Sienna Meridian Satterwhite
ca0748b109
Vault keystore (vault_keystore.rs): - AES-256-GCM encrypted local storage for root tokens + unseal keys - Argon2id KDF with machine-specific salt, 0600 permissions - save/load/verify/export API with 26 unit tests - Integrated into seed flow: save after init, load as fallback, backfill from cluster, restore K8s Secret if wiped Vault CLI: - vault reinit: wipe and re-initialize vault with confirmation - vault keys: show local keystore status - vault export-keys: plaintext export for machine migration - vault status: now shows keystore status + uses JWT auth - Fixed seal_status() bypassing request() (missing auth headers) Vault OIDC auth: - JWT auth method enabled on OpenBao via seed script - cli-admin role: full access for users with admin:true JWT claim - cli-reader role: read-only for non-admin SSO users - BaoClient.with_proxy_auth(): sends both Bearer (proxy) and X-Vault-Token (vault) headers - SunbeamClient.bao() authenticates via JWT login, falls back to local keystore root token Drive: - SDK client uses /items/ endpoint (was /files/ and /folders/) - Added create_child, upload_ended, upload_to_s3 methods - Added recursive drive upload command (--path, --folder-id) - Switched all La Suite clients to /external_api/v1.0/ Infrastructure: - Removed openbao-keys-placeholder.yaml from kustomization - Added sunbeam.dev/managed-by label to programmatic secrets - kv_patch→kv_put fallback for fresh vault initialization - Hydra/Kratos secrets combined (new,old) for key rotation
87 lines
1.9 KiB
TOML
87 lines
1.9 KiB
TOML
[package]
|
|
name = "sunbeam-sdk"
|
|
version = "1.0.1"
|
|
edition = "2024"
|
|
description = "Sunbeam SDK — reusable library for cluster management"
|
|
repository = "https://src.sunbeam.pt/studio/cli"
|
|
license = "MIT"
|
|
publish = ["sunbeam"]
|
|
|
|
[features]
|
|
default = ["identity", "gitea"]
|
|
identity = []
|
|
gitea = []
|
|
pm = ["gitea"]
|
|
matrix = []
|
|
opensearch = []
|
|
s3 = []
|
|
livekit = []
|
|
monitoring = []
|
|
lasuite = []
|
|
build = []
|
|
cli = ["dep:clap"]
|
|
all = ["identity", "gitea", "pm", "matrix", "opensearch", "s3", "livekit", "monitoring", "lasuite", "build"]
|
|
integration = ["all"]
|
|
|
|
[dependencies]
|
|
# Core
|
|
thiserror = "2"
|
|
tokio = { version = "1", features = ["full"] }
|
|
clap = { version = "4", features = ["derive"], optional = true }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_yaml = "0.9"
|
|
tracing = "0.1"
|
|
|
|
# Kubernetes
|
|
kube = { version = "0.99", features = ["client", "runtime", "derive", "ws"] }
|
|
k8s-openapi = { version = "0.24", features = ["v1_32"] }
|
|
|
|
# HTTP + TLS
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "blocking"] }
|
|
bytes = "1"
|
|
|
|
# SSH
|
|
russh = "0.46"
|
|
russh-keys = "0.46"
|
|
|
|
# Crypto
|
|
rsa = "0.9"
|
|
pkcs8 = { version = "0.10", features = ["pem"] }
|
|
pkcs1 = { version = "0.7", features = ["pem"] }
|
|
sha2 = "0.10"
|
|
hmac = "0.12"
|
|
base64 = "0.22"
|
|
rand = "0.8"
|
|
aes-gcm = "0.10"
|
|
argon2 = "0.5"
|
|
|
|
# Certificate generation
|
|
rcgen = "0.14"
|
|
|
|
# SMTP
|
|
lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
|
|
|
|
# Archive handling
|
|
flate2 = "1"
|
|
tar = "0.4"
|
|
|
|
# Async
|
|
futures = "0.3"
|
|
tokio-stream = "0.1"
|
|
|
|
# Utility
|
|
tempfile = "3"
|
|
dirs = "5"
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
|
|
[dev-dependencies]
|
|
wiremock = "0.6"
|
|
|
|
[build-dependencies]
|
|
reqwest = { version = "0.12", default-features = false, features = ["blocking", "rustls-tls"] }
|
|
sha2 = "0.10"
|
|
flate2 = "1"
|
|
tar = "0.4"
|
|
chrono = "0.4"
|