fakevault

package
v0.5.5 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 2, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Overview

Package fakevault exposes a small local-only Vault/OpenBao-compatible API backed by the Podplane keyring, enabling the use of Secrets Store CSI Driver in local VMs.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CleanPath

func CleanPath(path string) string

CleanPath normalizes a Vault API path to the key stored by fakevault.

func NewHandler

func NewHandler(store Store, validator func(context.Context, string, string, string) error) http.Handler

NewHandler returns a minimal Vault/OpenBao-compatible HTTP handler. When validator is set, Kubernetes auth login JWTs must pass validation.

Types

type KeyringBackend

type KeyringBackend interface {
	KeyringWrite(key string, value []byte) error
	KeyringRead(key string) ([]byte, error)
	KeyringDelete(key string) error
}

KeyringBackend is the subset of Podplane config used by KeyringStore.

type KeyringStore

type KeyringStore struct {
	// contains filtered or unexported fields
}

KeyringStore stores fakevault secrets in a keyring backend.

func NewKeyringStore

func NewKeyringStore(backend KeyringBackend) *KeyringStore

NewKeyringStore returns a keyring-backed fakevault store.

func (*KeyringStore) ArchiveSecret

func (s *KeyringStore) ArchiveSecret(clusterID, path string) error

ArchiveSecret marks a fakevault secret archived without deleting its value.

func (*KeyringStore) DeleteSecret

func (s *KeyringStore) DeleteSecret(clusterID, path string) error

DeleteSecret permanently removes a fakevault secret for clusterID and path.

func (*KeyringStore) GetSecret

func (s *KeyringStore) GetSecret(clusterID, path string) (map[string]string, bool, error)

GetSecret returns a fakevault secret for clusterID and path.

func (*KeyringStore) ListSecrets

func (s *KeyringStore) ListSecrets(clusterID string) ([]Secret, error)

ListSecrets lists fakevault secrets for clusterID.

func (*KeyringStore) RestoreSecret

func (s *KeyringStore) RestoreSecret(clusterID, path string) error

RestoreSecret makes an archived fakevault secret readable again.

func (*KeyringStore) SetSecret

func (s *KeyringStore) SetSecret(clusterID, path string, values map[string]string) error

SetSecret writes a fakevault secret for clusterID and path.

type KubernetesTokenValidator

type KubernetesTokenValidator struct {
	KubernetesAPIURL func(clusterID string) (string, error)
	Client           *http.Client
	Issuer           string
}

KubernetesTokenValidator validates Kubernetes service-account JWTs against the kube-apiserver JWKS endpoint for a cluster.

func (*KubernetesTokenValidator) ValidateToken

func (v *KubernetesTokenValidator) ValidateToken(ctx context.Context, clusterID, _, rawToken string) error

ValidateToken validates a Vault/OpenBao Kubernetes auth login JWT.

type Secret

type Secret struct {
	Path     string
	Keys     []string
	Archived bool
	Version  int
}

Secret describes one keyring-backed fakevault secret.

type Store

type Store interface {
	SetSecret(clusterID, path string, values map[string]string) error
	GetSecret(clusterID, path string) (map[string]string, bool, error)
	ArchiveSecret(clusterID, path string) error
	RestoreSecret(clusterID, path string) error
	DeleteSecret(clusterID, path string) error
	ListSecrets(clusterID string) ([]Secret, error)
}

Store persists fakevault secrets.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL