VAULT-31185 & 31186/use identity token auth for Artifactory in Vault CE & Ent #31255

kporter101 · 2025-07-11T18:19:10Z

Description

What does this PR do?
Context: Artifactory username/ API keys are being deprecated in favor of identity tokens, which do not require a username.

Removes all references to Artifactory username
Replaces references to Artifactory token (API key) with Artifactory Bearer token (identity token)

TODO only if you're a HashiCorp employee

Backport Labels: If this fix needs to be backported, use the appropriate backport/ label that matches the desired release branch. Note that in the CE repo, the latest release branch will look like backport/x.x.x, but older release branches will be backport/ent/x.x.x+ent.
- LTS: If this fixes a critical security vulnerability or severity 1 bug, it will also need to be backported to the current LTS versions of Vault. To ensure this, use all available enterprise labels.
ENT Breakage: If this PR either 1) removes a public function OR 2) changes the signature
of a public function, even if that change is in a CE file, double check that
applying the patch for this PR to the ENT repo and running tests doesn't
break any tests. Sometimes ENT only tests rely on public functions in CE
files.
Jira: If this change has an associated Jira, it's referenced either
in the PR description, commit message, or branch name.
RFC: If this change has an associated RFC, please link it in the description.
ENT PR: If this change has an associated ENT PR, please link it in the
description. Also, make sure the changelog is in this PR, not in your ENT PR.

PCI review checklist

I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.

Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

github-actions · 2025-07-11T18:24:10Z

CI Results:
All Go tests succeeded! ✅

github-actions · 2025-07-11T18:24:34Z

Build Results:
All builds succeeded! ✅

kporter101 · 2025-07-11T18:29:59Z

.github/workflows/test-run-enos-scenario.yml

@@ -44,8 +44,7 @@ jobs:
      ENOS_VAR_vault_log_level: trace
      ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
      ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
-      ENOS_VAR_artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
-      ENOS_VAR_artifactory_token: ${{ secrets.ARTIFACTORY_TOKEN }}
+      ENOS_VAR_artifactory_token: ${{ secrets.ARTIFACTORY_BEARER_TOKEN }}


@ryancragun should this still be secrets. or something else?

I would say that it is only this for historical reasons. When it was initially written we used Github Actions secrets for everything. Now we prefer Github Actions secrets for public repos and the internal Vault for private repos.

So to answer: ideally we'd only have this secret set in hashicorp/vault and only use it when the workflow executes in the context of that repository. When it executes in hashicorp/vault-enterprise we probably ought to be retrieving it from Vault.

The way that we do it in test-run-enos-scenario-matrix maps exactly to how we ought to do it here.

ryancragun

This looks good. Lets clean up the changelog and do some manual verification of the dev scenarios and merge it!

ryancragun · 2025-07-14T21:35:15Z

changelog/31255.txt

@@ -0,0 +1,3 @@
+```release-note:change
+secrets/artifactory: Use Artifactory identity token for auth, instead of username with API key


Since we're only changing the behavior of Vault CI, not the Vault binary itself, we don't need a changelog. Instead, use the pr/no-changelog label to get rid of failed check.

ryancragun · 2025-07-14T21:35:54Z

.github/workflows/test-run-enos-scenario.yml

@@ -44,8 +44,7 @@ jobs:
      ENOS_VAR_vault_log_level: trace
      ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
      ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
-      ENOS_VAR_artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
-      ENOS_VAR_artifactory_token: ${{ secrets.ARTIFACTORY_TOKEN }}
+      ENOS_VAR_artifactory_token: ${{ secrets.ARTIFACTORY_BEARER_TOKEN }}


The way that we do it in test-run-enos-scenario-matrix maps exactly to how we ought to do it here.

ryancragun · 2025-07-14T21:36:41Z

enos/enos-dev-scenario-pr-replication.hcl

        artifactory_token:
-          The artifactory token associated with your username. You'll need this if you wish to use
-          deb or rpm artifacts! You can create a token by logging into Artifactory via Okta.
+          The artifactory identity token associated with a service account. You'll need this if you wish to use


nit: can we normalize the line length on these new changes?

ryancragun · 2025-07-14T21:37:59Z

enos/enos-variables.hcl

@@ -1,13 +1,6 @@
 // Copyright (c) HashiCorp, Inc.
 // SPDX-License-Identifier: BUSL-1.1

-variable "artifactory_username" {


🫗 for basic auth

ryancragun · 2025-07-14T21:40:37Z

enos/modules/build_artifactory_package/main.tf

@@ -73,12 +68,11 @@ module "artifact_metadata" {
 }

 data "enos_artifactory_item" "vault" {
-  username = var.artifactory_username


Before merge we probably ought to test the dev scenarios with the package:rpm and package:deb variants to make sure they're working as expected.

ryancragun · 2025-07-14T21:42:39Z

I added the backport labels. Even though release testing always happens from main, we generally try and keep the enos and .github directories the same across all active branches.

vercel · 2025-07-23T22:19:57Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
vault-ui	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jul 25, 2025 8:53pm

ryancragun

Lets update the descriptions in both dev scenarios and then merge!

enos/enos-dev-scenario-pr-replication.hcl

ryancragun

kporter101 requested a review from a team as a code owner July 11, 2025 18:19

github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Jul 11, 2025

kporter101 force-pushed the VAULT-31185/remove-artifactory-usename branch from c73a9a0 to 5b0c872 Compare July 11, 2025 18:23

kporter101 commented Jul 11, 2025

View reviewed changes

kporter101 requested a review from a team as a code owner July 11, 2025 18:43

kporter101 requested a review from stuti-sr July 11, 2025 18:43

kporter101 force-pushed the VAULT-31185/remove-artifactory-usename branch 3 times, most recently from 6543d34 to 1f75fcc Compare July 14, 2025 19:25

kporter101 added the pr/no-milestone label Jul 14, 2025

kporter101 force-pushed the VAULT-31185/remove-artifactory-usename branch from 1f75fcc to 59d026a Compare July 14, 2025 20:00

ryancragun reviewed Jul 14, 2025

View reviewed changes

ryancragun added backport/ent/1.16.x+ent Changes are backported to 1.16.x+ent backport/ent/1.18.x+ent backport/1.20.x backport/ent/1.19.x+ent labels Jul 14, 2025

kporter101 added the pr/no-changelog label Jul 15, 2025

kporter101 force-pushed the VAULT-31185/remove-artifactory-usename branch 2 times, most recently from 561a4dc to e02156c Compare July 22, 2025 18:38

kporter101 force-pushed the VAULT-31185/remove-artifactory-usename branch from e02156c to 4e85cd0 Compare July 23, 2025 19:14

vercel bot had a problem deploying to Preview – vault-ui July 23, 2025 22:20 Failure

vercel bot had a problem deploying to Preview – vault-ui July 23, 2025 23:04 Failure

kporter101 force-pushed the VAULT-31185/remove-artifactory-usename branch from ddc315a to dc8bbbc Compare July 24, 2025 00:51

vercel bot had a problem deploying to Preview – vault-ui July 24, 2025 00:51 Failure

ryancragun reviewed Jul 25, 2025

View reviewed changes

enos/enos-dev-scenario-pr-replication.hcl Outdated Show resolved Hide resolved

removed artifactory_username

056e6a0

kporter101 force-pushed the VAULT-31185/remove-artifactory-usename branch from dc8bbbc to e8efa40 Compare July 25, 2025 20:14

vercel bot deployed to Preview – vault-ui July 25, 2025 20:14 View deployment

kporter101 added 4 commits July 25, 2025 16:48

updated artifactory token

b884bf2

ran enos fmt

a91a48d

ran terraform fmt

0f34404

debugging/ testing - pinned enos version, added null username

7b5e964

kporter101 force-pushed the VAULT-31185/remove-artifactory-usename branch from e8efa40 to 7b5e964 Compare July 25, 2025 20:49

vercel bot deployed to Preview – vault-ui July 25, 2025 20:49 View deployment

byyyyy

f2d21c4

vercel bot deployed to Preview – vault-ui July 25, 2025 20:53 View deployment

ryancragun approved these changes Jul 25, 2025

View reviewed changes

		@@ -0,0 +1,3 @@
		```release-note:change
		secrets/artifactory: Use Artifactory identity token for auth, instead of username with API key

VAULT-31185 & 31186/use identity token auth for Artifactory in Vault CE & Ent #31255

Are you sure you want to change the base?

VAULT-31185 & 31186/use identity token auth for Artifactory in Vault CE & Ent #31255

Conversation

kporter101 commented Jul 11, 2025

Description

TODO only if you're a HashiCorp employee

PCI review checklist

Uh oh!

github-actions bot commented Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ryancragun left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ryancragun commented Jul 14, 2025

Uh oh!

vercel bot commented Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ryancragun left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ryancragun left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jul 11, 2025 •

edited

Loading

github-actions bot commented Jul 11, 2025 •

edited

Loading

vercel bot commented Jul 23, 2025 •

edited

Loading