From d4e70ff6d59537e69d5b6998866ace771f828c39 Mon Sep 17 00:00:00 2001 From: Nashon Steffen Date: Wed, 4 Nov 2026 12:03:08 -0800 Subject: [PATCH] Add OctoSTS org trust policy for Argo CD on dev-aks Argo CD on the dev-aks cluster reads stacklok/infra. A CronJob in the argocd namespace exchanges its projected service account token for a read-only stacklok-octosts token. No GitHub App key is stored. The policy accepts the dev-aks OIDC issuer and the service account argocd:argocd-repo-token. The token carries contents: read on infra. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/chainguard/argocd-dev-aks.sts.yaml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/chainguard/argocd-dev-aks.sts.yaml diff --git a/.github/chainguard/argocd-dev-aks.sts.yaml b/.github/chainguard/argocd-dev-aks.sts.yaml new file mode 100644 index 0000000..8a69c47 --- /dev/null +++ b/.github/chainguard/argocd-dev-aks.sts.yaml @@ -0,0 +1,21 @@ +# Argo CD on the dev-aks cluster reads stacklok/infra to sync its apps. A +# CronJob in the argocd namespace exchanges its projected service account +# token here every 30 minutes. It writes the GitHub token into the Argo CD +# repo-creds Secret. It requests scope "stacklok" and identity +# "argocd-dev-aks". +# Infra source: stacklok/infra azure-aks/ (cluster) and the Argo CD bootstrap. + +# dev-aks OIDC issuer (westus3). The trailing slash is part of the iss claim. +issuer: https://westus3.oic.prod-aks.azure.com/6a88f3cf-e238-4742-95ab-8aafca0b2b87/caa0aab0-2fcb-4088-ad5c-bbe477e9e5a5/ +subject: system:serviceaccount:argocd:argocd-repo-token + +# Pin token exchanges to stacklok-octosts. The App ID is a string. +app: '4886385' + +# Install stacklok-octosts on each repo in this list. +repositories: + - infra + +# Argo CD only clones and fetches. It never writes to the repo. +permissions: + contents: read