feat(server-nestjs): configurable Harbor robot expiration with enforced rotation headroom - #2680
Merged
Merged
Conversation
…ed rotation headroom Robots were created with duration -1 (never expires), making the preventive rotation of their Vault secrets inconsistent: if a rotation silently failed, the robot would remain valid forever. Add HARBOR_ROBOT_EXPIRATION_DAYS (default 90) to the Harbor config and pass it as the robot duration, and keep the rotation headroom at roughly a third of the lifetime by lowering HARBOR_ROBOT_ROTATION_THRESHOLD_DAYS to 60. HARBOR_ROBOT_ROTATION_THRESHOLD_DAYS is now schema-enforced to stay strictly below the expiration, so robots are always replaced before they expire. Refs #2679 Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr> Change-Id: I1888d03cdbc54a3dbd00a027f69134c26a6a6964 Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr> Change-Id: I1888d03cdbc54a3dbd00a027f69134c26a6a6964
shikanime
force-pushed
the
feat/harbor-robot-expiration
branch
from
September 8, 2026 15:35
5fdea26 to
0835297
Compare
shikanime
marked this pull request as ready for review
September 8, 2026 15:39
StephaneTrebel
approved these changes
Sep 8, 2026
StephaneTrebel
left a comment
StephaneTrebel
left a comment
Collaborator
There was a problem hiding this comment.
Même forme que côté Gitlab, ça me va bien 👍
shikanime
enabled auto-merge
September 8, 2026 15:44
|
0 New Issues
0 Fixed Issues
0 Accepted Issues
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues liées
Issues numéro:
#2679
Quel est le comportement actuel ?
Les robots Harbor sont créés avec
duration: -1, c'est-à-dire sans expiration.La rotation préventive de leurs secrets Vault est alors incohérente : si une rotation échoue silencieusement, le robot reste valide indéfiniment.
Quel est le nouveau comportement ?
Ajout de
HARBOR_ROBOT_EXPIRATION_DAYSdans la config Harbor (par défaut 90 jours), passé comme durée de vie des robots.HARBOR_ROBOT_ROTATION_THRESHOLD_DAYSest désormais ramené à 60 jours, soit une marge de rotation d'environ un tiers de la durée de vie.Le seuil est validé par le schéma pour rester strictement inférieur à l'expiration.
Les robots sont donc toujours remplacés avant d'expirer.
Cette PR introduit-elle un breaking change ?
Non.
Autres informations