fakevault

package
v0.9.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 19, 2026 License: Apache-2.0 Imports: 20 Imported by: 0

Documentation

Overview

Package fakevault exposes a small local-only Vault/OpenBao-compatible API for local VMs. It stores encrypted secret files per local cluster, protected by one cluster-scoped key in the Podplane/system keyring.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CleanPath

func CleanPath(path string) string

CleanPath normalizes a Vault API path to the path stored by fakevault.

func NewHandler

func NewHandler(store Store, validator func(context.Context, string, string, string) error) http.Handler

NewHandler returns a minimal Vault/OpenBao-compatible HTTP handler. When validator is set, Kubernetes auth login JWTs must pass validation.

Types

type FileStore added in v0.5.7

type FileStore struct {
	// contains filtered or unexported fields
}

FileStore stores fakevault secrets as encrypted files protected by one keychain-backed vault key per local cluster.

func NewFileStore added in v0.5.7

func NewFileStore(backend KeyringBackend, root string) *FileStore

NewFileStore returns an encrypted file-backed fakevault store. root is the directory containing local cluster data, usually ~/.podplane/data/local.

func (*FileStore) ArchiveSecret added in v0.5.7

func (s *FileStore) ArchiveSecret(clusterID, path string) error

ArchiveSecret marks a fakevault secret archived without deleting its value.

func (*FileStore) DeleteSecret added in v0.5.7

func (s *FileStore) DeleteSecret(clusterID, path string) error

DeleteSecret permanently removes a fakevault secret for clusterID and path.

func (*FileStore) GetSecret added in v0.5.7

func (s *FileStore) GetSecret(clusterID, path string) (map[string]string, bool, error)

GetSecret returns a fakevault secret for clusterID and path.

func (*FileStore) ListSecrets added in v0.5.7

func (s *FileStore) ListSecrets(clusterID string) ([]Secret, error)

ListSecrets lists fakevault secrets for clusterID.

func (*FileStore) RestoreSecret added in v0.5.7

func (s *FileStore) RestoreSecret(clusterID, path string) error

RestoreSecret makes an archived fakevault secret readable again.

func (*FileStore) SetSecret added in v0.5.7

func (s *FileStore) SetSecret(clusterID, path string, values map[string]string) error

SetSecret writes a fakevault secret for clusterID and path.

type KeyringBackend

type KeyringBackend interface {
	KeyringWrite(key string, value []byte) error
	KeyringRead(key string) ([]byte, error)
}

KeyringBackend is the subset of Podplane config used by FileStore.

type KubernetesTokenValidator

type KubernetesTokenValidator struct {
	KubernetesAPIURL func(clusterID string) (string, error)
	KubernetesIssuer func(clusterID string) (string, error)
	Client           *http.Client
	Issuer           string
}

KubernetesTokenValidator validates Kubernetes service-account JWTs against the kube-apiserver JWKS endpoint for a cluster.

func (*KubernetesTokenValidator) ValidateToken

func (v *KubernetesTokenValidator) ValidateToken(ctx context.Context, clusterID, role, rawToken string) error

ValidateToken validates a Vault/OpenBao Kubernetes auth login JWT.

type Secret

type Secret struct {
	Path     string
	Keys     []string
	Archived bool
	Version  int
}

Secret describes one fakevault secret without exposing secret values.

type Store

type Store interface {
	SetSecret(clusterID, path string, values map[string]string) error
	GetSecret(clusterID, path string) (map[string]string, bool, error)
	ArchiveSecret(clusterID, path string) error
	RestoreSecret(clusterID, path string) error
	DeleteSecret(clusterID, path string) error
	ListSecrets(clusterID string) ([]Secret, error)
}

Store persists fakevault secrets.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL