leetcrypt
425c299359
v1: discover → migrate → expiry tracking → sealed export/import. - vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop - discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker, kube, git) and a file/dir harvester (--path) - sink: gopass streaming insert; length-prefixed bundle framing; Sealer interface with three impls — age (default, authenticated), hmac (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback, unauthenticated; OpenSSL 3.x enc refuses AEAD) - policy: local expiry engine, 60d/8w threshold parser - audit: redacted append-only JSONL, injectable clock - export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into locked memory; secrets stream gopass<->Sealer as bytes, never Go strings - tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass; go test ./... green, -race clean Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
85 lines
2.0 KiB
Go
85 lines
2.0 KiB
Go
package discover
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
|
|
"incredigo/internal/vault"
|
|
)
|
|
|
|
func init() { Register(&kubeScanner{}) }
|
|
|
|
// kubeScanner reads ~/.kube/config (YAML) and emits a credential per user that
|
|
// carries a static secret: a bearer token, a client key, or a basic-auth
|
|
// password. Dynamic exec/auth-provider users (no embedded secret) are skipped.
|
|
// Read-only.
|
|
type kubeScanner struct{}
|
|
|
|
func (k *kubeScanner) Name() string { return "kube" }
|
|
|
|
func (k *kubeScanner) path() string {
|
|
if p := os.Getenv("KUBECONFIG"); p != "" {
|
|
// KUBECONFIG may be a colon-separated list; use the first entry.
|
|
return strings.SplitN(p, ":", 2)[0]
|
|
}
|
|
home, _ := os.UserHomeDir()
|
|
return filepath.Join(home, ".kube", "config")
|
|
}
|
|
|
|
func (k *kubeScanner) Available() bool {
|
|
_, err := os.Stat(k.path())
|
|
return err == nil
|
|
}
|
|
|
|
func (k *kubeScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, error) {
|
|
p := k.path()
|
|
b, err := os.ReadFile(p) // read-only
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
fi, _ := os.Stat(p)
|
|
|
|
var cfg struct {
|
|
Users []struct {
|
|
Name string `yaml:"name"`
|
|
User struct {
|
|
Token string `yaml:"token"`
|
|
Password string `yaml:"password"`
|
|
ClientKeyData string `yaml:"client-key-data"`
|
|
} `yaml:"user"`
|
|
} `yaml:"users"`
|
|
}
|
|
if err := yaml.Unmarshal(b, &cfg); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var creds []Credential
|
|
for _, u := range cfg.Users {
|
|
var secret string
|
|
kind := KindToken
|
|
switch {
|
|
case u.User.Token != "":
|
|
secret, kind = u.User.Token, KindToken
|
|
case u.User.ClientKeyData != "":
|
|
secret, kind = u.User.ClientKeyData, KindPrivateKey
|
|
case u.User.Password != "":
|
|
secret, kind = u.User.Password, KindPassword
|
|
default:
|
|
continue // dynamic credential (exec/auth-provider) — nothing static to take
|
|
}
|
|
creds = append(creds, Credential{
|
|
Source: k.Name(),
|
|
Kind: kind,
|
|
Identity: u.Name,
|
|
Location: p,
|
|
Modified: fi.ModTime(),
|
|
Secret: v.Store([]byte(secret)),
|
|
})
|
|
}
|
|
return creds, nil
|
|
}
|