Vault on Alwaldend

Forgejo login

Mon, 01 Jan 0001 00:00:00 +0000

The plugin registers token removal before issuance, using a unique token name. Startup failure and normal shutdown attempt removal through the authenticated Forgejo browser session, including when creation did not return a usable token. Cleanup parses the complete applications settings page and verifies token absence after deletion. It then logs out the invocation’s browser session and verifies that the retained original cookie no longer accesses authenticated settings. Cleanup failures are reported.

Gen gossip key

Mon, 01 Jan 0001 00:00:00 +0000

Harbor login

Mon, 01 Jan 0001 00:00:00 +0000

The plugin destroys its Harbor session on normal shutdown and checks that the original session ID is rejected by the current-user API. Cleanup uses Harbor’s /c/oidc/logout endpoint (available in newer Harbor releases) and does not follow the optional identity-provider logout redirect. Unsupported endpoints, network failures, or sessions that remain valid are reported as cleanup errors. Session expiry remains server-controlled; forced termination cannot guarantee logout.

The session destruction behavior is defined by Harbor’s OIDC controller. Vault tokens created by the invocation are revoked after session cleanup.

Injector

Mon, 01 Jan 0001 00:00:00 +0000

Shutdown first drains plugin requests, then stops and waits for resource processes, revokes invocation-owned Vault credentials, and deletes temporary files and SSH key directories. Failed cleanup is reported. Registration after shutdown is rejected; a fetcher removes any unregistered temporary material. Temporary files use mode 0600 and directories use 0700. Deletion is filesystem unlinking, not secure erasure, and cannot run after SIGKILL or host failure.

no_auth explicitly sets the injected VAULT_TOKEN to an empty value so an inherited token is overridden. This does not remove the user’s token-helper file; commands that independently consult that helper may still authenticate. Template errors and OIDC status errors omit input and response contents. OIDC requests honor cancellation and do not follow redirects.

Login

Mon, 01 Jan 0001 00:00:00 +0000

Usage

bazel run //tools/vault/login

PVE login

Mon, 01 Jan 0001 00:00:00 +0000

The plugin requests an API token with a one-hour expiry and deletes that token on shutdown using the retained login ticket and CSRF token. The token name is registered for cleanup before creation, so cleanup is attempted even when a creation response is lost or malformed. Failures to delete are reported; expiry is the fallback when shutdown cannot complete. Pre-existing credentials are not revoked. Vault tokens created by the invocation are revoked after token cleanup.

Tf backend

Mon, 01 Jan 0001 00:00:00 +0000

The plugin tracks each running backend for shutdown, including backends created before a later call fails. Shutdown drains HTTP requests before revoking the backend’s invocation-owned Vault credentials. If the shutdown deadline expires, connections are forcibly closed and the timeout is reported. Normal HTTP server closure is not an error. Vault requests use their incoming request context.

Vault

Mon, 01 Jan 0001 00:00:00 +0000

Manual certificate creation

https://arminreiter.com/2022/01/create-your-own-certificate-authority-ca-using-openssl/

Unseal process

Get the encrypted unseal key
Unencrypt it: cat unseal.txt | base64 --decode | gpg -dq
Run vault operator unseal

Vault approle

Mon, 01 Jan 0001 00:00:00 +0000

Vault approle

Mon, 01 Jan 0001 00:00:00 +0000

Vault OIDC provider

Mon, 01 Jan 0001 00:00:00 +0000

Vault pki server

Mon, 01 Jan 0001 00:00:00 +0000

Vault ssh server role

Mon, 01 Jan 0001 00:00:00 +0000

Vault transit key

Mon, 01 Jan 0001 00:00:00 +0000

Vault on Alwaldend

Forgejo login

Gen gossip key

Harbor login

Injector

Login

Usage

PVE login

Tf backend

Vault

Manual certificate creation

Unseal process

Vault approle

Vault approle

Vault OIDC provider

Vault pki server

Vault ssh server role

Vault transit key

Links