search

tintoy / dotnet-kube-client

A Kubernetes API client for .NET Standard / .NET Core
MIT License
192 stars 33 forks source link

KubeClient & Core Data Protection #94

Closed rriverak closed 6 months ago

rriverak commented 5 years ago

Hey, thank you for this very handy client!
I currently have the need to enable Data Protection in my distributed dotnet application(s).

I would like to use native Kubernetes Secrets for this. A third-party Secret-Vault like HashiCorp Vault seems oversized to me. In my opinion, this scenario can be covered by Kubernetes alone.

A Package based on KubeClient.Extensions.Configuration could do that safely and quickly.

I think we just need some GlueCode between DataProtection and KubeClient.

services.AddDataProtection()
// Get Key-Signing Certificate from a Kuberenetes Secret
.ProtectKeysWithKubernetesSecret(...)
// Store signed Rotated-Keys in a Kubernetes Secret
.PersistKeysToKubernetesSecret(...)

It would then end in an KubeClient.Extensions.DataProtection package.

How can I contribute something like that? or do you see something like this outside of this project?

tintoy commented 5 years ago

Hi - this sounds like a great idea :)

I’m happy for you to open a PR if you would like to have a go at this (and am happy to help out if there’s anywhere you get stuck that I actually know something about).

tintoy commented 5 years ago

If you’re not sure how to start I could create a branch and sketch out the project structure so you could drop your code in)...

rriverak commented 5 years ago

Hey, thanks for the very fast answer :) I would first write a small application and test the procedure in minikube.

If this works as expected, I will transfer it to a netstandard2.0 library. After or during that, I would contact you again to get a branch and sketch out the project structure.

Many thanks!

rriverak commented 5 years ago

Soo, after the first few test.. I would not build ontop of KubeClient.Extensions.Configuration package..
The Idea was to hook the secret loading implementation but theres I see no clean way outside of IConfiguration...

The real Proleme here is that the IConfiguration contains the plain DataProtection Keys over the hole runtime and this could be a bad idea ;)

For now, I start the implementation with the pure KubeClient and request / create / update the Secret directly...

rriverak commented 5 years ago

That seems to work well now.

Here is my test repository: https://github.com/rriverak/KubeClient.Extensions.DataProtection

tintoy commented 5 years ago

Wow - you work fast :)

I'm happy to handle this 1 of 2 ways (although feel free to suggest something else if you have other preferences):

  1. I can pull your code into this repository and get it released and published along the rest of KubeClient (I'll add you as a repo contributor so you can help maintain it).
  2. I can help you set up CI to get your package built and published from your own repo in a way that's similar/compatible to how it's done for KubeClient (you'll decide when you want to release new versions of you your package). Given the way KubeClient was designed and built, this is also a totally valid way to release additional functionality for it.
rriverak commented 5 years ago

I'm a fan of monorepos ;-) I would be very happy to see my code in the KubeClient repository :)

tintoy commented 5 years ago

Ok, I’ll have a go at integrating your code this weekend on a branch and get you do do a review when it’s ready. How’s that sound?

tintoy commented 5 years ago

What version of ASP.NET Core are you expecting to target? This will affect the library’s TargetFramework (I think 3.x, for example, only supports netcoreapp from memory but I could be mistaken - I’m on my phone at the moment).

tintoy commented 5 years ago

(technically netstandard2.1 but we’ll have to multi-target if you want to support ASP.NET Core 2.x as well)

rriverak commented 5 years ago

I think it's good to support .NET Core 2.2. After all, there is an LTS release for .NET Core 2.2.

The target of Microsoft.AspNetCore.DataProtection 2.2.x isnetstandard2.0. I think we can follow that for now.

In 3.0.0-preview9 they target both netstandard2.0;netcoreapp3.0

tintoy commented 5 years ago

Good-o, I’ll get started on this first thing tomorrow (it’s 10pm here).

rriverak commented 5 years ago

many thanks for your effort! I have no time pressure on this topic. :)

tintoy commented 5 years ago

Sorry this has taken so long, work’s been a bit crazy!

I’m going to try to get this finished off over the weekend.

tintoy commented 5 years ago

Ok - I've published a build of the new package to the dev package feed (https://www.myget.org/F/dotnet-kube-client/api/v3/index.json).

Would you mind trying out the package and letting me know if it works for you? You're looking for KubeClient.Extensions.DataProtection, version 2.4.0-data-protection0006.

tintoy commented 6 months ago

And, years later, this has finally been implemented; sorry it took so long 🙂

Published as KubeClient.Extensions.DataProtection v2.5.8.