Hashicorp Vault KMS Support

ctrlplane / copilot

Key broker service

GNU General Public License v3.0

1 stars 1 forks source link

Hashicorp Vault KMS Support #4

Open ekwisnek opened 2 years ago

ekwisnek commented 2 years ago

Add Hashicorp Vault KMS interaction support for fetching secrets.

[x] AppRole authentication method
[ ] Correlate kek_id from request schema with secret ID in Vault path
[ ] Return key to pilot from Vault

I don't think we should integrate any authorization decisions at this point. Assume that all pilot instances are authorized to have all keys just to implement that end-to-end exchange.

ekwisnek commented 2 years ago

I created the AppRole auth method and added the credentials as Kubernetes secrets in the ctrlplane-dev namespace on the dev cluster. I can provide them via other means if necessary. I don't know how Spring Cloud Vault wants them.

EDIT: I looked it up, and I can create a secret like this if you want:

spring.cloud.vault:
    authentication: APPROLE
    app-role:
        role-id: <role-id>
        secret-id: <secret-id>
        role: copilot
        app-role-path: approle