Documentation
¶
Overview ¶
Package fakevault exposes a small local-only Vault/OpenBao-compatible API backed by the Podplane keyring, enabling the use of Secrets Store CSI Driver in local VMs.
Index ¶
- func CleanPath(path string) string
- func NewHandler(store Store, validator func(context.Context, string, string, string) error) http.Handler
- type KeyringBackend
- type KeyringStore
- func (s *KeyringStore) ArchiveSecret(clusterID, path string) error
- func (s *KeyringStore) DeleteSecret(clusterID, path string) error
- func (s *KeyringStore) GetSecret(clusterID, path string) (map[string]string, bool, error)
- func (s *KeyringStore) ListSecrets(clusterID string) ([]Secret, error)
- func (s *KeyringStore) RestoreSecret(clusterID, path string) error
- func (s *KeyringStore) SetSecret(clusterID, path string, values map[string]string) error
- type KubernetesTokenValidator
- type Secret
- type Store
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type KeyringBackend ¶
type KeyringBackend interface {
KeyringWrite(key string, value []byte) error
KeyringRead(key string) ([]byte, error)
KeyringDelete(key string) error
}
KeyringBackend is the subset of Podplane config used by KeyringStore.
type KeyringStore ¶
type KeyringStore struct {
// contains filtered or unexported fields
}
KeyringStore stores fakevault secrets in a keyring backend.
func NewKeyringStore ¶
func NewKeyringStore(backend KeyringBackend) *KeyringStore
NewKeyringStore returns a keyring-backed fakevault store.
func (*KeyringStore) ArchiveSecret ¶
func (s *KeyringStore) ArchiveSecret(clusterID, path string) error
ArchiveSecret marks a fakevault secret archived without deleting its value.
func (*KeyringStore) DeleteSecret ¶
func (s *KeyringStore) DeleteSecret(clusterID, path string) error
DeleteSecret permanently removes a fakevault secret for clusterID and path.
func (*KeyringStore) ListSecrets ¶
func (s *KeyringStore) ListSecrets(clusterID string) ([]Secret, error)
ListSecrets lists fakevault secrets for clusterID.
func (*KeyringStore) RestoreSecret ¶
func (s *KeyringStore) RestoreSecret(clusterID, path string) error
RestoreSecret makes an archived fakevault secret readable again.
type KubernetesTokenValidator ¶
type KubernetesTokenValidator struct {
KubernetesAPIURL func(clusterID string) (string, error)
Client *http.Client
Issuer string
}
KubernetesTokenValidator validates Kubernetes service-account JWTs against the kube-apiserver JWKS endpoint for a cluster.
func (*KubernetesTokenValidator) ValidateToken ¶
func (v *KubernetesTokenValidator) ValidateToken(ctx context.Context, clusterID, _, rawToken string) error
ValidateToken validates a Vault/OpenBao Kubernetes auth login JWT.
type Store ¶
type Store interface {
SetSecret(clusterID, path string, values map[string]string) error
GetSecret(clusterID, path string) (map[string]string, bool, error)
ArchiveSecret(clusterID, path string) error
RestoreSecret(clusterID, path string) error
DeleteSecret(clusterID, path string) error
ListSecrets(clusterID string) ([]Secret, error)
}
Store persists fakevault secrets.