Portability · 03 of 06 · Credentials

A short-lived token on every forge

Hangar's rule is that a pipeline never holds a standing credential: it proves who it is and gets a token for one repository. The broker keeps that rule on every forge. What it cannot keep is the lifetime and the scope, and those differ.

A short-lived token on every forge A pipeline pod sends its projected ServiceAccount token, audience scm, to the scm broker in platform-system, which checks it with a TokenReview and checks the caller owns a Repository CR for the repo. The broker signs with a forge credential that never leaves platform-system: a GitHub App key, a GitLab group token or a Bitbucket OAuth secret. It mints a short-lived token, which differs per forge: a GitHub installation token for one repo for an hour, built today; planned, a GitLab project access token for one day, a Bitbucket Cloud OAuth token for two hours that covers the whole workspace, and a Bitbucket Data Center HTTP token for one repo for a day. The broker also rotates, daily, the provider secret Pipelines as Code needs on GitLab and Bitbucket. PLATFORM-SYSTEMREQUESTMINTSSIGNS WITHROTATES DAILYPipeline podprojected SA token, aud scmscm brokerTokenReview + Repository CR checkForge credentialApp key · group token · OAuth secretPaC provider secretGitLab and Bitbucket onlyPER FORGEWhat comes backGitHubinstallation · 1h · one repoGitLabproject token · 1 dayBitbucket CloudOAuth · 2h · workspaceBitbucket DCHTTP token · 1 dayThe weakest forge sets the floor. Write the difference down, never hide it.LEGENDCallerBrokerCredentialShort-lived tokenRotation

Same front door

The broker's caller check does not change: a Repository CR in your namespace, proved with TokenReview. Only the minting step is per forge.

Two weaker spots

  • GitLab tokens expire by date, so a token can live up to a day. The broker revokes it when the run ends.
  • Bitbucket Cloud OAuth tokens cover the whole workspace. Use one workspace per trust boundary.

One new standing secret

Pipelines as Code on GitLab and Bitbucket reads a token from a Secret named by the Repository CR. The broker rotates it daily and Tower shows its age.

Hangar · Portability