aws / aws/eks-anywhere

Gitops: support Github's new Fine-grained personal access tokens

Open
#7,360 0 comments 0 reactions 0 assignees View on GitHub
external
Dominant language
Go
Stars
2.1k
Forks
328
Avg merge
1d 4h
Merged PRs (30d)
9

Description

**What would you like to be added**:

Github has added support for [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) for over a year now. It would be great if EKS Anywhere would support using them alongside (or perhaps even instead of) classic PATs.

**Why is this needed**:

In contrast to classic Personal Access Tokens, the new Fine-grained personal access tokens have the following advantages:
- They can be configured to only allow access to a single repository
- They must have an expiration date (current maximum is 1 calendar year)

Allowing operators to use fine-grained access tokens (that only have access to the single repo Flux needs) will allow EKS Anywhere to be more widely used, especially in environments where security best practices regarding secret rotation and limited access is enforced.

**Extra context**:

I tried using a Fine-grained personal access token, which I gave **all** permissions possible (to only the correct repo, of course). Yet, `eks anywhere` gave the "not enough permissions error"

```bash
Error: failed to upgrade cluster: validating provider: github access token does not have repo permissions
```

Although I didn't confirm this, I suspect the above scenario and error message mean that the checks done by `eksctl anywhere` just need to be updated to accommodate Fine-grained personal access tokens.

Contributor guide

Open the contributing guide

Research direction

Start with the eksctl anywhere provider validation that emits "github access token does not have repo permissions" and reproduce the check using a fine-grained token scoped to the correct repository. Trace how GitHub token permissions are validated for Flux, then verify that the token is accepted while classic PAT support remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, go
Domain
authentication, cli, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.