unkin-agent
64d9b89dcd
Mints ephemeral, scoped ghp access tokens via ghp's admin token API
(POST /api/tokens), bound to a Vault lease and revoked on lease
expiry (DELETE /api/tokens/{id}).
- config: base_url + write-only admin_token (ghpsvc_ service token),
TLS settings; verifies the token is a ghp admin on write. No
rotate-root: the service token is static and operator-managed.
- roles: token_type (agent/proxy), installation_id, app_record_id,
repositories, scopes (permission:level), session_prefix, ttl/max_ttl.
- creds: mint a lease-bound token; ghp-side duration bounded by the
lease ceiling as defence in depth.
- secret ghp_token: idempotent revoke + lease renew.
- Unit tests (config/role/creds/client/scopes/revocation), mock-ghp
e2e on Vault + OpenBao, Woodpecker pre-commit/build/test/release,
Makefile patch/minor/major, nfpm RPM packaging.
91 lines
4.3 KiB
Modula-2
91 lines
4.3 KiB
Modula-2
module git.unkin.net/unkin/vault-plugin-secrets-ghp
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/hashicorp/go-hclog v1.6.3
|
|
github.com/hashicorp/go-uuid v1.0.3
|
|
github.com/hashicorp/vault/api v1.15.0
|
|
github.com/hashicorp/vault/sdk v0.14.0
|
|
)
|
|
|
|
require (
|
|
github.com/Microsoft/go-winio v0.6.1 // indirect
|
|
github.com/armon/go-metrics v0.4.1 // indirect
|
|
github.com/armon/go-radix v1.0.0 // indirect
|
|
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/distribution/reference v0.6.0 // indirect
|
|
github.com/docker/docker v26.1.5+incompatible // indirect
|
|
github.com/docker/go-connections v0.4.0 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
|
|
github.com/fatih/color v1.16.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/golang/snappy v0.0.4 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.0 // indirect
|
|
github.com/hashicorp/go-kms-wrapping/v2 v2.0.8 // indirect
|
|
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
|
github.com/hashicorp/go-plugin v1.6.1 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
|
|
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/mlock v0.1.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.0 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
|
|
github.com/hashicorp/go-sockaddr v1.0.6 // indirect
|
|
github.com/hashicorp/go-version v1.6.0 // indirect
|
|
github.com/hashicorp/golang-lru v0.5.4 // indirect
|
|
github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
|
|
github.com/hashicorp/yamux v0.1.1 // indirect
|
|
github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mitchellh/copystructure v1.2.0 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/oklog/run v1.1.0 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b // indirect
|
|
github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 // indirect
|
|
github.com/pierrec/lz4 v2.6.1+incompatible // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/ryanuber/go-glob v1.0.0 // indirect
|
|
github.com/sasha-s/go-deadlock v0.2.0 // indirect
|
|
github.com/stretchr/testify v1.11.1 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.51.0 // indirect
|
|
go.opentelemetry.io/otel v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.44.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.uber.org/atomic v1.9.0 // indirect
|
|
golang.org/x/crypto v0.54.0 // indirect
|
|
golang.org/x/mod v0.37.0 // indirect
|
|
golang.org/x/net v0.57.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
golang.org/x/time v0.5.0 // indirect
|
|
golang.org/x/tools v0.47.0 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a // indirect
|
|
google.golang.org/grpc v1.82.1 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|