Documentation
¶
Overview ¶
Package fakevault exposes a small local-only Vault/OpenBao-compatible API for local VMs. It stores encrypted secret files per local cluster, protected by one cluster-scoped key in the Podplane/system keyring.
Index ¶
- func CleanPath(path string) string
- func NewHandler(store Store, validator func(context.Context, string, string, string) error) http.Handler
- type FileStore
- func (s *FileStore) ArchiveSecret(clusterID, path string) error
- func (s *FileStore) DeleteSecret(clusterID, path string) error
- func (s *FileStore) GetSecret(clusterID, path string) (map[string]string, bool, error)
- func (s *FileStore) ListSecrets(clusterID string) ([]Secret, error)
- func (s *FileStore) RestoreSecret(clusterID, path string) error
- func (s *FileStore) SetSecret(clusterID, path string, values map[string]string) error
- type KeyringBackend
- type KubernetesTokenValidator
- type Secret
- type Store
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type FileStore ¶ added in v0.5.7
type FileStore struct {
// contains filtered or unexported fields
}
FileStore stores fakevault secrets as encrypted files protected by one keychain-backed vault key per local cluster.
func NewFileStore ¶ added in v0.5.7
func NewFileStore(backend KeyringBackend, root string) *FileStore
NewFileStore returns an encrypted file-backed fakevault store. root is the directory containing local cluster data, usually ~/.podplane/data/local.
func (*FileStore) ArchiveSecret ¶ added in v0.5.7
ArchiveSecret marks a fakevault secret archived without deleting its value.
func (*FileStore) DeleteSecret ¶ added in v0.5.7
DeleteSecret permanently removes a fakevault secret for clusterID and path.
func (*FileStore) GetSecret ¶ added in v0.5.7
GetSecret returns a fakevault secret for clusterID and path.
func (*FileStore) ListSecrets ¶ added in v0.5.7
ListSecrets lists fakevault secrets for clusterID.
func (*FileStore) RestoreSecret ¶ added in v0.5.7
RestoreSecret makes an archived fakevault secret readable again.
type KeyringBackend ¶
type KeyringBackend interface {
KeyringWrite(key string, value []byte) error
KeyringRead(key string) ([]byte, error)
}
KeyringBackend is the subset of Podplane config used by FileStore.
type KubernetesTokenValidator ¶
type KubernetesTokenValidator struct {
KubernetesAPIURL func(clusterID string) (string, error)
KubernetesIssuer func(clusterID string) (string, error)
Client *http.Client
Issuer string
}
KubernetesTokenValidator validates Kubernetes service-account JWTs against the kube-apiserver JWKS endpoint for a cluster.
func (*KubernetesTokenValidator) ValidateToken ¶
func (v *KubernetesTokenValidator) ValidateToken(ctx context.Context, clusterID, role, rawToken string) error
ValidateToken validates a Vault/OpenBao Kubernetes auth login JWT.
type Store ¶
type Store interface {
SetSecret(clusterID, path string, values map[string]string) error
GetSecret(clusterID, path string) (map[string]string, bool, error)
ArchiveSecret(clusterID, path string) error
RestoreSecret(clusterID, path string) error
DeleteSecret(clusterID, path string) error
ListSecrets(clusterID string) ([]Secret, error)
}
Store persists fakevault secrets.