduce or replace our static-PAT surface:

Read the released docs/PRs: what grants exist, how issuance/expiry works, whether non-interactive service accounts (reconciler, renovate, runner-controller, registry-mirror, CI) can use it.
Map against ADR 0024's service-account token inventory: which tokens could become short-lived JWTs?
Interaction with the admin token-rotation work — if Authorized Integrations covers a consumer, rotation for that consumer becomes moot.
Security posture: key management, revocation story, audit-logging of JWT-authenticated calls.

Outcome: a short findings note + go/no-go per consumer; ADR update only if adopted.

**Tier 2 v16 follow-up — evaluation** (gated on #73 landing). v16 introduces **Authorized Integrations**: JWT-based authentication for the API and Git that avoids long-lived static secrets (from the v16.0 release announcement; not in our original upgrade plan — discovered during release-day verification). Evaluate whether it can reduce or replace our static-PAT surface: - [ ] Read the released docs/PRs: what grants exist, how issuance/expiry works, whether non-interactive service accounts (reconciler, renovate, runner-controller, registry-mirror, CI) can use it. - [ ] Map against ADR 0024's service-account token inventory: which tokens could become short-lived JWTs? - [ ] Interaction with the admin token-rotation work — if Authorized Integrations covers a consumer, rotation for that consumer becomes moot. - [ ] Security posture: key management, revocation story, audit-logging of JWT-authenticated calls. Outcome: a short findings note + go/no-go per consumer; ADR update only if adopted.

supernaut lade till etiketterna

2026-07-17 11:52:31 +00:00

supernaut lade till detta till projektet Bitborg Infrastructure

2026-07-17 11:55:48 +00:00

supernaut refererade till detta ärende

2026-07-17 14:07:19 +00:00

upgrade forgejo 15.0.4 → 16.0.0 #73

supernaut lade till

ready-for-implementation

och tog bort

needs-triage

etiketter

2026-07-17 14:50:04 +00:00

supernaut refererade till detta ärende

2026-07-18 20:30:37 +00:00

v16: automated service-account token rotation via the admin token API #75

supernaut kommenterad

2026-07-20 15:11:52 +00:00

Upphovsperson

Ägare

Eval done — recommendation: DEFER broad adoption; adopt for one subset only (gitborg-ci in-Actions package push) as a scoped PoC.

How it works (v16): Authorized Integrations is inbound auth — a trust rule asserts on an incoming JWT (issuer via OIDC discovery + JWKS, Forgejo-generated audience, claim matching eq/in/glob/nest) and authenticates the caller as a user with access-token-equivalent scopes, no shared secret. The caller must present a JWT from a trusted issuer: local Forgejo Actions (urn:forgejo:authorized-integrations:actions, ~1h ID_TOKEN_EXPIRATION_TIME) or an external OIDC provider (AWS/GitHub/GitLab). Docs do not cover a plain standalone script obtaining such a JWT.

Mapping vs ADR 0024:

gitborg-ci (runs in Forgejo Actions) — YES, native fit; could drop the static REGISTRY_TOKEN.
reconciler / runner-controller — No/partial: bare host timers, no OIDC identity; would need a new issuer (Kanidm client-creds) that just relocates a static secret.
renovate / registry-mirror / token-audit / gitborg-bot — No: host scripts/containers, no issuer.
web — N/A (no Forgejo PAT since Kanidm web-provision).

Rotation (#75): moot only for whatever moves to JWT (i.e. gitborg-ci if adopted); stays load-bearing for all the host-script bots. ADR change: none now — only a short ADR 0024 addendum if the gitborg-ci PoC lands.

Verify on the instance: (1) package registry accepts the Actions JWT for write:package; (2) JWT-auth calls appear distinctly in the v16 audit log; (3) whether Kanidm can be a trusted issuer for host automation.

Full note: bitborg-internal/plans/2026-07-20-authorized-integrations-jwt-eval.md.

**Eval done — recommendation: DEFER broad adoption; adopt for one subset only (`gitborg-ci` in-Actions package push) as a scoped PoC.** How it works (v16): Authorized Integrations is *inbound* auth — a trust rule asserts on an incoming JWT (issuer via OIDC discovery + JWKS, Forgejo-generated audience, claim matching eq/in/glob/nest) and authenticates the caller as a user with access-token-equivalent scopes, no shared secret. The caller must present a JWT from a trusted issuer: **local Forgejo Actions** (`urn:forgejo:authorized-integrations:actions`, ~1h `ID_TOKEN_EXPIRATION_TIME`) or an external OIDC provider (AWS/GitHub/GitLab). Docs do **not** cover a plain standalone script obtaining such a JWT. Mapping vs ADR 0024: - **gitborg-ci** (runs in Forgejo Actions) — **YES**, native fit; could drop the static `REGISTRY_TOKEN`. - **reconciler / runner-controller** — **No/partial**: bare host timers, no OIDC identity; would need a new issuer (Kanidm client-creds) that just relocates a static secret. - **renovate / registry-mirror / token-audit / gitborg-bot** — **No**: host scripts/containers, no issuer. - **web** — N/A (no Forgejo PAT since Kanidm web-provision). Rotation (#75): moot only for whatever moves to JWT (i.e. gitborg-ci if adopted); stays load-bearing for all the host-script bots. ADR change: none now — only a short ADR 0024 addendum if the gitborg-ci PoC lands. Verify on the instance: (1) package registry accepts the Actions JWT for `write:package`; (2) JWT-auth calls appear distinctly in the v16 audit log; (3) whether Kanidm can be a trusted issuer for host automation. Full note: `bitborg-internal/plans/2026-07-20-authorized-integrations-jwt-eval.md`.

supernaut refererade till detta ärende

2026-07-21 06:57:59 +00:00

v16 spike: IdP-driven team/org membership via dynamic OIDC group mappings #77

supernaut refererade till detta ärende från en incheckning

2026-08-01 15:00:04 +00:00

docs: evaluate v16 authorized integrations vs static pats (#80)

supernaut hänvisade till detta ärende från en ändringsförfrågan som kommer att stänga det

2026-08-01 15:00:05 +00:00

docs(design): evaluate Authorized Integrations against our static-PAT surface #312

supernaut refererade till detta ärende

2026-08-01 15:00:27 +00:00

forgejo: authorized integrations accept any issuer domain, on an open-registration instance #313