{"id":50886125,"url":"https://github.com/hops-ops/authstack-reconciler","last_synced_at":"2026-06-15T17:02:49.023Z","repository":{"id":357852034,"uuid":"1238277529","full_name":"hops-ops/authstack-reconciler","owner":"hops-ops","description":"In-cluster reconciler for hops-ops/auth-stack — manages operational PATs against an existing Zitadel install.","archived":false,"fork":false,"pushed_at":"2026-05-14T14:57:10.000Z","size":36,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-14T15:44:47.273Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hops-ops.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-14T01:28:01.000Z","updated_at":"2026-05-14T14:55:36.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/hops-ops/authstack-reconciler","commit_stats":null,"previous_names":["hops-ops/authstack-reconciler"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/hops-ops/authstack-reconciler","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Fauthstack-reconciler","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Fauthstack-reconciler/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Fauthstack-reconciler/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Fauthstack-reconciler/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hops-ops","download_url":"https://codeload.github.com/hops-ops/authstack-reconciler/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Fauthstack-reconciler/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34372130,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-15T02:00:07.085Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-15T17:02:48.085Z","updated_at":"2026-06-15T17:02:49.018Z","avatar_url":"https://github.com/hops-ops.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# authstack-reconciler\n\nIn-cluster reconciler for [`hops-ops/auth-stack`](https://github.com/hops-ops/auth-stack)'s\noperational Personal Access Tokens (PATs). Runs as a CronJob in the\nAuthStack install namespace; reads the iam-admin machine key,\nauthenticates against Zitadel via JWT bearer, and ensures each managed\nPAT Secret carries a valid token — minting fresh ones via the\nmanagement API when an existing value is missing or has been rejected.\n\nSee [`hops-ops/auth-stack` spec `specs/authstack-reconciler`](https://github.com/hops-ops/auth-stack)\nfor the full design (durable vs operational secret split, how this\nfits with ESO `ExternalSecret` + `PushSecret` for capture-and-restore,\nand the loss-scenario recovery paths).\n\n## Configuration\n\nThe reconciler is configured entirely via environment variables — set\nby the CronJob spec composed by the AuthStack XRD. No flags, no config\nfiles.\n\n| Env var | Required | Description |\n|---|---|---|\n| `ZITADEL_BASE_URL` | yes | In-cluster URL of the Zitadel API (e.g. `http://\u003crelease\u003e-zitadel.\u003cns\u003e.svc.cluster.local:8080`). |\n| `TARGET_NAMESPACE` | yes | Namespace holding the managed Secrets. |\n| `MACHINE_KEY_SECRET` | one-of | K8s Secret name holding the iam-admin machine key JSON (the chart writes this on first install). The reconciler reads, signs a JWT, and exchanges for an access token. |\n| `ZITADEL_ADMIN_PASSWORD_SECRET` | one-of | (Fallback, not yet implemented) K8s Secret holding the human `zitadel-admin` password — used when the machine key isn't available. |\n| `ZITADEL_ADMIN_USERNAME` | no | Human admin username for the password fallback. Defaults to `zitadel-admin`. |\n| `IAM_ADMIN_PAT_SECRET` | optional | Secret name for the iam-admin PAT. |\n| `IAM_ADMIN_USERNAME` | with above | Login name of the iam-admin machine user. |\n| `LOGIN_CLIENT_PAT_SECRET` | optional | Secret name for the login-client PAT (required for the login UI pod's volume mount). |\n| `LOGIN_CLIENT_USERNAME` | with above | Login name of the login-client machine user. |\n\nAt least one of `MACHINE_KEY_SECRET` / `ZITADEL_ADMIN_PASSWORD_SECRET`\nmust be set. At least one managed PAT pair\n(`*_PAT_SECRET` + `*_USERNAME`) must be set.\n\n## Behavior\n\n```\n1. Wait up to 5m for /debug/ready\n2. Authenticate (machine-key JWT exchange)\n3. For each managed PAT Secret:\n   a. Read the K8s Secret\n   b. If `pat` key is present, validate via GET /auth/v1/users/me\n   c. If absent or 401, look up the user by username and mint a fresh PAT\n      via POST /management/v1/users/{userId}/pats\n   d. Write the K8s Secret with `pat=\u003cvalue\u003e`\n4. Exit 0\n```\n\nPushSecret (composed by the AuthStack XRD alongside this CronJob)\nmirrors any Secret write back to AWS Secrets Manager, so subsequent\ninstalls against a fresh K8s namespace recover via `ExternalSecret`\nprojection without needing a re-mint.\n\n## RBAC\n\nThe reconciler's ServiceAccount needs `get` on the machine-key Secret\nand `get`/`update`/`patch`/`create` on the operational PAT Secrets in\nits own namespace. The AuthStack composition renders the\nServiceAccount, Role, and RoleBinding alongside the CronJob.\n\n## Build\n\n```sh\ngo build ./...\ndocker build -t authstack-reconciler:dev .\n```\n\nPublished images: `ghcr.io/hops-ops/authstack-reconciler` (built by\n[`unbounded-tech/workflows-containers`](https://github.com/unbounded-tech/workflows-containers)\non push to main / version tag).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhops-ops%2Fauthstack-reconciler","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhops-ops%2Fauthstack-reconciler","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhops-ops%2Fauthstack-reconciler/lists"}