Adapters

Every adapter per concern, from the registry in internal/port. To choose one, read choosing a deployment. To add one, read adding an adapter in a fork. The fit with presets is in ports and adapters.

Column	Meaning
Status	✅ implemented: built and registered. 💤 on request: in the catalogue, not built; start refuses it
AWS, Kubernetes, OpenBao	needs: the platform answer must be yes
kubernetes, lambda, process	✅: the sluis process may run there

One adapter can cover several hosts: the valkey adapter is ElastiCache, MemoryDB, in-cluster or external.

state

Adapter	Status	AWS	Kubernetes	OpenBao	kubernetes	lambda	process	What it is
dynamodb	✅ implemented	needs	-	-	✅	✅	✅	State, sessions included, in a DynamoDB table per module with per-item TTL.
kubernetes	💤 on request	-	needs	-	✅	-	-	State in a ConfigMap the service rebuilds and owns.
legacy	✅ implemented	-	needs	-	✅	-	✅	ConfigMaps and, optionally, Valkey sessions and leases; deprecated since v1.74.0, still the default (migrate with sluis migrate).
memory	✅ implemented	-	-	-	✅	✅	✅	In this process's memory; a restart loses it. For tests and the demonstration.
postgres	💤 on request	-	-	-	✅	✅	✅	State in a PostgreSQL table.
valkey	💤 on request	-	-	-	✅	✅	✅	State, sessions included, in Valkey.

secrets

Adapter	Status	AWS	Kubernetes	OpenBao	kubernetes	lambda	process	What it is
kubernetes	💤 on request	-	needs	-	✅	-	-	Dynamic secrets as Kubernetes Secrets the service writes.
legacy	✅ implemented	-	needs	-	✅	-	✅	Kubernetes Secrets the service writes; deprecated since v1.74.0, still the default.
memory	✅ implemented	-	-	-	✅	✅	✅	In this process's memory; a restart loses it. For tests and the demonstration.
openbao	✅ implemented	-	-	needs	✅	✅	✅	Dynamic secrets as KV version 2 secrets in an OpenBao mount, laid out under its own private/ and export/ trees; logs in with a ServiceAccount or web identity JWT.
ssm	✅ implemented	needs	-	-	✅	✅	-	Dynamic secrets as SecureString parameters in AWS SSM Parameter Store (layout v5).
store	💤 on request	-	-	-	✅	✅	✅	Secrets in the service's own encrypted store, for a platform with no secret store.

blobs

Adapter	Status	AWS	Kubernetes	OpenBao	kubernetes	lambda	process	What it is
legacy	✅ implemented	-	needs	-	✅	-	✅	Reports and snapshots in ConfigMaps or Valkey; deprecated since v1.74.0, still the default.
memory	✅ implemented	-	-	-	✅	✅	✅	In this process's memory; a restart loses it. For tests and the demonstration.
off	💤 on request	-	-	-	✅	✅	✅	No blob storage: reports and snapshots are not kept.
postgres	💤 on request	-	-	-	✅	✅	✅	Blobs in PostgreSQL large objects.
s3	✅ implemented	needs	-	-	✅	✅	✅	Blobs in an S3 bucket, optionally under SSE-KMS.

signing

Adapter	Status	AWS	Kubernetes	OpenBao	kubernetes	lambda	process	What it is
file	✅ implemented	-	-	-	✅	✅	✅	Signing keys read from files the platform mounts (signingKey).
generated	💤 on request	-	-	-	✅	✅	✅	A token-signing key generated at start and shared through state.
kms	✅ implemented	needs	-	-	✅	✅	-	Token signing by AWS KMS keys (ES384 on ECC_NIST_P384, and RS256 on RSA); the private key never leaves KMS (signingKey.kms).
kms-wrapped	✅ implemented	needs	-	-	✅	✅	-	Token signing by key pairs AWS KMS generates and wraps under one symmetric key, rotated automatically (ES384 and RS256); the private key is decrypted into process memory to sign (signingKey.kmsWrapped).
transit	💤 on request	-	-	needs	✅	✅	✅	Token signing by an OpenBao transit key.

trigger

Adapter	Status	AWS	Kubernetes	OpenBao	kubernetes	lambda	process	What it is
dynamodb	✅ implemented	needs	-	-	✅	✅	✅	Notifications over the same table.
http	💤 on request	-	-	-	✅	✅	✅	"Run a pass now" from an authenticated HTTP request.
invoke	✅ implemented	needs	-	-	-	✅	-	"Run a pass now" as an asynchronous Lambda invoke of the controller function.
legacy	✅ implemented	-	needs	-	✅	-	✅	An in-process trigger: a notification reaches only this process.
memory	✅ implemented	-	-	-	✅	✅	✅	In this process's memory; a restart loses it. For tests and the demonstration.
watch	💤 on request	-	needs	-	✅	-	-	"Run a pass now" from a Kubernetes watch.

schedule

Adapter	Status	AWS	Kubernetes	OpenBao	kubernetes	lambda	process	What it is
eventbridge	✅ implemented	needs	-	-	-	✅	-	One EventBridge Scheduler schedule per target invokes the controller function with {"kind":"tick","controller":"","target":""}.
ticker	✅ implemented	-	-	-	✅	-	✅	An in-process interval timer.

audit

Adapter	Status	AWS	Kubernetes	OpenBao	kubernetes	lambda	process	What it is
connect	✅ implemented	-	-	-	✅	✅	✅	Events sent to the audit installation's receiver (audit.writer).
log	✅ implemented	-	-	-	✅	✅	✅	Events written to the log only.
sqs	✅ implemented	needs	-	-	✅	✅	-	Events published to an SQS queue the audit writer Lambda consumes (settings queueURL, region, endpoint, timeout; the catalogue travels with the writer's package).

Presets

The adapter each preset names per concern. 💤 on request marks an adapter that is not built.

Concern	server	k8s-minimal	k8s-openbao	aws-serverless	aws-hybrid	k8s-aws
state	postgres 💤	kubernetes 💤	kubernetes 💤	dynamodb	dynamodb	dynamodb
secrets	store 💤	kubernetes 💤	openbao	ssm	ssm	ssm
blobs	postgres 💤	off 💤	off 💤	s3	s3	s3
signing	generated 💤	file	transit 💤	kms-wrapped	kms-wrapped	kms-wrapped
trigger	http 💤	watch 💤	watch 💤	invoke	invoke	dynamodb
schedule	ticker	ticker	ticker	eventbridge	eventbridge	ticker
audit	log	log	log	sqs	sqs	connect

Availability

A preset that names an unbuilt adapter is unavailable. Start refuses it unless adapters replaces every planned adapter it names.

Unavailable preset	Why
server	its state, secrets, blobs, signing and trigger adapters (postgres, store, generated, http) are planned and not built.
k8s-minimal	its state, secrets, blobs and trigger adapters (kubernetes, off, watch) are planned and not built.
k8s-openbao	its state, blobs, signing and trigger adapters (kubernetes, off, transit, watch) are planned and not built.

Available: aws-serverless, aws-hybrid, k8s-aws.

The deprecated name aws-eks resolves to k8s-aws, and start warns.