divekit credentials on Divekit

divekit credentials renew

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis

Replace the managed tokens of a distribution before they expire.

For each credential Divekit creates a replacement token, writes it into every CI/CD variable that consumes it, and only then revokes the previous token, so pipelines keep working throughout. If a variable cannot be updated, the previous token stays valid and the credential is reported as failed. Running the renewal again finishes it and also removes the surplus token the failed attempt left.

divekit credentials revoke

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis

Revoke the managed tokens of a distribution and remove the variables that carried them.

Tokens are revoked first and the variables removed afterwards. If a step fails, a consumer is left with a variable that holds a dead token, which fails closed, instead of a live secret that nothing references. A token that cannot be revoked keeps its variables in place. Running the revocation again finishes it.

divekit credentials status

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis

Report the managed credentials of a distribution without changing anything.

For each repository the report shows the token name, the project that owns the token (GitLab sends its expiry notices to that project), the project whose CI/CD variables carry it, the state and the expiry date. Token values are never shown.

STATES: active one active token, carried by every consuming variable expiring active, but it expires within 30 days expired the managed token ended by date missing no active managed token exists pending-cleanup several active tokens carry a managed name: a renewal stopped before it ended the older one legacy the only active token still has the legacy name variables-missing the token works, but a consuming variable does not exist unknown a project could not be read, which is never reported as healthy