harnesssolutionfactory/harness-token-rotation

•Updated 1 day ago

Image

10K+

harnesssolutionfactory/harness-token-rotation repository overview

⁠Harness Token Rotation Plugin

A comprehensive container-based tool for automated rotation of Harness API tokens with seamless secret management integration. This plugin automatically rotates service account tokens, updates corresponding secrets, and maintains security best practices by removing expired tokens.

⁠Overview

The Harness Token Rotation Plugin provides automated lifecycle management for Harness API tokens by:

Token Rotation: Automatically generates new API tokens for service accounts with configurable naming
Secret Management: Updates Harness secrets with newly generated tokens
Cleanup Operations: Removes expired/old tokens to maintain security hygiene
Multi-Architecture Support: Native support for amd64 and arm64 platforms
CI/CD Integration: Built as a native Harness plugin for seamless pipeline integration

The plugin is designed to run as part of scheduled pipelines or triggered workflows, ensuring your service account tokens remain fresh and secure without manual intervention.

⁠Key Features

Multi-Architecture Support: Docker images built for amd64 and arm64 architectures
Automated Token Lifecycle: Complete token generation, rotation, and cleanup in a single execution
Secret Synchronization: Automatically updates Harness secrets with new token values
Service Account Integration: Works with Harness service accounts and personal access tokens
Security-First Design: Removes old tokens after successful rotation to minimize exposure
Comprehensive Testing: Full unit test coverage with pytest framework
CI/CD Ready: Native Harness plugin support with pipeline examples
Configurable Naming: Supports dynamic token naming with pipeline variables

⁠Environment Variables

⁠Core Configuration

These variables are required for all operations:

Variable	Description	Required	Default	Example
`PLUGIN_SWITCH`	Operation mode: `main` and `rotate`	No	`main`	`main`
`PLUGIN_HARNESS_URI`	Harness platform API base URL	Yes		`https://app.harness.io`
`PLUGIN_HARNESS_ACCT`	Harness account identifier	Yes		`HT1234569XFhhslllddd12`
`PLUGIN_HARNESS_API_KEY`	Harness API token with service read permissions	Yes		`pat.example123...`
`PLUGIN_DEBUG_MODE`	Enable debug logging for troubleshooting	No	`false`	`true`
`SSL_VERIFY_X509_STRICT`	Enforce strict adherance to the SSL RFC5280	String	all

⁠Token Configuration

Controls token rotation behavior:

Variable	Description	Required	Example
`PLUGIN_API_KEY_TYPE`	API key type: `SERVICE_ACCOUNT` or `USER`	Yes	`SERVICE_ACCOUNT`
`PLUGIN_PARENT_ID`	Parent RBAC identifier (service account or user identifier)	Yes	`harness_platform_manager`
`PLUGIN_API_KEY_ID`	API Key identifier under the service account	Yes	`platform_manager`
`PLUGIN_NEW_TOKEN_REFERENCE`	Unique identifier for the new token	Yes	`auto_token_123`
`PLUGIN_TOKEN_ORG_ID`	Organization ID containing the token	No	`Harness_Platform_Management`
`PLUGIN_TOKEN_PROJECT_ID`	Project ID containing the token	No	`Solutions_Factory`

⁠Secret Configuration

Controls secret update behavior:

Variable	Description	Required	Default	Example
`PLUGIN_SECRET_ID`	Secret ID to update with new token	Yes		`hsf_platform_api_key`
`PLUGIN_SECRET_ORG_ID`	Organization ID containing the secret	No		`Harness_Platform_Management`
`PLUGIN_SECRET_PROJECT_ID`	Project ID containing the secret	No		`Solutions_Factory`
`UPDATE_SELF`	Should the new token be used once the rotation is complete to then delete old token. Requires 'core_secret_edit' and 'core_serviceaccount_manageapikey' permissions on the token.	No	`false`	`true`

⁠Harness Plugin

This image supports the Harness plugin configuration

⁠Account Token with Account Secret with Self-Updating

steps:
- step:
    type: Plugin
    name: Rotate Token
    identifier: Rotate_Token
    spec:
        connectorRef: account.harnessImage
        image: harnesssolutionfactory/harness-token-rotation:latest
        settings:
            SWITCH: rotate
            HARNESS_URI: https://app.harness.io
            HARNESS_ACCT: <+pipeline.variables.hsf_account>
            HARNESS_API_KEY: <+secrets.getValue("HARNESS_API_SECRET")>
            API_KEY_TYPE: SERVICE_ACCOUNT
            PARENT_ID: harness_platform_management
            API_KEY_ID: platform_automation
            NEW_TOKEN_REFERENCE: auto_token_<+pipeline.sequenceId>
            SECRET_ID: hsf_platform_api_key
            UPDATE_SELF: true

⁠Account Token with Organization Secret

steps:
- step:
    type: Plugin
    name: Rotate Token
    identifier: Rotate_Token
    spec:
        connectorRef: account.harnessImage
        image: harnesssolutionfactory/harness-token-rotation:latest
        settings:
            SWITCH: rotate
            HARNESS_URI: https://app.harness.io
            HARNESS_ACCT: <+pipeline.variables.hsf_account>
            HARNESS_API_KEY: <+secrets.getValue("HARNESS_API_SECRET")>
            API_KEY_TYPE: SERVICE_ACCOUNT
            PARENT_ID: harness_platform_management
            API_KEY_ID: platform_automation
            NEW_TOKEN_REFERENCE: auto_token_<+pipeline.sequenceId>
            SECRET_ID: hsf_platform_api_key
            SECRET_ORG_ID: Lab
            UPDATE_SELF: false

⁠Project Token with Project Secret

steps:
- step:
    type: Plugin
    name: Rotate Token
    identifier: Rotate_Token
    spec:
        connectorRef: account.harnessImage
        image: harnesssolutionfactory/harness-token-rotation:latest
        settings:
            SWITCH: rotate
            HARNESS_URI: https://app.harness.io
            HARNESS_ACCT: <+pipeline.variables.hsf_account>
            HARNESS_API_KEY: <+secrets.getValue("HARNESS_API_SECRET")>
            API_KEY_TYPE: SERVICE_ACCOUNT
            PARENT_ID: harness_platform_management
            API_KEY_ID: platform_automation
            TOKEN_ORG_ID: Lab
            TOKEN_PROJECT_ID: workshop
            NEW_TOKEN_REFERENCE: auto_token_<+pipeline.sequenceId>
            SECRET_ID: hsf_platform_api_key
            SECRET_ORG_ID: Lab
            SECRET_PROJECT_ID: workshop
            UPDATE_SELF: false

Tag summary

Recent tags

Content type

Image

Digest

sha256:30b92c6e8…

Size

66.4 MB

Last updated

1 day ago

docker pull harnesssolutionfactory/harness-token-rotation