Skip to content

Commit 84de08b

Browse files
romdalfromdalf
authored
Merge pull request #11 from beezy-dev/vault
'cleaning up hvault code'
2 parents 9b2ca20 + c0802bd commit 84de08b

7 files changed

Lines changed: 87 additions & 54 deletions

File tree

‎cmd/kleidi/main.go‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,10 @@ func main() {
2020

2121
// Generic vars considering the consistency across providers.
2222
var (
23-
listenAddr = flag.String("listen", "unix:///tmp/kleidi/kleidi-kms-plugin.socket", "gRPC listen address.")
24-
providerService = flag.String("provider", "softhsm", "KMS provider to connect to (hvault, softhsm, tpm).")
25-
providerConfigFile = flag.String("configfile", "/opt/kleidi/config.json", "Provider config file pat.")
23+
listenAddr = flag.String("listen", "unix:///tmp/kleidi/kleidi-kms-plugin.socket", "gRPC listen address")
24+
providerService = flag.String("provider", "softhsm", "KMS provider to connect to (hvault, softhsm, tpm)")
25+
providerConfigFile = flag.String("configfile", "/opt/kleidi/config.json", "Provider config file pat")
26+
debugMode = flag.Bool("debugmode", false, "Enable debug mode")
2627
)
2728

2829
// Parsing environment variables.
@@ -57,9 +58,11 @@ func main() {
5758
log.Fatalln("EXIT: flag -configfile set to", providerConfig, "failed with error:\n", err.Error())
5859
}
5960

61+
debug := *debugMode
62+
6063
//Starting the appropriate provider once previously validated.
6164
//REFACTOR to a simple interface
6265

63-
utils.StartProvider(addr, provider, providerConfig)
66+
utils.StartProvider(addr, provider, providerConfig, debug)
6467

6568
}

‎configuration/k8s/encryption/vault-encryption-config.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,9 @@ resources:
55
- secrets
66
- configmaps
77
providers:
8+
- kms:
9+
apiVersion: v2
10+
name: kleidi-kms-plugin
11+
endpoint: unix:///tmp/kleidi/kleidi-kms-plugin.socket
12+
timeout: 5s
813
- identity: {}

‎configuration/testenv4kvault.sh‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -123,11 +123,7 @@ echo
123123
echo -e " -> Trigger Kind k8s API server restart"
124124
kubectl delete -n kube-system pod/kube-apiserver-kleidi-vault-control-plane
125125
echo -e " -> Sleeping for 10 seconds to allow kube-apiserver to restart"
126-
sleep 10
127-
128-
echo
129-
echo -e " -> Creating a post kleidi deployment Secret"
130-
kubectl create secret generic postkleidi -n default --from-literal=mykey=mydata
126+
sleep 30
131127

132128
echo
133129
echo -e " -> Checking a pre kleidi deployment Secret"
@@ -140,6 +136,10 @@ else
140136
echo -e " /!\ no unencrypted prekleidi Secret object found!"
141137
fi
142138

139+
echo
140+
echo -e " -> Creating a post kleidi deployment Secret"
141+
kubectl create secret generic postkleidi -n default --from-literal=mykey=mydata
142+
143143
echo
144144
echo -e " -> Checking a post kleidi deployment Secret"
145145
# kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/postkleidi" | hexdump -C
@@ -166,15 +166,15 @@ else
166166
echo -e " /!\ no encrypted prekleidi Secret object found!"
167167
fi
168168

169-
echo
170-
echo -e " -> Cleaning any existing vault test env"
171-
killall -9 vault ||true
169+
# echo
170+
# echo -e " -> Cleaning any existing vault test env"
171+
# killall -9 vault ||true
172172

173-
echo
174-
echo -e " -> Cleaning any existing kind test env"
175-
kind delete cluster --name kleidi-vault
173+
# echo
174+
# echo -e " -> Cleaning any existing kind test env"
175+
# kind delete cluster --name kleidi-vault
176176

177-
echo
178-
echo -e " -> Cleaning vault-encryption-config.yaml"
179-
cp k8s/encryption/vault-encryption-config-bkp.yaml k8s/encryption/vault-encryption-config.yaml
177+
# echo
178+
# echo -e " -> Cleaning vault-encryption-config.yaml"
179+
# cp k8s/encryption/vault-encryption-config-bkp.yaml k8s/encryption/vault-encryption-config.yaml
180180

‎internal/providers/hvault.go‎

Lines changed: 39 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,14 @@ type hvaultRemoteService struct {
2424
*api.Client
2525

2626
keyID string
27-
keypath string
27+
debug bool
2828
Address string `json:"Address"`
2929
Transitkey string `json:"Transitkey"`
3030
Vaultrole string `json:"Vaultrole"`
3131
Namespace string `json:"Namespace"`
3232
}
3333

34-
func NewVaultClientRemoteService(configFilePath string) (service.Service, error) {
34+
func NewVaultClientRemoteService(configFilePath string, debug bool) (service.Service, error) {
3535
ctx, err := os.ReadFile(configFilePath)
3636
if err != nil {
3737
log.Fatalln("EXIT:ctx: failed to read vault config file with error:\n", err.Error())
@@ -40,8 +40,14 @@ func NewVaultClientRemoteService(configFilePath string) (service.Service, error)
4040
log.Fatalln("EXIT:keyID len: invalid keyID")
4141
}
4242

43+
if debug {
44+
log.Println("DEBUG:--------------------------------------------------")
45+
log.Println("DEBUG: verifying keyID:", keyID)
46+
}
47+
4348
vaultService := &hvaultRemoteService{
4449
keyID: keyID,
50+
debug: debug,
4551
}
4652

4753
json.Unmarshal(([]byte(ctx)), &vaultService)
@@ -50,11 +56,18 @@ func NewVaultClientRemoteService(configFilePath string) (service.Service, error)
5056

5157
keypath := fmt.Sprintf("transit/keys/%s", vaultService.Transitkey)
5258

59+
if debug {
60+
log.Println("DEBUG:--------------------------------------------------")
61+
log.Println("DEBUG: unmarshal JSON values:", "\n -> vaultService.Address:", vaultService.Address, "\n -> vaultService.Trasitkey:", vaultService.Transitkey, "\n -> vaultService.Vaultrole:", vaultService.Vaultrole, "\n -> vaultService.Namespace:", vaultService.Namespace, "\n -> keypath:", keypath)
62+
}
63+
5364
client, err := api.NewClient(vaultconfig)
5465
if err != nil {
55-
log.Println("--------------------------------------------------------")
56-
log.Println("DEBUG:client: json.Unmarshal output from configFile:", "\n vaultService.Address:", vaultService.Address)
57-
log.Println("--------------------------------------------------------")
66+
if debug {
67+
log.Println("DEBUG:--------------------------------------------------")
68+
log.Println("DEBUG:client: json.Unmarshal output from configFile:", "\n vaultService.Address:", vaultService.Address)
69+
log.Println("DEBUG:--------------------------------------------------")
70+
}
5871
log.Fatalln("EXIT:client: failed to initialize Vault client with error:\n", err.Error())
5972
}
6073

@@ -63,9 +76,11 @@ func NewVaultClientRemoteService(configFilePath string) (service.Service, error)
6376
)
6477

6578
if err != nil {
66-
log.Println("--------------------------------------------------------")
67-
log.Println("DEBUG:k8sAuth: json.Unmarshal output from configFile:", "\n vaultService.Vaultrole:", vaultService.Vaultrole)
68-
log.Println("--------------------------------------------------------")
79+
if debug {
80+
log.Println("DEBUG:--------------------------------------------------")
81+
log.Println("DEBUG:k8sAuth: json.Unmarshal output from configFile:", "\n vaultService.Vaultrole:", vaultService.Vaultrole)
82+
log.Println("DEBUG:--------------------------------------------------")
83+
}
6984
log.Fatalln("EXIT:k8sAuth: unable to initialize Kubernetes auth method with error:\n", err.Error())
7085
}
7186

@@ -83,14 +98,13 @@ func NewVaultClientRemoteService(configFilePath string) (service.Service, error)
8398

8499
client.SetNamespace(vaultService.Namespace)
85100

86-
// //keypath := fmt.Sprintf("transit/keys/%s", vaultService.Transitkey)
87-
// keypath := "transit/keys/kleidi"
88-
89101
key, err := client.Logical().Read(keypath)
90102
if err != nil {
91-
log.Println("--------------------------------------------------------")
92-
log.Println("DEBUG:key: keypath:", keypath)
93-
log.Println("--------------------------------------------------------")
103+
if debug {
104+
log.Println("DEBUG:--------------------------------------------------")
105+
log.Println("DEBUG:key: keypath:", keypath)
106+
log.Println("DEBUG:--------------------------------------------------")
107+
}
94108
log.Fatalln("EXIT:key: unable to find transit key:\n", err.Error())
95109
}
96110

@@ -101,20 +115,22 @@ func NewVaultClientRemoteService(configFilePath string) (service.Service, error)
101115

102116
func (s *hvaultRemoteService) Encrypt(ctx context.Context, uid string, plaintext []byte) (*service.EncryptResponse, error) {
103117

104-
// log.Println("--------------------------------------------------------------------------------------------------")
105-
// log.Println("DEBUG: unencrypted payload:", string([]byte(plaintext)))
106-
// log.Println("--------------------------------------------------------------------------------------------------")
118+
if s.debug {
119+
log.Println("DEBUG:--------------------------------------------------")
120+
log.Println("DEBUG: unencrypted payload:", string([]byte(plaintext)))
121+
log.Println("DEBUG:--------------------------------------------------")
122+
}
107123

108-
// // keypath := fmt.Sprintf("transit/keys/%s", s.Transitkey)
124+
enckeypath := fmt.Sprintf("transit/encrypt/%s", s.Transitkey)
109125
// keypath := "transit/encrypt/kleidi"
110126
encodepayload := map[string]interface{}{
111127
"plaintext": base64.StdEncoding.EncodeToString(plaintext),
112128
}
113129

114-
encrypt, err := s.Logical().WriteWithContext(ctx, s.keypath, encodepayload)
130+
encrypt, err := s.Logical().WriteWithContext(ctx, enckeypath, encodepayload)
115131
if err != nil {
116132
log.Println("--------------------------------------------------------")
117-
log.Println("DEBUG:encrypt:", "\nplaintext:", string([]byte(plaintext)), "\nkeypath:", s.keypath, "\nencodepayload:", encodepayload)
133+
log.Println("DEBUG:encrypt:", "\nplaintext:", string([]byte(plaintext)), "\nkeypath:", enckeypath, "\nencodepayload:", encodepayload)
118134
log.Println("--------------------------------------------------------")
119135
log.Fatalln("EXIT:encrypt: with error:\n", err.Error())
120136
}
@@ -150,16 +166,17 @@ func (s *hvaultRemoteService) Decrypt(ctx context.Context, uid string, req *serv
150166
return nil, fmt.Errorf("/!\\ invalid keyID")
151167
}
152168

169+
decryptkeypath := fmt.Sprintf("transit/decrypt/%s", s.Transitkey)
153170
// // keypath := fmt.Sprintf("transit/keys/%s", s.Transitkey)
154171
// keypath := "transit/decrypt/kleidi"
155172
encryptedPayload := map[string]interface{}{
156173
"ciphertext": string([]byte(req.Ciphertext)),
157174
}
158175

159-
encryptedResponse, err := s.Logical().WriteWithContext(ctx, s.keypath, encryptedPayload)
176+
encryptedResponse, err := s.Logical().WriteWithContext(ctx, decryptkeypath, encryptedPayload)
160177
if err != nil {
161178
log.Println("--------------------------------------------------------")
162-
log.Println("DEBUG:encryptedResponse:", "\nkeypath:", s.keypath, "\nenresult:", encryptedPayload)
179+
log.Println("DEBUG:encryptedResponse:", "\nkeypath:", decryptkeypath, "\nenresult:", encryptedPayload)
163180
log.Println("--------------------------------------------------------")
164181
log.Fatalln("EXIT:encryptedResponse: with error:", err.Error())
165182
}

‎internal/utils/startprovider.go‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,19 +16,23 @@ const (
1616
socketTimeOut = 10 * time.Second
1717
)
1818

19-
func StartProvider(addr, provider, providerConfig string) {
19+
func StartProvider(addr, provider, providerConfig string, debug bool) {
2020

2121
switch provider {
2222
case "softhsm":
23-
startSofthsm(addr, provider, providerConfig)
23+
startSofthsm(addr, provider, providerConfig, debug)
2424
case "hvault":
25-
startHvault(addr, provider, providerConfig)
25+
startHvault(addr, provider, providerConfig, debug)
2626
case "tpm":
27-
startTpm(addr, provider, providerConfig)
27+
startTpm(addr, provider, providerConfig, debug)
2828
}
2929
}
3030

31-
func startSofthsm(addr, provider, providerConfig string) {
31+
func startSofthsm(addr, provider, providerConfig string, debug bool) {
32+
33+
if debug {
34+
log.Println("test")
35+
}
3236

3337
remoteKMSService, err := providers.NewPKCS11RemoteService(providerConfig, "kleidi-kms-plugin")
3438
if err != nil {
@@ -52,9 +56,9 @@ func startSofthsm(addr, provider, providerConfig string) {
5256
grpcService.Shutdown()
5357
}
5458

55-
func startHvault(addr, provider, providerConfig string) {
59+
func startHvault(addr, provider, providerConfig string, debug bool) {
5660

57-
remoteKMSService, err := providers.NewVaultClientRemoteService(providerConfig)
61+
remoteKMSService, err := providers.NewVaultClientRemoteService(providerConfig, debug)
5862
if err != nil {
5963
log.Fatalln("EXIT: remote KMS provider [", provider, "] failed with error:\n", err.Error())
6064
}
@@ -76,7 +80,11 @@ func startHvault(addr, provider, providerConfig string) {
7680

7781
}
7882

79-
func startTpm(addr, provider, providerConfig string) {
83+
func startTpm(addr, provider, providerConfig string, debug bool) {
84+
85+
if debug {
86+
log.Println("test")
87+
}
8088

8189
log.Println("BETA: flag -provider", provider, "with -listen", addr, "and -configfile", providerConfig, "currently unsafe to used in production.")
8290
providers.TmpPlaceholder()

‎results.sarif‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,13 +38,13 @@
3838
},
3939
"region": {
4040
"endColumn": 2,
41-
"endLine": 47,
41+
"endLine": 53,
4242
"snippet": {
4343
"text": "json.Unmarshal(([]byte(ctx)), \u0026vaultService)"
4444
},
4545
"sourceLanguage": "go",
4646
"startColumn": 2,
47-
"startLine": 47
47+
"startLine": 53
4848
}
4949
}
5050
}

‎scripts/prd/vault/env4kvault.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ sleep 30
128128

129129
echo
130130
echo -e " -> Checking a pre kleidi deployment Secret"
131-
# kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C
131+
# kubectl -n kube-system exec etcd-kleidi-vault-prd-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C
132132

133133
if kubectl -n kube-system exec etcd-kleidi-vault-prd-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C | grep mydata;
134134
then
@@ -144,7 +144,7 @@ kubectl create secret generic postkleidi -n default --from-literal=mykey=mydata
144144

145145
echo
146146
echo -e " -> Checking a post kleidi deployment Secret"
147-
# kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/postkleidi" | hexdump -C
147+
# kubectl -n kube-system exec etcd-kleidi-vault-prd-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/postkleidi" | hexdump -C
148148

149149
if kubectl -n kube-system exec etcd-kleidi-vault-prd-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/postkleidi" | hexdump -C | grep kms;
150150
then
@@ -160,7 +160,7 @@ echo -e " -> Performing replace of prekleidi"
160160
kubectl get secret prekleidi -o json | kubectl replace -f -
161161

162162
echo -e " -> Checking a pre kleidi Secret replace"
163-
# kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C
163+
# kubectl -n kube-system exec etcd-kleidi-vault-prd-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C
164164

165165
if kubectl -n kube-system exec etcd-kleidi-vault-prd-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C |grep kms;
166166
then
@@ -175,7 +175,7 @@ killall -9 vault ||true
175175

176176
echo
177177
echo -e " -> Cleaning any existing kind test env"
178-
kind delete cluster --name kleidi-vault
178+
kind delete cluster --name kleidi-vault-prd
179179

180180
echo
181181
echo -e " -> Cleaning vault-encryption-config.yaml"

0 commit comments

Comments
 (0)