Scaffold the bind-tsig secrets engine #1

2026-07-11T02:17:10+10:00

unkinben commented

2026-07-11 02:17:10 +10:00

First cut of the Vault/OpenBao secrets engine for BIND TSIG keys, modelled on vault-plugin-secrets-litellm.

Architecture

Vault never touches Kubernetes — it calls the bind-operator companion API (deployed by the operator, boolean-gated), which creates/rotates/deletes BindTSIGKey CRs; the operator reconciles them into key material.

Paths

config — companion API url/token/tls + defaults
static-roles/<role> + static-creds/<role> — stable named key, managed rotation (name never changes so zone allow-update stays valid)
roles/<role> + creds/<role> — dynamic, lease-bound keys (revoke deletes the CR)

Companion API contract (defined here, implemented next in bind-operator)

POST /v1/keys, GET/POST /v1/keys/{name}[/rotate], DELETE /v1/keys/{name}

Build/CI/e2e

Makefile + Woodpecker (pre-commit/build/test on PR; RPM build+publish on tag), nfpm vault+openbao flavours
e2e (like the litellm plugin): mock companion API + Vault + OpenBao in docker-compose, full lifecycle per engine (make e2e)
unit tests (mock API) for dynamic mint/revoke + static provision/read

First cut of the Vault/OpenBao secrets engine for BIND TSIG keys, modelled on vault-plugin-secrets-litellm. ## Architecture Vault never touches Kubernetes — it calls the bind-operator **companion API** (deployed by the operator, boolean-gated), which creates/rotates/deletes `BindTSIGKey` CRs; the operator reconciles them into key material. ## Paths - `config` — companion API url/token/tls + defaults - `static-roles/<role>` + `static-creds/<role>` — stable named key, **managed rotation** (name never changes so zone allow-update stays valid) - `roles/<role>` + `creds/<role>` — **dynamic**, lease-bound keys (revoke deletes the CR) ## Companion API contract (defined here, implemented next in bind-operator) `POST /v1/keys`, `GET/POST /v1/keys/{name}[/rotate]`, `DELETE /v1/keys/{name}` ## Build/CI/e2e - Makefile + Woodpecker (pre-commit/build/test on PR; RPM build+publish on tag), nfpm vault+openbao flavours - **e2e** (like the litellm plugin): mock companion API + Vault + OpenBao in docker-compose, full lifecycle per engine (`make e2e`) - unit tests (mock API) for dynamic mint/revoke + static provision/read ## Next Implement the companion API + operator-manages-its-deployment (boolean) in the bind-operator repo, to the contract above.

unkinben added 1 commit 2026-07-15 21:29:37 +10:00

Scaffold the bind-tsig secrets engine

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

b4b8915d3e

A Vault/OpenBao secrets engine that manages BIND TSIG keys via the
bind-operator companion API (Vault -> HTTP API -> BindTSIGKey CRs).

- backend + cmd entry point (plugin.ServeMultiplex), modelled on
  vault-plugin-secrets-litellm
- config path: companion API url/token/tls + defaults
- static-roles/static-creds: stable named key with managed rotation
- roles/creds: dynamic, lease-bound keys (revoke deletes the CR)
- tsig_key secret type with revoke/renew
- HTTP client for the companion API contract (/v1/keys CRUD + rotate)
- Makefile, Woodpecker CI (pre-commit/build/test + tag release RPMs),
  nfpm packaging (vault + openbao flavours)
- e2e: mock companion API + Vault + OpenBao in docker-compose, full
  lifecycle per engine; unit tests for the dynamic + static flows

unkinben force-pushed benvin/plugin-scaffold from a743a7246f to b4b8915d3e

2026-07-15 21:29:37 +10:00

Compare

benvin merged commit ac52ca5bde into main

2026-07-15 21:35:12 +10:00

benvin deleted branch benvin/plugin-scaffold

2026-07-15 21:35:12 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-plugin-secrets-bind-tsig#1