Closed andaryjo closed 5 months ago
Unfortunately based on https://github.com/lukasjarosch/skipper/pull/51, something went wrong with the branches there.
This is the URI for key versions, and supported within the SDK, but it the API throws me an error
So I figured this one out. The decrypt method does actually not support specification of a key version, as you can see here.
The resource name of the CryptoKey to use for decryption. The server will choose the appropriate version.
This means we will need to omit the key version - if specified - for the decrypt request from the key name.
Implementation of https://github.com/lukasjarosch/skipper/issues/46
Adds the GCP KMS Secrets Driver. To use it add following to your
<target>.skipper.secrets.drivers
target configuration:The key name represents the full key URI. The naming scheme might be confusing but is consistent with the SDK. Both the URI and the key name are called name. I did not (yet) implement the option to provide project, location, key ring, etc. as dedicated arguments because as opposed to the Azure SDK, the GCP SDK wants to have the URI for the request. Let me know if you think the single arguments implementation should be included as well.
Open issues
Fixed:
I'm still struggling with key versions. With Cloud KMS, rotating a key does not disable older versions and you can still decrypt secrets with the older version without actually needing to specify the version, even if you changed the primary (default) version. Somehow that just works until you disable the old version.In theory you should be able to specify the key version by appending it to the URI:projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<keyname>/cryptoKeyVersions/<version>
. This is the URI for key versions, and supported within the SDK (as you can see here), but it the API throws me an error and I wasn't successful fixing this yet:Testing instructions
Configure the GCP KMS Secret Driver in your target as stated above.
Make sure skipper can authenticate itself against Google Cloud by either pointing to service account credentials with the
GOOGLE_APPLICATION_CREDENTIALS
environment variable or runninggcloud auth application-default login
to let skipper authenticate itself as you. As this is a test environment, just be the owner of the project to not worry about permissions.Run skipper.