unkinben
123faf8bbf
Introduces the vault-tools monorepo: two Go CLIs that share a config file (~/.config/vault) and token cache (~/.cache/vault) for working with multiple Vault instances (contexts). - add shared/ library: config parsing (vctl.yaml/config.yaml, per-context overrides, slash contexts), token cache (0600/0700, atomic writes, path- traversal guards), and a small hand-rolled Vault HTTP client (login/renew) - add vctl: login/renew (single or --all), list, --method/--user overrides, no-echo password/token prompts, dynamic context completion - add vctx: resolve a context, set VAULT_ADDR/VAULT_TOKEN/VAULT_NAMESPACE and exec the vault CLI, passing remaining args through untouched - add unit tests across shared/, vctl and vctx command layers (config resolution, cache paths, vault client, --all iteration + error aggregation, vctx arg pass-through and env construction via fakeable exec/prompt seams) - add Makefile (build/test/completions/rpm, patch|minor|major version bumps), nfpm RPM packaging bundling bash/zsh/fish completions for both binaries - add Woodpecker pipelines: build/test/pre-commit on PRs, and a tag release that cross-compiles, builds+uploads the RPM to artifactapi, and cuts a Gitea release (serviceAccountName default, k8s resources on every step) - add README, per-command docs (docs/vctl.md, docs/vctx.md), AGENTS.md and an example config Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
2.5 KiB
vctx
vctx is a thin, context-aware wrapper around the real vault CLI. It resolves
a context (using the same config file and token cache as vctl),
sets VAULT_ADDR, VAULT_TOKEN and VAULT_NAMESPACE for that single
invocation only, and execs vault with the remaining arguments.
Synopsis
vctx --context <context> <any vault args...>
vctx version
How it works
vctx --context sydney kv put kv/foo/bar secret=baz
- Resolves the
sydneycontext from~/.config/vault/vctl.yaml(orconfig.yaml) — the exact filevctluses. - Loads the cached token from
~/.cache/vault/sydney(errors with a hint to runvctl login sydneyif none exists). - Sets, for this process only:
VAULT_ADDR= the context's addressVAULT_TOKEN= the cached tokenVAULT_NAMESPACE= the context's namespace (only if non-empty; falls back to the namespace recorded in the cached token)
execs thevaultbinary (found onPATH) with everything after the context. Because it replaces the process,vault's exit status, signals and TTY behaviour pass straight through.
The ambient VAULT_ADDR / VAULT_TOKEN in your shell are ignored for the call
— vctx always targets the chosen context.
The --context flag
--context is the only flag vctx consumes; it must come before the vault
command. Everything from the first non-flag argument onward is handed to vault
untouched, so vault's own flags work normally:
vctx --context sydney kv get -field=password secret/db
vctx --context staging/sydney token lookup
vctx --context sydney -help # 'vctx --context X' then vault sees -help
Context names support slashes (e.g. staging/sydney), matching the config and
the on-disk token cache.
Examples
# Write a secret to the sydney vault
vctx --context sydney kv put kv/foo/bar secret=baz
# Read a single field
vctx --context sydney kv get -field=secret kv/foo/bar
# Operate against a namespaced, slash-named context
vctx --context staging/sydney kv list kv/
# Inspect the token vctx would use
vctx --context sydney token lookup
Requirements
- The
vaultCLI must be installed and onPATH. - A token must already be cached for the context (
vctl login <context>).
Shell completion
vctx completion bash > /etc/bash_completion.d/vctx
vctx completion zsh > ~/.zsh/completions/_vctx
The --context value completes dynamically from the configured context names,
so vctx --context <TAB> lists your vaults (the RPM installs these completions
automatically).