sneakers-release

module

v0.1.0-rc.3 Latest Latest Go to latest Published: Oct 24, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Sneakers-PAM/sneakers-release

Links

Open Source Insights

README ¶

Release 📦

🧭 The Sneakers release: Helm charts for every service and the pinned manifest that holds k0s, every image and every third-party component at one version.

A Sneakers release is applied whole. manifest/release.yaml names every service image, the k0s version and each third-party chart and image; the charts in charts/ pin the same versions, and CI fails when the two disagree.

🧭 Which way to run Sneakers

🖥️ The appliance (recommended): a single-node k0s image built from an org-signed release, with the maintenance screen, scheduled automatic updates, database snapshots and automatic rollback. See the sneakers-appliance repository.
☸️ Helm on your own Kubernetes (supported alternative): the sneakers umbrella chart in this repository. You run upgrades, backups and the cluster yourself; there is no maintenance screen and no automatic update window.

✨ Highlights

🧩 One chart per service: identity, vault, workflow, audit, notify, connector, sshbroker, gateway, mcp and the two web apps (web-staff, web-admin), each usable alone, plus the sneakers umbrella that installs them together.
🔌 Bundled or bring your own: PostgreSQL, Valkey and Ory Kratos come bundled and on by default; Ory Hydra is bundled and off. Turn any of them off and point the services at your own.
🛡️ Production-safe defaults: JSON logs at error level, requests and limits, non-root pods on a read-only root filesystem, NetworkPolicies, PodDisruptionBudgets and a schema for every chart's values.
📌 Pinned: every third-party chart and image is pinned by version and digest.
🔁 Migration: sneakers-migrate (migrate/) exports an install of the original system to one encrypted bundle, imports it into a fresh install and verifies counts, the audit chain, sample reveals and targets. For the move onto the appliance it re-maps folders, names and types from an approved mapping file, carries current values only, resets every sign-in and checks parity (docs/migrate-appliance.md).

🚀 Install with Helm

helm repo add valkey https://valkey.io/valkey-helm/
helm repo add ory https://k8s.ory.sh/helm/charts
helm dependency build charts/sneakers

kubectl create namespace sneakers
kubectl -n sneakers create secret generic sneakers-vault-root-key \
  --from-literal=VAULT_ROOT_KEK="$(openssl rand -base64 32)"

helm install sneakers charts/sneakers -n sneakers \
  --set global.host=sneakers.example.org \
  --set vault.secretEnv.VAULT_ROOT_KEK.secretName=sneakers-vault-root-key
helm test sneakers -n sneakers

The charts aren't published to a registry yet, so install from a checkout. Back up the root key Secret with the database: without it no stored secret can be opened.

📚 Where to look

docs/install.md: requirements, installing, ingress, bringing your own PostgreSQL, Valkey or Kratos, upgrades and uninstalling.
docs/values.md: every value of the umbrella and the service charts.
docs/release-checks.md: the manual checks run on a release candidate before it's tagged.
docs/migrate.md: sneakers-migrate, the rehearsals and the cutover runbook.
docs/release.md: how a release is cut, and its GitHub production environment.
manifest/release.yaml: the pinned release.

🛠️ Develop

scripts/install-tools.sh bin helm kubeconform   # pinned, checksum-checked tools
PATH="$PWD/bin:$PATH" scripts/check-charts.sh  # lint, render, schemas, defaults, edges, manifest

The install test (test/kind/run.sh, run by the Install Test workflow) builds every service image from its repository, installs the umbrella on a throwaway kind cluster, upgrades it in place, runs helm test and checks that each service's port takes only its callers, and that a callee refuses a caller with the wrong service account. It runs twice: with the chart defaults on amd64, and with the small-box example values on an arm64 runner (ubuntu-24.04-arm), where every image is built natively for arm64. Both record each pod's peak memory (test/kind/memory-peak.sh) and fail when the sum passes 4 GiB. The arm64 job isn't a required check.

The migration rehearsal (test/migrate/rehearsal.sh, run by the Migrate Rehearsal workflow) seeds a synthetic source in the original schema and runs export, import and verify against the umbrella in rehearsal mode, with its negative tests. go test ./... runs the tool's tests; set MIGRATE_TEST_PG to an admin Postgres DSN for the integration tests.

🙏 Acknowledgements

Sneakers-PAM was originally written by @Bugs5382.

🔐 Export compliance

Sneakers-PAM is published from the United States and uses only standard, publicly available cryptography; see CRYPTO.md. You are responsible for complying with applicable export control and sanctions laws, including not using, exporting or re-exporting it in violation of those laws or if you are on a restricted-party list.

⚖️ License

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
gen
go/thirdparty/audit/v1
go/thirdparty/vault/v1
migrate
cmd/sneakers-migrate command Command sneakers-migrate moves an install of the original system to Sneakers-PAM: keygen, export, import and verify.	Command sneakers-migrate moves an install of the original system to Sneakers-PAM: keygen, export, import and verify.
internal/bundle Package bundle is the migration bundle: a manifest plus one newline-delimited JSON stream per table, packed as a gzipped tar and encrypted with age (X25519) to the target's import key.	Package bundle is the migration bundle: a manifest plus one newline-delimited JSON stream per table, packed as a gzipped tar and encrypted with age (X25519) to the target's import key.
internal/chain Package chain recomputes and checks the audit service's hash chain.	Package chain recomputes and checks the audit service's hash chain.
internal/codes Package codes holds sneakers-migrate's error codes.	Package codes holds sneakers-migrate's error codes.
internal/commands Package commands holds the sneakers-migrate command line.	Package commands holds the sneakers-migrate command line.
internal/config Package config reads sneakers-migrate's connection settings and keys from the environment.	Package config reads sneakers-migrate's connection settings and keys from the environment.
internal/connect Package connect makes sneakers-migrate's first connection to each service it talks to (a database, a gRPC service, Kratos) wait until the service is reachable, for up to a minute.	Package connect makes sneakers-migrate's first connection to each service it talks to (a database, a gRPC service, Kratos) wait until the service is reachable, for up to a minute.
internal/envelope Package envelope reads and writes the original vault's sealed records: each field sealed with AES-256-GCM under a per-record data key (DEK), with the field name as additional data, and the DEK wrapped by a working key named by the record's KeyRef.	Package envelope reads and writes the original vault's sealed records: each field sealed with AES-256-GCM under a per-record data key (DEK), with the field name as additional data, and the DEK wrapped by a working key named by the record's KeyRef.
internal/kratos Package kratos is a small client for the Ory Kratos admin API: listing identities with their password hashes, creating identities from those hashes, and the few calls import and verify need.	Package kratos is a small client for the Ory Kratos admin API: listing identities with their password hashes, creating identities from those hashes, and the few calls import and verify need.
internal/kratos/kratostest Package kratostest is an in-memory stand-in for the Kratos admin API, for tests: list (paged, with password hashes on request), create (from a hash or a password), get, replace, delete, lookup by identifier and version.	Package kratostest is an in-memory stand-in for the Kratos admin API, for tests: list (paged, with password hashes on request), create (from a hash or a password), get, replace, delete, lookup by identifier and version.
internal/mapping Package mapping turns bundle rows (the source layout) into rows for the target baselines, and closes what can't carry over: in-flight approvals, check-outs, uses and rotation claims end "by migration", each with an event for the audit trail.	Package mapping turns bundle rows (the source layout) into rows for the target baselines, and closes what can't carry over: in-flight approvals, check-outs, uses and rotation claims end "by migration", each with an event for the audit trail.
internal/report Package report is the record of an import or a verify run: ids, counts and results only.	Package report is the record of an import or a verify run: ids, counts and results only.
internal/rpc Package rpc holds the gRPC clients import and verify use: the target vault (seal for import, reveal, targets) and the target audit service (record an event, verify the chain).	Package rpc holds the gRPC clients import and verify use: the target vault (seal for import, reveal, targets) and the target audit service (record an event, verify the chain).
internal/schema Package schema names the tables sneakers-migrate moves: the source profile it knows how to read, the order tables are written in, and what each table needs on the way (sealed values, seed rows, transient rows left behind).	Package schema names the tables sneakers-migrate moves: the source profile it knows how to read, the order tables are written in, and what each table needs on the way (sealed values, seed rows, transient rows left behind).
internal/settings Package settings reviews the imported security settings against the target vault's defaults.	Package settings reviews the imported security settings against the target vault's defaults.
internal/source Package source exports the original system: it reads each service database in one read-only snapshot, opens sealed values with the original key ring in memory, reads the Kratos identities with their password hashes, checks the audit chain, and builds the bundle.	Package source exports the original system: it reads each service database in one read-only snapshot, opens sealed values with the original key ring in memory, reads the Kratos identities with their password hashes, checks the audit chain, and builds the bundle.
internal/synth Package synth lays down an invented dataset in the original system's schema: users with passwords and TOTP, groups, folders and rules, secrets with several versions sealed under an invented key ring, targets, schedules, open approvals and check-outs, and a valid audit chain.	Package synth lays down an invented dataset in the original system's schema: users with passwords and TOTP, groups, folders and rules, secrets with several versions sealed under an invented key ring, targets, schedules, open approvals and check-outs, and a valid audit chain.
internal/target Package target imports a bundle into a fresh Sneakers-PAM install: Kratos identities through the admin API, every service database through its own baseline layout in one transaction per service, secret values re-sealed by the target vault, the audit chain inserted raw, then the migration's own audit entries appended through the audit service.	Package target imports a bundle into a fresh Sneakers-PAM install: Kratos identities through the admin API, every service database through its own baseline layout in one transaction per service, secret values re-sealed by the target vault, the audit chain inserted raw, then the migration's own audit entries appended through the audit service.
internal/testenv Package testenv builds the databases the integration tests run against: a synthetic source in the source profile's schema, and an empty target in the layout of the Sneakers-PAM baselines.	Package testenv builds the databases the integration tests run against: a synthetic source in the source profile's schema, and an empty target in the layout of the Sneakers-PAM baselines.
internal/testpg Package testpg gives integration tests throwaway Postgres databases on the server named by MIGRATE_TEST_PG (an admin DSN).	Package testpg gives integration tests throwaway Postgres databases on the server named by MIGRATE_TEST_PG (an admin DSN).
internal/totpcipher Package totpcipher reads and writes the identity service's at-rest form of a TOTP shared secret: base64(nonce \|\| AES-256-GCM) under TOTP_ENC_KEY, a 32-byte key given as hex or standard base64.	Package totpcipher reads and writes the identity service's at-rest form of a TOTP shared secret: base64(nonce \|\| AES-256-GCM) under TOTP_ENC_KEY, a 32-byte key given as hex or standard base64.
internal/verify Package verify checks a target against the bundle it was imported from: per-table counts, the audit chain from genesis to head, sample reveals of current values matched by keyed hash (never printed), every secret's older versions by number, timestamp and sealed fields (never revealed), and that every target resolves to a connection and its secrets, the dry run of a connection test.	Package verify checks a target against the bundle it was imported from: per-table counts, the audit chain from genesis to head, sample reveals of current values matched by keyed hash (never printed), every secret's older versions by number, timestamp and sealed fields (never revealed), and that every target resolves to a connection and its secrets, the dry run of a connection test.
internal/wait Package wait blocks until sneakers-migrate's dependencies answer: a DNS name resolves, then each TCP target accepts a connection, in the order given.	Package wait blocks until sneakers-migrate's dependencies answer: a DNS name resolves, then each TCP target accepts a connection, in the order given.
test/synth command Command synth stands up the synthetic source for a rehearsal: it applies the source schema to four empty databases and seeds them, and the source Kratos, with an invented dataset sealed under freshly generated keys.	Command synth stands up the synthetic source for a rehearsal: it applies the source schema to four empty databases and seeds them, and the source Kratos, with an invented dataset sealed under freshly generated keys.