Skip to content

Lockstep 0.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Nov 09:49
· 24 commits to main since this release
v0.1.0
1a78404

First public release.

Added

  • Compare KV v2 secrets engines across two Vaults, or two mounts or prefixes in one Vault. Values are compared on the server and only shown on request; secrets you can't read show as No access, never as one-sided.
  • Copy keys or whole secrets in either direction after a review, with KV v2 check-and-set (no overwriting a target changed since the comparison), nothing ever deleted, and every write audit-logged without values.
  • Sync plans: save a reviewed set of copies as a signed file with no values (and a Markdown report); someone with write access checks and applies it later. If anything in it changed, nothing is written.
  • Comparison profiles: path mappings (services/*/prod/** ⇄ services/*/staging/**) and ignored keys or paths, shared by the server or kept per browser.
  • Value tools: base64, PEM/DER, X.509 certificates and chains (validated), PKCS#12, JKS/JCEKS, keys, CSRs, images, archives; side-by-side certificate comparison and downloads.
  • Certificate expiry dashboard across one or both mounts, including certificates inside keystores, with CSV export.
  • Last-updated metadata per secret and per key, never part of the comparison.
  • Sign-in with token, userpass, LDAP, OIDC (redirect flow) or the pod's Kubernetes service account.
  • Helm chart: hardened defaults, session key kept across upgrades, Ingress, NetworkPolicy, PodDisruptionBudget, Kubernetes auth, shared profiles; validated by a schema and tested in k3s.
  • Runs on Red Hat Hardened Images (distroless, non-root). Every change is scanned (CVEs, secrets, misconfigurations, base image signatures) and tested end to end in a browser.

Install

Helm (Kubernetes):

helm upgrade --install lockstep oci://ghcr.io/welshstew/charts/lockstep --version 0.1.0 \
  -n lockstep --create-namespace -f my-values.yaml

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/welshstew/lockstep:0.1.0

Image digest: sha256:36d7f6c58148adec6fdb3c4b6253c8dce417218cac82b24979333b854792ddb3 · chart digest: sha256:68972ebc9f8f337d85f9b810c6863a57e46d36ebb994975c2e49024b784317c5

Verify

The image and the chart are signed with cosign (keyless, by this repository's release workflow), and the image carries an SBOM and build provenance:

cosign verify ghcr.io/welshstew/lockstep:0.1.0 \
  --certificate-identity "https://github.com/welshstew/lockstep/.github/workflows/release.yml@refs/tags/v0.1.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Assets 2
Loading