search

nagyesta / lowkey-vault

Lowkey Vault is a small test double for Azure Key Vault. Developer feedback needed, please vote here: https://github.com/nagyesta/lowkey-vault/discussions/272
MIT License
53 stars 5 forks source link
azure ci cryptography fake-objects keyvault local test-double

readme

LowkeyVault

GitHub license Java version latest-release Maven Central Docker Hub JavaCI

CII Best Practices code-climate-maintainability code-climate-tech-debt last_commit badge-abort-mission-armed-green

Lowkey Vault is a test double (fake object) aspiring to be compatible with Azure Key Vault REST APIs. The project aims to provide a low footprint alternative for the cases when using a real Key Vault is not practical or impossible.

Recommended use

[!WARNING]
Lowkey Vault is NOT intended as an Azure Key Vault replacement. Please do not attempt using it instead of the real service in production as it is not using any security measures to keep your secrets safe.

Valid use-cases

I have an app using Azure Key Vault and:

Quick start guide

Java

  1. Either download manually the Spring Boot app from the packages or use Maven Central.
  2. Start Lowkey Vault jar
  3. Use https://localhost:8443 as key vault URI when using the Azure Key Vault Key client or the Azure Key Vault Secret client and set any basic credentials (Lowkey Vault will check whether they are there but ignore the value.)
  4. If you are using more than one vaults parallel
    1. Either set up all of their host names in hosts to point to localhost
    2. Or, use the provider in lowkey-vault-client to handle the mapping for you
    3. (Or mimic the same using your HTTP client provider)
  5. Initialize your keys or secrets using the client
  6. Run your code
  7. Stop Lowkey Vault

Docker

[!NOTE]
A complex example is available here

  1. Pull the most recent version from nagyesta/lowkey-vault
    • You can find a list of all the available tags here
  2. docker run --rm -p 8443:8443 nagyesta/lowkey-vault:<version>
  3. Use https://localhost:8443 as key vault URI when using the Azure Key Vault Key client or the Azure Key Vault Secret client and set any basic credentials (Lowkey Vault will check whether they are there but ignore the value.)
  4. If you are using more than one vaults parallel
    1. Either set up all of their host names in hosts to point to localhost
    2. Or, use the provider in lowkey-vault-client to handle the mapping for you
    3. (Or mimic the same using your HTTP client provider)
  5. Initialize your keys or secrets using the client
  6. Run your code
  7. Stop Lowkey Vault

Testcontainers

See examples under Lowkey Vault Testcontainers.

Features

Lowkey Vault is far from supporting all Azure Key Vault features. The list supported functionality can be found here:

Keys

Secrets

Certificates

Management API

Functionality

Swagger

https://localhost:8443/api/swagger-ui/index.html

Port mappings (Default)

HTTP :8080

Only used for simulating Managed Identity Token endpoint /metadata/identity/oauth2/token?resource=<resource>.

[!TIP]
This endpoint provides the same Managed Identity stub as Assumed Identity. If you want to use Lowkey Vault with Managed Identity, this functionality allows you to do so with a single container.

HTTPS :8443

Startup parameters

  1. Using the .jar: Lowkey Vault App.
  2. Using Docker: Lowkey Vault Docker.
  3. Using Testcontainers: Lowkey Vault Testcontainers.

Example projects

  1. Java
  2. .Net
  3. Python
  4. Go
  5. Node.js
  6. Docker

Limitations