From 4e7dca90931864547a9a4328197d7353e3b57a6f Mon Sep 17 00:00:00 2001 From: John Hooks Date: Tue, 12 May 2026 11:10:55 -0400 Subject: [PATCH 1/2] update capability for artifactory readme --- artifactory-automation/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/artifactory-automation/README.md b/artifactory-automation/README.md index 87232ded..0f99b545 100644 --- a/artifactory-automation/README.md +++ b/artifactory-automation/README.md @@ -9,7 +9,7 @@ Create a role that matches the registry.pull_token_creator role. > [!IMPORTANT] > If you want to enable pruning of expired pull tokens, you must add identity.list and identity.delete capabilities. -`chainctl iam roles create artifactory --parent --capabilities apk.list,groups.list,identity.create,manifest.list,manifest.metadata.list,record_signatures.list,repo.list,role_bindings.create,roles.list,sboms.list,tag.list,vuln_reports.list,identity.list,identity.delete,apk.blobs.get,repo.blobs.get` +`chainctl iam roles create artifactory --parent --capabilities apk.list,groups.list,identity.create,manifest.list,manifest.metadata.list,record_signatures.list,repo.list,role_bindings.create,roles.list,sboms.list,tag.list,vuln_reports.list,identity.list,identity.delete,apk.blobs.get,repo.blobs.get,referrers.list` Create the assumable identity From c170847be59c81b633ebd474d9105b6244f14c4f Mon Sep 17 00:00:00 2001 From: John Hooks Date: Tue, 12 May 2026 12:00:52 -0400 Subject: [PATCH 2/2] update to use built in role --- artifactory-automation/README.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/artifactory-automation/README.md b/artifactory-automation/README.md index 0f99b545..0221bf38 100644 --- a/artifactory-automation/README.md +++ b/artifactory-automation/README.md @@ -5,15 +5,17 @@ Workflow that will automate the creation and updating of pull tokens to allow cu For this workflow to run properly, you will need to create an [assumable identity](https://edu.chainguard.dev/chainguard/administration/custom-idps/custom-idps/) beforehand. It will need a role with the correctly scoped permissions. ## Creating the Role and Identity -Create a role that matches the registry.pull_token_creator role. +Create a role for artifactory that can create and delete pull tokens. > [!IMPORTANT] > If you want to enable pruning of expired pull tokens, you must add identity.list and identity.delete capabilities. -`chainctl iam roles create artifactory --parent --capabilities apk.list,groups.list,identity.create,manifest.list,manifest.metadata.list,record_signatures.list,repo.list,role_bindings.create,roles.list,sboms.list,tag.list,vuln_reports.list,identity.list,identity.delete,apk.blobs.get,repo.blobs.get,referrers.list` +1. Create a role with identity.delete capabilities: +`chainctl iam roles create token-delete --parent --capabilities identity.delete` -Create the assumable identity -`chainctl iam identities create github artifactory --github-repo= --parent= --role artifactory` +2. Create the assumable identity and bind the token-delete role: + +`chainctl iam identities create github artifactory --github-repo= --parent= --role=token-delete,registry.pull_token_creator` ## Example Workflow