v0.1.0

vault-plugin-secrets-harbor v0.1.0

Vault secrets engine that issues short-lived Harbor robot accounts.

Install (binary)

curl -fsSLO https://github.com/corelyr-oss/vault-plugin-secrets-harbor/releases/download/v0.1.0/vault-plugin-secrets-harbor_0.1.0_linux_amd64.tar.gz
curl -fsSLO https://github.com/corelyr-oss/vault-plugin-secrets-harbor/releases/download/v0.1.0/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
tar -xzf vault-plugin-secrets-harbor_0.1.0_linux_amd64.tar.gz vault-plugin-secrets-harbor
install -m 0755 vault-plugin-secrets-harbor /etc/vault/plugins/
vault plugin register -sha256=$(sha256sum /etc/vault/plugins/vault-plugin-secrets-harbor | cut -d' ' -f1) -version=v0.1.0 secret vault-plugin-secrets-harbor

Install (OCI image, containerized plugin runtime)

vault plugin register -oci_image=ghcr.io/corelyr-oss/vault-plugin-secrets-harbor -version=v0.1.0 -runtime=<your-runtime> secret vault-plugin-secrets-harbor

Verify

cosign verify-blob --certificate SHA256SUMS.pem --signature SHA256SUMS.sig \
  --certificate-identity-regexp='^https://github.com/corelyr-oss/vault-plugin-secrets-harbor/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com SHA256SUMS

Changelog

Features

• 36ad116: feat: Harbor secrets engine for Vault/OpenBao (Vinzenz Stadtmueller vinzenz@nextpart.io)

Bug fixes

• d6a67fa: fix(ci): make Harbor's generated config readable for docker compose on Linux (Vinzenz Stadtmueller vinzenz@nextpart.io)
• 204ae9b: fix(ci): replace Harbor compose file via sudo cp instead of chown -R (Vinzenz Stadtmueller vinzenz@nextpart.io)
• 51d6d06: fix(ci): take ownership of Harbor prepare output before editing compose file (Vinzenz Stadtmueller vinzenz@nextpart.io)

Other

• 1b22810: chore: release v0.1.0 (Vinzenz Stadtmueller vinzenz@nextpart.io)
• dea1389: test(integration): cover project-level and system-level issuer robots; document Harbor 2.12 vs 2.13 robot-mode difference (Vinzenz Stadtmueller vinzenz@nextpart.io)

Harbor login action v0.1.0

Harbor login action v0.1.0

Logs in to Harbor with a short-lived robot account issued by the
Harbor secrets engine, and revokes it when the job ends.

- uses: corelyr-oss/vault-plugin-secrets-harbor/action@action/v0
  with:
    registry: harbor.example.com
    role: ci-pull
    vault-url: https://vault.example.com

Requires permissions: id-token: write for the OIDC path.
See action/README.md.

Verified in CI for this release

Component	Version
Runner	ubuntu-latest (GitHub-hosted)
Node runtime	node24
Vault	2.0.4
Harbor	2.15.2
Auth paths	GitHub OIDC (JWT) and supplied token