Introduction

Introduction to token-operator

token-operator is a token management tool. It supports GitLab and Gitea as token sources and 1Password and HashiCorp Vault as password managers.

When you manage GitLab or Gitea tokens across many instances, you may run into the situation that you’re missing an overview of what access tokens exist.

Additionally, you may want to automate the rotation of existing access tokens, so that they have a short life-span and can get rotated on-demand when needed while not wasting precious time of your staff.

If you manage access to tokens through a vault instance, you can additionally monitor and control access to the access tokens.

To solve these issues, ’token-operator’ was born.

What token-operator does

1. It connects to the configured tokens provider (GitLab or Gitea) and password vault.
2. Loops over the tokens in the configuration.
3. For each token, decides if it needs rotating and if so, rotates the token and updates the vault item.

Supported tokens providers

• GitLab: supported, group/project tokens require Enterprise license.
• Gitea: supported and requires Enterprise license.

Supported password managers

• 1Password: supported and fully open-source.
• HashiCorp Vault: supported and requires Enterprise license.
• Bitwarden: not supported currently. Supporting it requires significant changes as Bitwarden go-sdk requires CGO which prevents cross-compiling with goreleaser. https://github.com/bitwarden/sdk-sm/blob/main/languages/go/INSTRUCTIONS.md

Continue to 👉 Initial setup