samply/bridgehead
1
0
Fork 0
mirror of https://github.com/samply/bridgehead.git synced 2026-10-13 10:56:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Secret Sync for the config repo token, one-time enrollment code, check output (#401)

Browse Source 
* cce: Fetch the config repository token via Secret Sync

* Keep the Secret Sync GitLab token across reboots and outages

* Install site configuration with a one-time enrollment code

* Align the itcc and dhki cases in prepare-system.sh

* Report an unreachable broker instead of a clock skew during install

* Show bridgehead check results as OK, WARN or CRIT and run them during install

* Refresh the config repo token before bridgehead check fetches

* Skip Secret Sync until the private key and root certificate exist

* Indent the case block in prepare-system.sh with tabs only

* Hide the config repo URL, token and enrollment code from other local users

* remove the unreachable second dhki case

---------

Co-authored-by: Martin Lablans <m.lablans@dkfz-heidelberg.de>
This commit is contained in:
Pierre Delpy
2026-10-08 14:16:00 +02:00
committed by GitHub
co-authored by Martin Lablans
parent 59a9fd688e
commit 00192eaefc
8 changed files with 287 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/gitlab-token-helper.sh
+2 -2
View File
@@ -2,10 +2,10 @@
[ "$1" = "get" ] || exit
source "/tmp/bridgehead/secret-sync.boot-$(cat /proc/sys/kernel/random/boot_id)/gitlab-token"
source /var/cache/bridgehead/secrets/gitlab-token
# Any non-empty username works, only the token matters
cat << EOF
username=bk
password=$BRIDGEHEAD_CONFIG_REPO_TOKEN
EOF
EOF