Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set robot account expiration and recreate it when account is removed #11

Open
hanlins opened this issue Jan 9, 2021 · 1 comment
Open
Labels
feature New feature or request

Comments

@hanlins
Copy link
Collaborator

hanlins commented Jan 9, 2021

For a robot account, from a security standpoint, we should set an expiration for that account or at least rotate its credentials. As currently, we can't rotate robots' credentials/tokens in harbor itself, we should set an expiration date in the operator when creating the robot account as a future improvement. And by the nature of controller reconciliation logic, a new robot account should be created after the old one expires.

@hanlins hanlins added the feature New feature or request label Jan 9, 2021
@hanlins
Copy link
Collaborator Author

hanlins commented Jan 9, 2021

For reference, the robot account is set to never expire.

	params := products.NewPostProjectsProjectIDRobotsParamsWithContext(c.context).
		WithTimeout(c.timeout).
		WithHTTPClient(c.insecureClient).
		WithProjectID(projectID).
		WithRobot(&models.RobotAccountCreate{
			Access: []*models.RobotAccountAccess{
				{
					Action:   "push",
					Resource: fmt.Sprintf("/project/%d/repository", projectID),
				},
			},
			Description: "automated by harbor automation operator",
			ExpiresAt:   -1, // never
			Name:        utils.RandomName("4k8s"),
		})

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant