News for hackers. Stuff that matters.

A comment on GitHub: Packages support for fine-grained PATs. Parent comment

Re:GitHub: Packages support for fine-grained PATs by simonw on Sunday April 28, 2024 @02:57PM (#40190887)
If I want my random DigitalOcean VPS to have access to an account elsewhere, it's going to need a secret of some sort. If it gets issued ephemeral secrets from something like Vault it still needs to be able to identify itself to Vault as "I'm DigitalOcean VPS ID=32443 and I need a 1 hour secret to access this GitHub repo".

Eventually, something needs to have a non-expiring secret to help identify it.

The more complicated we make this stuff the more chance someone will make a mistake in configuring it and open themselves up to a breach.

[ Parent | on HN ]
Re:GitHub: Packages support for fine-grained PATs by zshev on Sunday April 28, 2024 @05:37PM (#40192233)
I’m not familiar with DO but one approach to the secret zero thing that works elsewhere is the VPS gets assigned an OIDC identity by the provider (or the VPS has access to one if it asks). That identity is in turn used to sign in to Vault.
[ Parent | on HN ]