ForgejoAccessToken
An access token of a ForgejoUser (typically a bot), issued through the admin API (Forgejo v16+) and written to secretTargets as FORGEJO_TOKEN, FORGEJO_USERNAME and FORGEJO_URL.
- API version:
forgejo.weebo.io/v1alpha1 - Scope: Namespaced
- Short names:
fjtoken - Guide: Credentials
An access token of a ForgejoUser (typically a bot), issued through the
admin API (Forgejo v16+) and written to secretTargets as
FORGEJO_TOKEN, FORGEJO_USERNAME and FORGEJO_URL.
Token values can't be read back: a lost target, a new
forgejo.weebo.io/rotate-secret nonce or an elapsed rotationPeriod
issues a new token. The new token is issued and written to every target
before the old one is revoked; as names are unique per user, a rotated
token alternates between name and name-next.
Example
apiVersion: forgejo.weebo.io/v1alpha1
kind: ForgejoAccessToken
metadata:
name: my-accesstoken
namespace: team-a
spec:
userRef:
name: ci-bot
scopes:
- write:repositorySpec fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
deletionPolicy | string | no | "Delete" | What happens to the Forgejo object when its CR is deleted. |
instanceRef | object | no | The ForgejoInstance or ForgejoLocalInstance this object lives on. Unset: the cluster's only ForgejoInstance, else the only ForgejoLocalInstance of this namespace. | |
name | string | no | Token name, unique per user. Defaults to <namespace>-<cr name>. A token of that name the user already has, or another CR issues, is never revoked: the CR fails (ForgejoObjectAlreadyExists, RemoteObjectClaimed). Rotation alternates with <name>-next. | |
repositoryRefs | object[] | no | Restrict the token to these ForgejoRepositorys (same namespace). Forgejo then only accepts the read:/write: issue and repository scopes. Same disruptive-update rule as scopes. | |
rotationPeriod | string | no | Issue a new token once the current one is this old — a Go duration such as 720h. | |
scopes | string[] | yes | all, or read:/write: + activitypub, admin, issue, misc, notification, organization, package, repository, user. Changing scopes issues a new token, which needs the forgejo.weebo.io/allow-disruptive-update: "true" annotation. | |
secretTargets | object[] | no | Defaults to one target named after the CR, in its namespace, on the instance's default secretStore backend. | |
userRef | object | yes | The user the token belongs to. |
Build a manifest
Answer the questions and fill in the fields: the YAML preview updates as you type, ready to copy or download and kubectl apply.
Loading form...