Vault is Gaucho Racing's internal secrets manager for shared credentials, application secrets, and workflow automation secrets. It provides a Sentinel-backed web interface for storing account credentials, TOTP seeds, notes, API keys, and app-scoped secrets with group-based access controls.

Vault also powers secret delivery to GitHub Actions and Kubernetes clusters through OIDC. Callers request explicit app-secret selectors, and Vault evaluates its rules against the caller identity — repository/ref for Actions, cluster/namespace/service account for Kubernetes — before returning any values.

Production: vault.gauchoracing.com

• Sentinel SSO and group-based access for accounts and app-secret applications.
• Encrypted account secrets for passwords, TOTP seeds, API keys, URLs, notes, and custom secret types.
• App secrets referenced by selectors such as mapache-prod.sentinel_client_id.
• GitHub Actions OIDC rules for exporting selected app secrets to trusted workflows.
• Kubernetes OIDC rules for materializing app secrets into cluster Secret resources via vault-k8s-operator.
• Audit logs for account and secret views, with duplicate view events debounced.
• Multi-architecture server and web images published to GitHub Container Registry.

Run the local development stack with Docker Compose:

docker compose up --build

The development proxy serves Vault at:

http://localhost:10310

The API is available under:

http://localhost:10310/api

The compose stack starts:

• vault: Go API server
• web: React/Vite frontend
• db: PostgreSQL
• kerbecs: local reverse proxy

Run backend checks:

cd vault
go test ./...

Run frontend checks:

cd web
npm install
npm run lint
npm run build

Vault exposes a GitHub Actions OIDC export endpoint for app secrets. Rules are managed from the Vault settings page and can be created by users with sentinel:all, Admins, or DevopsMembers access.

Use the dedicated action repository to pull secrets in workflows:

• Gaucho-Racing/vault-pull-secrets

Example:

permissions:
  id-token: write
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: Gaucho-Racing/vault-pull-secrets@v1
        with:
          secrets: pypi.publish_token

Vault exposes a Kubernetes OIDC export endpoint that materializes app secrets into cluster Secret resources. Register a cluster and a matching rule from Vault settings, then let the vault-k8s-operator reconcile secrets into workloads.

Example VaultSecretSync:

apiVersion: vault.gauchoracing.com/v1alpha1
kind: VaultSecretSync
metadata:
  name: sentinel-secrets
  namespace: sentinel
spec:
  serviceAccountName: default
  target:
    name: sentinel-secrets
  rolloutTargets:
    - kind: Deployment
      name: core
  secrets:
    DATABASE_PASSWORD: gr-postgres.database_password
    DISCORD_TOKEN: sentinel-prod.discord_token

Create a new Vault release from an up-to-date main branch:

scripts/release.sh 1.5.2

The release workflow publishes versioned vault-server and vault-web images, then opens an infrastructure PR to deploy the new image tags.

• Sentinel: authentication and access management
• Vault Pull Secrets: GitHub Action for exporting Vault app secrets
• Vault K8s Operator: Kubernetes operator that syncs Vault app secrets into cluster Secret resources

1. Fork the project.
2. Create your feature branch (git checkout -b gh-username/my-amazing-feature).
3. Commit your changes (git commit -m 'Add my amazing feature').
4. Push to the branch (git push origin gh-username/my-amazing-feature).
5. Open a pull request.