Gitops: support Github's new Fine-grained personal access tokens
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 328
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 9
Description
**What would you like to be added**:
Github has added support for [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) for over a year now. It would be great if EKS Anywhere would support using them alongside (or perhaps even instead of) classic PATs.
**Why is this needed**:
In contrast to classic Personal Access Tokens, the new Fine-grained personal access tokens have the following advantages:
- They can be configured to only allow access to a single repository
- They must have an expiration date (current maximum is 1 calendar year)
Allowing operators to use fine-grained access tokens (that only have access to the single repo Flux needs) will allow EKS Anywhere to be more widely used, especially in environments where security best practices regarding secret rotation and limited access is enforced.
**Extra context**:
I tried using a Fine-grained personal access token, which I gave **all** permissions possible (to only the correct repo, of course). Yet, `eks anywhere` gave the "not enough permissions error"
```bash
Error: failed to upgrade cluster: validating provider: github access token does not have repo permissions
```
Although I didn't confirm this, I suspect the above scenario and error message mean that the checks done by `eksctl anywhere` just need to be updated to accommodate Fine-grained personal access tokens.
Contributor guide
Research direction
Start with the eksctl anywhere provider validation that emits "github access token does not have repo permissions" and reproduce the check using a fine-grained token scoped to the correct repository. Trace how GitHub token permissions are validated for Flux, then verify that the token is accepted while classic PAT support remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, go
- Domain
- authentication, cli, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100