Skip to content

Commit 9bf1230

Browse files
xnotoxnoto
authored
chore: drop unused Grafana token; rotate CF service token secret (#17)
## What - **`secrets.yaml`**: carries the rotated `cloudflare_auth_client_secret`. The GitHub Actions service token had **expired 2026-06-03** (1-year duration, never successfully used) — diagnosed via Cloudflare API (`last_seen_at: null`), rotated, and duration set to `forever`. This unblocks every Cloudflare Access machine-auth consumer, including the Dependabot alert path. - **`main.tf`**: drops `grafana_alerts_token` from the secrets map — unused after the Alertmanager pivot (Grafana 12 cannot ingest external alerts into the embedded AM). - **`AGENTS.md` / `gh-dependabot.tf`**: docs updated for the Alertmanager delivery target. - README regenerated. On apply: `GRAFANA_ALERTS_TOKEN` is **deleted** from all repos and `CLOUDFLARE_AUTH_CLIENT_SECRET` is updated org-wide. ## Validation `make test` clean. Token values handled in-subprocess only (kubectl/sops set), never exposed. ## Merge order **Last**, after shared-workflows#15, kustomize-cluster#55, tfroot-cloudflare#21.
1 parent 42dea73 commit 9bf1230

4 files changed

Lines changed: 21 additions & 30 deletions

File tree

‎AGENTS.md‎

Lines changed: 13 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -63,24 +63,19 @@ Dependabot: they are owned by the canonical config in
6363

6464
When Dependabot opens a PR, the managed caller workflow
6565
(`.github/workflows/dependabot-notify.yml`, from `gh-dependabot.tf`) invokes
66-
the `dependabot-notify` reusable workflow in `shared-workflows`, which posts a
67-
synthetic alert to the cluster Grafana's Alertmanager API. Delivery goes to
68-
Discord via the `GrafanaContactPoint`/`GrafanaNotificationPolicy` CRs in
69-
`kustomize-cluster/workloads/grafana`.
70-
71-
Two secrets make this work, both distributed here to all active repositories:
72-
73-
- `CLOUDFLARE_AUTH_CLIENT_ID` / `CLOUDFLARE_AUTH_CLIENT_SECRET` — the existing
74-
"GitHub Actions" Cloudflare Access service token, allowed by the path-scoped
75-
Access app managed in `tfroot-cloudflare/cf-access-grafana.tf`.
76-
- `GRAFANA_ALERTS_TOKEN` — a Grafana service account token. The account and
77-
token are managed as code by the `GrafanaServiceAccount` CR in
78-
`kustomize-cluster/workloads/grafana/serviceaccount-alerts.yaml`; the
79-
operator writes the generated token to the `grafana-alerts-token` cluster
80-
Secret (key `token`). Until that value is copied here into
81-
`secrets/secrets.yaml` as `grafana_alerts_token`, the distributed secret is
82-
a placeholder and alert delivery fails with a 401 in the caller repo's
83-
Actions log.
66+
the `dependabot-notify` reusable workflow in `shared-workflows`
67+
(`.github/workflows/_dependabot-notify.yml` — the underscore path keeps it
68+
clear of this managed file's target, which is written to every repository
69+
including `shared-workflows`), which posts a
70+
synthetic alert to the cluster Alertmanager (`alertmanager.makeitwork.cloud`,
71+
kube-prometheus-stack) behind the Cloudflare Access app managed in
72+
`tfroot-cloudflare/cf-access-alertmanager.tf`. Delivery goes to Discord via
73+
the Alertmanager config Secret in `kustomize-cluster/operators/kube-prometheus-stack`.
74+
75+
The only required secrets are `CLOUDFLARE_AUTH_CLIENT_ID` /
76+
`CLOUDFLARE_AUTH_CLIENT_SECRET` — the "GitHub Actions" Cloudflare Access
77+
service token, distributed here to all active repositories. Alertmanager has
78+
no auth of its own; the Access app is the only gate.
8479

8580
## Related Repositories
8681

‎gh-dependabot.tf‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,11 @@ resource "github_repository_file" "dependabot" {
7272

7373
locals {
7474
# Caller for the dependabot-notify reusable workflow in shared-workflows.
75+
# The reusable lives at _dependabot-notify.yml because this file's target
76+
# path is managed in every repo, shared-workflows included; a reusable at
77+
# the caller's path would be overwritten by this resource on every apply.
7578
# Fires only when Dependabot itself opens the PR; posts a synthetic alert
76-
# to the cluster Grafana (see AGENTS.md, "Dependabot PR Alerting").
79+
# to the cluster Alertmanager (see AGENTS.md, "Dependabot PR Alerting").
7780
dependabot_notify_workflow = <<-EOT
7881
---
7982
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
@@ -88,7 +91,7 @@ locals {
8891
jobs:
8992
notify:
9093
if: github.actor == 'dependabot[bot]'
91-
uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
94+
uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
9295
secrets: inherit
9396
EOT
9497
}

‎main.tf‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -91,13 +91,6 @@ locals {
9191
value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"]
9292
repositories = local.active_github_repositories
9393
}
94-
"grafana_alerts_token" = {
95-
name = "GRAFANA_ALERTS_TOKEN"
96-
# Placeholder until the operator-generated token is copied from the
97-
# cluster (see AGENTS.md, "Dependabot PR Alerting").
98-
value = lookup(data.sops_file.secret_vars.data, "grafana_alerts_token", "pending-grafana-service-account-token")
99-
repositories = local.active_github_repositories
100-
}
10194
"ssh_private_key" = {
10295
name = "SSH_PRIVATE_KEY"
10396
value = data.sops_file.secret_vars.data["ssh_private_key"]

‎secrets/secrets.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
ssh_known_hosts: ENC[AES256_GCM,data:y20mxN9b7SCSj7hIulROnBLSexKbUU/ZNNualdPUFJt+msbCJGeQzQIpk7rVYjCWv2f9XyJJd5cToY7N53h/B6Djtr04EcS7hMaYAMbSIgKtoqWqEOhyzT9zMzzHdnevYWCFwfNg1mO1SPhgYl66ETBv+sp5OqXH3/2ISBOikN7KnruFoGYZBAhTTd0RX5/4UigkH3SbTj6H/fLYfKJr8MIuQdxfQUJyDfY3fVpHCwh4rARUlWgi4cJopjqC0UjWZ86MgByECENOt5a+7WeTl+GOdL0gpzWcztFC7Ae3x838tfQrjSaoZ1nxI4rPgyvzfy8evmV7bfXvjmrDcONxydG7gCfMCa2FBbwIYgsFR4WDnG56zcOXY1LVf7eVBXwl7GGRA3ML2+rboG2eeiuObZ5OjvlNx27PCeWTe4tB1dwOpZeJpt3AFoeF1nllSL+DreGKsGMS2pvY6dfQNZlQGu1cEqIcYA2akVbvn5k=,iv:MYug0wz3seQsEM+Jk9NQY6sEhLIDOTgqnF9h9MKSp5w=,tag:ZagIn9+s0o+nWvG/0tbjrA==,type:str]
22
ssh_private_key: ENC[AES256_GCM,data:jwLxp5hbbZBeclwGLVjfIWQlRC2CGLjv8p+0buE2DqnazqobSY68wEGuvh/a+LSIgCpWLLnmBOO9H954wgzpQ2wWpH8R+oCe7OzeBvprFbvDthmQMSymW0HJ+XKwcMzkwuLtquN0oAS0GJbsfTUuqhSVrAZeNynnrUc5II8ItwZImZnlmNNCyX79QRiQ7QQlE0SSFWKSn+vyNRvw5RA0a0/FGxccyW+hFXvpuTlVr2hzxmOZiiXMBD99tRlAavT0gKCVxCEKqDcrdwkrifTZsNTxYP1NiTSMuXfsxfCoqrUMJOi/h0QGzzIpdsQnLn5908h4J8ehV/pxYlYFy5Z6hdyXk5wIu4IsegDG5lfYd+nF9p85ydGniFIK9IKTAp+J0gjN9CEEg7QfmSh/VCJ6anEKQf6HdqiQjOqeEDth8zWX/Ds8WxYpWZNX+DQqokVL2scNziesgOvx7ixHwHKx+nTcgFlDk0E/GaqWVmK4vBhdC2vWVni1IcMlxvs+NzE/drP+I9IhxR2X4r8Z/ZDXwiImfsvbE8ITSkVxyc1Yr8w+Dhq6Xx2VwL/tklU5WtX63F67Bao8F90e752l3rNyfAB/8A6oQKMY/HBKmnT9r5egDu9eE9OFoNDEqW2Zhvu+9Hc++CYJ+CrJYYaknITJP37ai/eWJkPQCTCJC4y24nETtz3j8fAaMsRrVdbeFiKxwQ0m5S+h/IEnZ9+atQqU+COqIFetDJ196ZsUhuWB4CpWzNEeloiqjSQIofnjjFgeF6L3hN1tYP+ajwar9pvnO7/boGTvGDGLaPHWzcx4wSVmqbHai3gM/UhS5mvkubcNg2S6HyIz1vOzmxbOQUDn8364NFwMPv7+rbcVYVMvcKfIrL5NDtqj6XkO3CPvGLxO/B13u4SwC16cwO1nyfG2qw4tHAhBYJLz0tyaY46L9PRLemPzQxF5+lfzlAPTMgjcTSnfnPvBu7w1vU14XWRlawOps1TatVUnO9Z0ZmyDsKq6JahpV5iuK3xXfRMTd0DQJboLVjM6TgqYvB2dIFmlFfs2QEAIgP/ZDM9ah7NiMqVol1x7c7iM1dcaekKu84fARCYU0d38IhQM3aLvVSIE49DxEfc+1S8FpWwA8otbqzUz3FrWzbIvf3Orchrgr/aeOprusRwIU4Bpc201p9MSdcAH9OeHbyQH7ICrtHObojWAQalG4SPIWMFH2BQP+t/gjTMgJTzedqjJRrw67tHQnA1f0nAKzdhsVX0cc+55/BIP7078hhuQ+2RKypKARvp+I9JKIEtj50SBHy7OWFpu9L+pRLuVTrC3tYkdsg082yP4ybtfL8c05Sh6EZb3jETlYnvyT0GZboElaYBwJgpf310Kw01KxpLw0aJVdYc5CArZPGgcVMtGX73zkzwPjjSJGBIoiKEkxGYn0OVBrx0L7NeVyYPLvxODGHvO8ZWwhcfaBqaKKO78LrzFOnmD40VRqbd/3nCUCavE6Q2QNZPhN3l/eXocUBMG60rE2cC2OP2kxpVJIqUg29jrRFRlU7/DvA2bCHtaa7yT5uWLsKjRyY0oVOOb0UerhH3rtRMOfF/29OA0YoqmrgjtRe3rF2eRP9sxKkbBaa3rWmT4whGhDU0J96H4xGD6GshNO2gbHfgOVkAUYP7UJteCqnwTdXlXhb+rAROc+P5vseNmrBKz5E5ekocPE+Fp6L7Css0TSgkgCxlZcla5gVOlOzrHaCvsXdo+LhaoDY1y8JU8KoSA/kfWMVj6LZWWevX8S/GgQybFmnRVY+HU3Gx5F4JeFYsNtuvS0JqV3xIEdnlibYNNwEQwArazUSRtY/Z+RjD2evmJKNHVj/s27mqmLTm6qsXsCgA9kVigr2Nfk2NGdF4oEPZC2d41U31F59TdDi0hzELXFXoYv3C3bEH4NNr2CySfMDki2S+C3ayRwoQxsgdN+Pb/I87ymku8oqrw8xzz6l+ykqjf4zjHFRyWwDsB01PFV6QgDDn/NW+pUUBK7/60kmTAh83Nhnotba19ydh35CaiHQjzqHAnTHSJZfzIi7Am6Ybt+HZv0bOzZ7UmQCcPSqBxmQcgx7O+o0v/hUA1yAx1j9szs604hwy7bViHH32y18sODq2Hm1EcQgwdLzRier67YS9532O5mx0NnXWQsZ2c2ujPMWyKRb3zb5KEsbCrPOJ1rWCDsflZqAzP/XULS7/Huik8ykJLUwI+2PX6vuq0T+/UGjMPR2VUAt6z5Ilv//KSehJM0VPmQ4WtQUMQg7gzo4qWYeGFIB5UfNpz0frKUZk8/NN8FFzxU1/HrcJMgGo1Tzi3TD8lw/yY5b0MuYwcGdf0K8iipJ3gjJDMHnFWDw3srWDvhlbwRhNEtZCRUUhWdvpOM7CJCgpL8TYtF4knRQdA0W2VztK4lrqmvDVyyuWOUAqFyWxca2X/9ooylWf/aRUItSpLU5OTpnT6JEC/nKganTND6p2mNdP0keBJgPM5Tbt0/Oq7itM20GRP3l1LdjuB3ED1WRwWJi0+sV6yBIMq8DbfYSzI835VDqorqVYN/Wj5zcG/clJGwXuyEC9oZgDa/QLKD66SjvjBit1fyqMkKJrtrEjDTA17UmSipGk37n1I0PSuHfBiuMcLg8OttEqa1gWasZJZCgR9nuRYkW+ph2rOK4VfgGunQo2gKqwgsaM2ksITcz95AjWuHJhcQ/YDhAdUIJmYe8aHoky+xEc3Htp3l1k6x9o+3LfEoOdJJo/WSE+/fpb/iRJhMMaQpkE4dP0NzMBcxr1Evr4HRqacaAPmidFkcjVePf3TKf0SlF4JMvjMaC9Gb2MiN9fnL9jynWpy3ubaGOgdW4E5Q5vtm0/9baIcnBv4UVdGPUWtXYZ9oWVCuOc1sG47TrphaQwFDxD60usH9TBFHkwiwpQ8Hz9h1+phdcTz1OiJXBuQ3DwXdX41C088tRGpNajK5bAY6mUvmVC+Q7yiMtXf0YDo4iRpuOJgPhqdi2Hv6hnD8AUFn7fWKunDlUpxKnfrwR9jwfiClozH4dw+xF0p4dZKr4wuKxZtgHQcuQEQMXld+MvcCiwLmnGLM0cMsZ3kcaRiBK6QrXG1IZj7MzAaC7YIFxrhpKPTD+bk0JlVW1V2omBI/imG5yWnXbCCmkDD8T2tWhy9vtNCOzh/mjE2FtVV5C3kSLbMOLpQOmX77qzi9YNZQPgtNoiyW5Pws3j9H7+PqSizxM/NvLE8aI/A20bvdO/2fcdvI/+QGwHPYZTd/E5n1GQ2xi1RB/bbfk/vFqAGNe+0Z7vQZjuL3MVekvFyfHlX3EZ+APrQ0R9Z83L1lOd5loJKuJKFZlPU/C6FFeN+Q0SZl1zlppm/+xN52KrZQa1u32DZGD4iv8084nBmBJ/scOfR8I9nqJ/sBFsPycnYqUNvNNJ9LmcNKYIA8Bk6ROvd1+Tf1wJQwFgXLg6YfDRCVlBJpSmy6lLmJ6w9pxES7n+MeGTcoHBLvy/oGpUVk85Alc4Ui4u7NEi75Gbm57zKvSzZDKQ27jCqX7KfULOxjhuF/rTLAFD9M2SgGtnCnwJZsRzLYAxXhgptYlSNdRplSGU3q2m5wXFbDvJZtrFAtyACEo/bSenQQxKSzzSCEWITEn56kVxd/gqgjo2+z9JljHSzs+JM7mRDyYD8MhemREcd6REbgbM6AH1U9fBlWTkZhVmpHSM80dGWlQ8BrUHLWlrvhghSma/NbBWAokmE/iThQCy1IwqIwtDhRdUM29hTHQzljxoiBuv1XMkE0rrKhAYTzRO/n/2bKqkIJ5Tq3DAjg2WC9t4XYSWXtSsZKyiz7XS1PzhwViJ9um/KBy2tykSJKqUShnu2Oo2bJvw3sU5vUKcedrxoFT+qbR6iFsS1K/b0u56dPikFWEoM+Kqi4h/WG2s0pKoBVZ0HKYdeju4M/Z24Sa2ue2bR8bqWCushGFEK+ZKbpJR4Z1l9e2+s2aUm2HJts40xls+3yOb8/IjvfFMBmfvv7cNJN9set1uVm+kolDtCI6oP451E+ie3DB6F0wyJhxV0BQOjzFiMusNiKR/BYqNdV0kJnNsPG+76aJkYziPfKplFA3h97XN5rAUf7zd47e5Nq2c5fkA7JODxNdWrAgMYD3tklTbp59zbwOY/eSV6ERpldBOH8/GRshPVEXZdqaIqxuQLeyceCx/YbD05nlxYhyLEu256Uc3dnaDTWBCGeNHW7hh09CD0OE63UTsoT+l4SwcB5eTi4YrQOHFy0ZNq219azkbmFyNgI88qHpw+yFyZgKaWz+BIavjOVKmygHpH/3lnQwgoOuD7IaMwyt1pkDrtkPlIooinFm4SQ5Ng+x9lD07J+jtXkHkQiMvELsUJtchgoL4FOIN/8TxfoGs3OBVe0C+IXYd/Xb49Gl6hLUtRlQDXfJKX+OA8+rImOWriXTZlZWbzYx3LQUnLOvNo2OX8s4xIHrb7h7Kef4QGOXgrP92c9F+iNdSot//sVDoCQc+PXRYa97W+,iv:EcjD0Rh76XFRumSkjAjOH4kK9gIE8xeoIk2WL2yCPyE=,tag:VbjPyVrmGBqXJPnTJzjd5Q==,type:str]
33
cloudflare_auth_client_id: ENC[AES256_GCM,data:ik69sQhJwg2paYUowWq6HIHL/0OKGhICSXESNULdwrlnG4OnJ6mX,iv:bKexr9xu/zYA7nYZYx9fEQF1kMSi/vUYWbQi2UTh2dk=,tag:HWvZQagx95eI3D/83oEL3w==,type:str]
4-
cloudflare_auth_client_secret: ENC[AES256_GCM,data:oqD9lnwf9wSoS9IZBB0ILzZJq9sYPaOcAD+6aZSbVHuJDUnR3QZJweddWK1FxGw1u4eT7LICFL5v5mu9WEFk9Q==,iv:WjX32HfZJAD1pt5sYJmmtLPCCZ9vs3hdA4XSshXPBmg=,tag:LI5D10qlhWhn8lSQjLtTnw==,type:str]
4+
cloudflare_auth_client_secret: ENC[AES256_GCM,data:cYP+ZBzdTw38l3FzgP0Z2Dj8KHUlduKpGPxFLEd4Xdo94Z9AyHM+54Ho3yGBq1fZ382G5C+Ug/EBMYzZMIvNWw==,iv:EIoR7w0qS+lbuedVoj5HZMCH5g4dgFYmaNs8hHTofNM=,tag:VfPsPSo7BFHqrIkHxwo1JQ==,type:str]
55
s3_bucket: ENC[AES256_GCM,data:zBVdG+sJNkgrdRw7iXh5GvliwNc=,iv:6CvZGNRKGjeC0b/Sig2eq8ROmqyHZZcqYRhVynqUG4c=,tag:N5khlbQVW87ywVNU3jMSOA==,type:str]
66
s3_key: ENC[AES256_GCM,data:XqPuz071oUsHTSMgFKBqCi0=,iv:0WuTD4F7y5by9SUIjIyVIlM6mIt8OgR9WHT/v50lAqY=,tag:l1C/p4mQ7rkQhlSPnF3xYQ==,type:str]
77
s3_region: ENC[AES256_GCM,data:s9mEEbAkYXUo,iv:+LGva6jpgQLOZJ7SEWB+im+pNKMnIJgzFl4fzjE5H8c=,tag:E6JVicVvHBSaFtvLZJp2tg==,type:str]
@@ -26,7 +26,7 @@ sops:
2626
aws_profile: ""
2727
created_at: "2026-06-19T04:16:52Z"
2828
enc: AQICAHj1IggLFhM4nJnKEvmbEpk5E9RxZZoxpZYUW0taoyrz1AF/kg94UKFDzajWL4wI8KwkAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMmVOJEF56prSE5mcxAgEQgDt27+5rh3R0yvgpohI7YEEeZqxAJQiRdIomE22ohFcv2WGRfPXvbh43PlSwUAekZwmkLMM440d0Pu8zcA==
29-
lastmodified: "2026-08-24T15:30:58Z"
30-
mac: ENC[AES256_GCM,data:ntytB4EW4Oo3YaKoqi0BsOy6Ij4HRE6PJ+bEKXiS3pHpIww1OVFPAYWRJPosPpkn7AYX1iSF7p+w16FJs5vKqek2hnP4wWzDzWqbbFhJAurBEjwWilLi/Phxc5SArJsWghA8UMl4g6FkRBlYC6S4pnfsmX/t0bGtIDQasVZPLU0=,iv:xTKf3t/71gvLP/ygJLbiTtOTN/9ahs55hv6wE5LYB0o=,tag:X6oDOiXdp77v3dgIQD2gVw==,type:str]
29+
lastmodified: "2026-08-24T15:45:47Z"
30+
mac: ENC[AES256_GCM,data:X7y3yiyl4M8UNmDQVPP6Y8djAuBnh1eK64vwR/qzlldyX1UXu1l0Q974nwZLTfH/lPsCN2KJIFQVD8y0st5SOhmnWR2nrWiw/5ktykaZ/dU7A/QFNPjHfgnvznXGySXiiuavLYtCKzhT0cpZRzQpfRO0D8fCflUj4H+nT0TDJ1M=,iv:v/953DlmuApxQEtMYU8wAokA0lq+Z2RDOZj9e1tfHc4=,tag:hmLkOgL9ecm9B9vfukk5wQ==,type:str]
3131
unencrypted_suffix: _unencrypted
3232
version: 3.12.2

0 commit comments

Comments
 (0)