serviceaccountaccesstoken.yaml

---
apiVersion: instance.gitlab.m.crossplane.io/v1alpha1
kind: ServiceAccountAccessToken
metadata:
  name: example-instance-sa-access-token
  namespace: default
spec:
  forProvider:
    name: example-instance-sa-access-token
    # The instance service account the token belongs to, by ID or reference.
    serviceAccountIdRef:
      name: example-instance
    expiresAt: "2026-06-15T08:00:00Z"
    scopes:
      - "read_repository"
  # Owner mode: this ProviderConfig must authenticate with an instance-admin
  # token. Instance service-account tokens have no dedicated endpoints, so the
  # provider creates/rotates/revokes them through the admin personal access
  # tokens API.
  providerConfigRef:
    name: gitlab-provider
    kind: ProviderConfig
  writeConnectionSecretToRef:
    name: gitlab-example-instance-sa-access-token
---
apiVersion: instance.gitlab.m.crossplane.io/v1alpha1
kind: ServiceAccountAccessToken
metadata:
  name: example-instance-sa-access-token-no-expiry
  namespace: default
spec:
  forProvider:
    name: example-instance-sa-access-token-no-expiry
    serviceAccountId: 123
    # The provider rotates the token before expiry and writes the new value
    # to the connection secret. self_rotate enables self-rotation.
    renewalPeriodDays: 30
    renewBeforeDays: 5
    scopes:
      - "read_repository"
      - "self_rotate"
  providerConfigRef:
    name: gitlab-provider
    kind: ProviderConfig
  writeConnectionSecretToRef:
    name: gitlab-example-instance-sa-access-token-no-expiry
---
# Self-managed / self-rotating example.
#
# This is the self-sustaining loop: a short-lived service-account token whose
# value is consumed by the very ProviderConfig used to reconcile it. The
# provider authenticates AS the service account, so it can only use the self
# endpoints (self-inform + self-rotate). The controller detects this
# automatically when the referenced ProviderConfig's credentials secretRef
# matches this resource's writeConnectionSecretToRef (same namespace, name, and
# key "token") and the method is PersonalAccessToken.
#
# Unlike owner mode, the self-rotating loop needs NO instance-admin token once
# bootstrapped - it runs on the service account's own credential.
#
# Bootstrap (one-time): the token must already exist and be reachable via the
# secret below. Two ways to seed it:
#
#  a) Let Crossplane create it first in owner-mode (using an instance-admin
#     ProviderConfig so Crossplane creates and OWNS the connection secret with
#     the correct type), then switch providerConfigRef to the self ProviderConfig
#     below.
#
#  b) Hand-create the secret yourself. It MUST have
#     type: connection.crossplane.io/v1alpha1 (NOT Opaque) and a `token` key with
#     a token that has at least the `api` and `self_rotate` scopes. Crossplane
#     only writes rotated values into connection-typed secrets it can control.
#
# From then on the provider keeps the token alive by rotating before expiry and
# writing the new value back into the same secret, which the ProviderConfig
# re-reads on the next reconcile.
---
# Option (b): hand-created bootstrap secret. Note the connection secret type.
apiVersion: v1
kind: Secret
metadata:
  name: gitlab-instance-self-rotating-token
  namespace: default
type: connection.crossplane.io/v1alpha1
stringData:
  token: <a service-account PAT with api + self_rotate scopes>
---
apiVersion: gitlab.m.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: gitlab-instance-self-rotating
  namespace: default
spec:
  baseURL: https://gitlab.example.com/
  credentials:
    source: Secret
    method: PersonalAccessToken
    secretRef:
      namespace: default
      # Same secret the ServiceAccountAccessToken below writes its token into.
      name: gitlab-instance-self-rotating-token
      key: token
---
apiVersion: instance.gitlab.m.crossplane.io/v1alpha1
kind: ServiceAccountAccessToken
metadata:
  name: instance-self-rotating-token
  namespace: default
spec:
  forProvider:
    # name and scopes must match the adopted token (it is immutable). Include
    # self_rotate so the provider can rotate it, plus api to reconcile resources.
    name: crossplane-instance-self-rotating
    # The service account this token belongs to. Setting it activates the
    # self-mode safety guard: the provider refuses to rotate/revoke the token
    # if the credentials secret is wired to a different service account.
    serviceAccountId: 123
    scopes:
      - api
      - self_rotate
    # Short lifetime; the provider rotates well before expiry.
    renewalPeriodDays: 7
    renewBeforeDays: 2
  # Uses the ProviderConfig that authenticates with this very token.
  providerConfigRef:
    name: gitlab-instance-self-rotating
    kind: ProviderConfig
  # Writes the rotated token back into the ProviderConfig's credentials secret,
  # closing the self-rotation loop.
  writeConnectionSecretToRef:
    name: gitlab-instance-self-rotating-token