Add vctl and vctx Vault token CLIs #1

2026-07-26T23:28:37+10:00

unkinben commented

2026-07-26 23:28:37 +10:00

vault-tools is a new Go monorepo of small CLIs for managing Vault tokens across multiple vault instances ("contexts"). Both tools share one config file (~~/.config/vault) and token cache (~~/.cache/vault), so once a context is configured every tool knows about it. It follows the node-lookup conventions (Makefile version bumps, nfpm RPM with bundled completions, Woodpecker build/test/pre-commit + tag release).

add shared/ library: config parsing (vctl.yaml/config.yaml, file defaults + per-context overrides, slash contexts), token cache (0600 files / 0700 dirs, atomic writes, path-traversal guards, stores accessor/policies/ttl for later revocation), and a small hand-rolled Vault HTTP client (login for ldap/userpass/okta/radius/token, renew-self)
add vctl: login and renew (single context or --all), list, --method/--user overrides, no-echo password/token prompts, and dynamic context-name completion
add vctx: resolve a context, set VAULT_ADDR/VAULT_TOKEN/VAULT_NAMESPACE for one invocation, and exec the real vault CLI with the remaining args passed through untouched
add unit tests across shared/, vctl and vctx (config resolution, cache paths incl. slash contexts, vault client via httptest, --all iteration + error aggregation, vctx arg pass-through and env construction behind fakeable exec/prompt seams)
add Makefile, nfpm packaging bundling bash/zsh/fish completions for both binaries, and .woodpecker pipelines (serviceAccountName default, k8s resources on every step, RPM PUT to artifactapi, Gitea release)
add README, per-command docs (docs/vctl.md, docs/vctx.md), AGENTS.md and an example config

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

vault-tools is a new Go monorepo of small CLIs for managing Vault tokens across multiple vault instances ("contexts"). Both tools share one config file (~/.config/vault) and token cache (~/.cache/vault), so once a context is configured every tool knows about it. It follows the node-lookup conventions (Makefile version bumps, nfpm RPM with bundled completions, Woodpecker build/test/pre-commit + tag release). - add shared/ library: config parsing (vctl.yaml/config.yaml, file defaults + per-context overrides, slash contexts), token cache (0600 files / 0700 dirs, atomic writes, path-traversal guards, stores accessor/policies/ttl for later revocation), and a small hand-rolled Vault HTTP client (login for ldap/userpass/okta/radius/token, renew-self) - add vctl: login and renew (single context or --all), list, --method/--user overrides, no-echo password/token prompts, and dynamic context-name completion - add vctx: resolve a context, set VAULT_ADDR/VAULT_TOKEN/VAULT_NAMESPACE for one invocation, and exec the real vault CLI with the remaining args passed through untouched - add unit tests across shared/, vctl and vctx (config resolution, cache paths incl. slash contexts, vault client via httptest, --all iteration + error aggregation, vctx arg pass-through and env construction behind fakeable exec/prompt seams) - add Makefile, nfpm packaging bundling bash/zsh/fish completions for both binaries, and .woodpecker pipelines (serviceAccountName default, k8s resources on every step, RPM PUT to artifactapi, Gitea release) - add README, per-command docs (docs/vctl.md, docs/vctx.md), AGENTS.md and an example config https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben added 1 commit 2026-07-26 23:28:37 +10:00

Add vctl and vctx Vault token CLIs

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline failed

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

123faf8bbf

Introduces the vault-tools monorepo: two Go CLIs that share a config file
(~/.config/vault) and token cache (~/.cache/vault) for working with multiple
Vault instances (contexts).

- add shared/ library: config parsing (vctl.yaml/config.yaml, per-context
  overrides, slash contexts), token cache (0600/0700, atomic writes, path-
  traversal guards), and a small hand-rolled Vault HTTP client (login/renew)
- add vctl: login/renew (single or --all), list, --method/--user overrides,
  no-echo password/token prompts, dynamic context completion
- add vctx: resolve a context, set VAULT_ADDR/VAULT_TOKEN/VAULT_NAMESPACE and
  exec the vault CLI, passing remaining args through untouched
- add unit tests across shared/, vctl and vctx command layers (config
  resolution, cache paths, vault client, --all iteration + error aggregation,
  vctx arg pass-through and env construction via fakeable exec/prompt seams)
- add Makefile (build/test/completions/rpm, patch|minor|major version bumps),
  nfpm RPM packaging bundling bash/zsh/fish completions for both binaries
- add Woodpecker pipelines: build/test/pre-commit on PRs, and a tag release
  that cross-compiles, builds+uploads the RPM to artifactapi, and cuts a Gitea
  release (serviceAccountName default, k8s resources on every step)
- add README, per-command docs (docs/vctl.md, docs/vctx.md), AGENTS.md and an
  example config

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben added 1 commit 2026-07-26 23:49:22 +10:00

Fix errcheck lint failures in runList

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

bffbd45204

golangci-lint (errcheck) in CI flagged the fmt.Fprintf calls in vctl's
runList as unchecked return values — writes to an arbitrary io.Writer are
not on errcheck's default exclude list (unlike os.Stdout/os.Stderr).

- discard the fmt.Fprintf return values in runList with '_, _ =', matching
  the existing convention used elsewhere in the tree

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

benvin merged commit 46560219ed into main

2026-07-27 00:46:55 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-tools#1