Automating pull token rotation

Preferred: use an assumable identity

Where the platform supports OIDC (GitHub Actions, GitLab, AWS, Kubernetes), use an assumable identity so a short-lived credential is minted on each run and there is nothing to rotate.

Static pull token

chainctl auth pull-token create --parent <org> --ttl 720h -o json | jq -r .token

• --ttl default is 720h (30 days); maximum is 8760h (one year).
• --repository is one of oci, apk, java, python, javascript (default oci).
• There is no --output token mode; parse JSON, or use -o env to get CHAINGUARD_*_IDENTITY_ID and CHAINGUARD_*_TOKEN.
• For a pull token, the docker login username is the token's identity ID (not _token).

Schedule the rotation

Run the create-and-store step on a schedule comfortably shorter than the token TTL. For the default 30-day TTL, a weekly cron leaves ample margin:

# run the rotation script weekly (Sundays, 03:00)
0 3 * * 0  /path/to/rotate-chainguard-pull-token.sh

Rotation and the user-removal caveat

Pull tokens are standalone identities, so removing a user does not revoke that user's pull tokens. Audit and rotate them separately (chainctl auth pull-token list) so orphaned tokens do not accumulate in your organization.