Skip to content

Commit bd49798

Browse files
romdalfromdalf
authored
Merge pull request #12 from beezy-dev/vault
Vault
2 parents 84de08b + 6cd8161 commit bd49798

10 files changed

Lines changed: 110 additions & 74 deletions

File tree

‎configuration/k8s/deploy/vault-pod-kleidi-kms.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,11 @@ spec:
1212
hostNetwork: true
1313
containers:
1414
- name: kleidi-kms-plugin
15-
image: ghcr.io/beezy-dev/kleidi-kms-plugin:vault-1283a8e
15+
image: ghcr.io/beezy-dev/kleidi-kms-plugin:vault-dev
1616
imagePullPolicy: Always
1717
args:
1818
- -provider=hvault
19+
- -debugmode=true
1920
resources:
2021
limits:
2122
cpu: 300m

‎configuration/k8s/encryption/vault-encryption-config.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,4 @@ resources:
55
- secrets
66
- configmaps
77
providers:
8-
- kms:
9-
apiVersion: v2
10-
name: kleidi-kms-plugin
11-
endpoint: unix:///tmp/kleidi/kleidi-kms-plugin.socket
12-
timeout: 5s
138
- identity: {}

‎configuration/kleidi/vault-config.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"Namespace": "",
3-
"Transitkey": "kleidi",
4-
"Vaultrole": "kleidi",
5-
"Address": "http://10.89.0.1:8200"
2+
"namespace": "",
3+
"transitkey": "kleidi",
4+
"vaultrole": "kleidi",
5+
"address": "http://10.89.0.1:8200"
66
}

‎configuration/testenv4kvault.sh‎

Lines changed: 56 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,9 @@ fi
6666
echo -ne ".OK (${NODEVERSION})\n"
6767

6868
echo
69-
echo -e " -> Creating a pre kleidi deployment Secret"
70-
kubectl create secret generic prekleidi -n default --from-literal=mykey=mydata
69+
echo -e " -> Creating 990 pre kleidi deployment Secrets"
70+
# kubectl create secret generic prekleidi -n default --from-literal=mykey=mydata
71+
for i in {10..1000}; do kubectl create secret generic prekleidi$i --from-literal=mykey=mydata; done
7172

7273
echo
7374
echo -e " -> Creating kleidi k8s ServiceAccount/SA Secret/RBAC"
@@ -122,59 +123,74 @@ cp k8s/encryption/vault-encryption-config-with_kms.yaml k8s/encryption/vault-enc
122123
echo
123124
echo -e " -> Trigger Kind k8s API server restart"
124125
kubectl delete -n kube-system pod/kube-apiserver-kleidi-vault-control-plane
125-
echo -e " -> Sleeping for 10 seconds to allow kube-apiserver to restart"
126-
sleep 30
126+
echo -e " -> Sleeping for 30 seconds to allow kube-apiserver to restart"
127127

128-
echo
129-
echo -e " -> Checking a pre kleidi deployment Secret"
128+
# echo
129+
# echo -e " -> Checking a pre kleidi deployment Secret"
130130
# kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C
131131

132-
if kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C | grep mydata;
133-
then
134-
echo -e " unencrypted prekleidi Secret object found :)"
135-
else
136-
echo -e " /!\ no unencrypted prekleidi Secret object found!"
137-
fi
132+
# if kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C | grep mydata;
133+
# then
134+
# echo -e " unencrypted prekleidi Secret object found :)"
135+
# else
136+
# echo -e " /!\ no unencrypted prekleidi Secret object found!"
137+
# fi
138+
139+
rvho
140+
echo -e " -> Checking a pre kleidi deployment Secret"
141+
for i in {10..1000}; do kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi$i" | hexdump -C | grep Opaque; done | wc -l
138142

139143
echo
140-
echo -e " -> Creating a post kleidi deployment Secret"
141-
kubectl create secret generic postkleidi -n default --from-literal=mykey=mydata
144+
echo -e " -> Creating 990 post kleidi deployment Secrets"
145+
# kubectl create secret generic postkleidi -n default --from-literal=mykey=mydata
146+
for i in {10..1000}; do kubectl create secret generic postkleidi$i --from-literal=mykey=mydata; done
142147

143-
echo
144-
echo -e " -> Checking a post kleidi deployment Secret"
148+
# echo
149+
# echo -e " -> Checking a post kleidi deployment Secret"
145150
# kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/postkleidi" | hexdump -C
146151

147-
if kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/postkleidi" | hexdump -C | grep kms;
148-
then
149-
echo -e " encrypted postkleidi Secret object found :)"
150-
else
151-
echo -e " /!\ no encrypted postkleidi Secret object found!"
152-
exit
153-
fi
152+
# if kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/postkleidi" | hexdump -C | grep kms;
153+
154+
# then
155+
# echo -e " encrypted postkleidi Secret object found :)"
156+
# else
157+
# echo -e " /!\ no encrypted postkleidi Secret object found!"
158+
# exit
159+
# fi
160+
161+
echo
162+
echo -e " -> Checking a post kleidi deployment Secret"
163+
for i in {10..1000}; do kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/postkleidi$i" | hexdump -C | grep vault; done | wc -l
154164

155165
echo
156166
echo -e " -> Performing replace of prekleidi"
157-
kubectl get secret prekleidi -o json | kubectl replace -f -
167+
# kubectl get secret prekleidi -o json | kubectl replace -f -
168+
for i in {10..1000}; do kubectl get secret prekleidi$i -o json | kubectl replace -f -; done
158169

159-
echo -e " -> Checking a pre kleidi Secret replace"
170+
171+
# echo -e " -> Checking a pre kleidi Secret replace"
160172
# kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C
161173

162-
if kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C |grep kms;
163-
then
164-
echo -e " encrypted prekleidi Secret object found :)"
165-
else
166-
echo -e " /!\ no encrypted prekleidi Secret object found!"
167-
fi
174+
# if kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi" | hexdump -C |grep kms;
175+
# then
176+
# echo -e " encrypted prekleidi Secret object found :)"
177+
# else
178+
# echo -e " /!\ no encrypted prekleidi Secret object found!"
179+
# fi
168180

169-
# echo
170-
# echo -e " -> Cleaning any existing vault test env"
171-
# killall -9 vault ||true
181+
echo
182+
echo -e " -> Checking a pre kleidi Secret replace"
183+
for i in {10..1000}; do kubectl -n kube-system exec etcd-kleidi-vault-control-plane -- sh -c "ETCDCTL_ENDPOINTS='https://127.0.0.1:2379' ETCDCTL_CACERT='/etc/kubernetes/pki/etcd/ca.crt' ETCDCTL_CERT='/etc/kubernetes/pki/etcd/server.crt' ETCDCTL_KEY='/etc/kubernetes/pki/etcd/server.key' ETCDCTL_API=3 etcdctl get /registry/secrets/default/prekleidi$i" | hexdump -C | grep vault; done | wc -l
172184

173-
# echo
174-
# echo -e " -> Cleaning any existing kind test env"
175-
# kind delete cluster --name kleidi-vault
185+
echo
186+
echo -e " -> Cleaning any existing vault test env"
187+
killall -9 vault ||true
176188

177-
# echo
178-
# echo -e " -> Cleaning vault-encryption-config.yaml"
179-
# cp k8s/encryption/vault-encryption-config-bkp.yaml k8s/encryption/vault-encryption-config.yaml
189+
echo
190+
echo -e " -> Cleaning any existing kind test env"
191+
kind delete cluster --name kleidi-vault
192+
193+
echo
194+
echo -e " -> Cleaning vault-encryption-config.yaml"
195+
cp k8s/encryption/vault-encryption-config-bkp.yaml k8s/encryption/vault-encryption-config.yaml
180196

‎internal/providers/constants.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package providers
22

33
const (
4-
keyID = "kleidi-kms-plugin"
4+
keyID = "kleidi-kms-plugin"
5+
annotationKey = "v2.kleidi.beezy.dev"
56
)

‎internal/providers/hvault.go‎

Lines changed: 38 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,12 @@ var _ service.Service = &hvaultRemoteService{}
2323
type hvaultRemoteService struct {
2424
*api.Client
2525

26-
keyID string
27-
debug bool
28-
Address string `json:"Address"`
29-
Transitkey string `json:"Transitkey"`
30-
Vaultrole string `json:"Vaultrole"`
31-
Namespace string `json:"Namespace"`
26+
// keyID string
27+
Debug bool
28+
Namespace string `json:"namespace"`
29+
Transitkey string `json:"transitkey"`
30+
Vaultrole string `json:"vaultrole"`
31+
Address string `json:"address"`
3232
}
3333

3434
func NewVaultClientRemoteService(configFilePath string, debug bool) (service.Service, error) {
@@ -45,20 +45,29 @@ func NewVaultClientRemoteService(configFilePath string, debug bool) (service.Ser
4545
log.Println("DEBUG: verifying keyID:", keyID)
4646
}
4747

48-
vaultService := &hvaultRemoteService{
49-
keyID: keyID,
50-
debug: debug,
51-
}
48+
// vaultService := &hvaultRemoteService{
49+
// // keyID: keyID,
50+
// Debug: debug,
51+
// }
5252

53+
vaultService := &hvaultRemoteService{}
54+
vaultService.Debug = debug
5355
json.Unmarshal(([]byte(ctx)), &vaultService)
56+
5457
vaultconfig := api.DefaultConfig()
5558
vaultconfig.Address = vaultService.Address
5659

5760
keypath := fmt.Sprintf("transit/keys/%s", vaultService.Transitkey)
5861

5962
if debug {
6063
log.Println("DEBUG:--------------------------------------------------")
61-
log.Println("DEBUG: unmarshal JSON values:", "\n -> vaultService.Address:", vaultService.Address, "\n -> vaultService.Trasitkey:", vaultService.Transitkey, "\n -> vaultService.Vaultrole:", vaultService.Vaultrole, "\n -> vaultService.Namespace:", vaultService.Namespace, "\n -> keypath:", keypath)
64+
log.Println("DEBUG: unmarshal JSON values:",
65+
"\n -> vaultService.debug", vaultService.Debug,
66+
"\n -> vaultService.Address:", vaultService.Address,
67+
"\n -> vaultService.Transitkey:", vaultService.Transitkey,
68+
"\n -> vaultService.Vaultrole:", vaultService.Vaultrole,
69+
"\n -> vaultService.Namespace:", vaultService.Namespace,
70+
"\n -> keypath:", keypath)
6271
}
6372

6473
client, err := api.NewClient(vaultconfig)
@@ -92,9 +101,10 @@ func NewVaultClientRemoteService(configFilePath string, debug bool) (service.Ser
92101
log.Fatalln("EXIT:authInfo: no kubernetes auth info was returned after login")
93102
}
94103

95-
vaultService = &hvaultRemoteService{
96-
Client: client,
97-
}
104+
// vaultService = &hvaultRemoteService{
105+
// Client: client,
106+
// }
107+
vaultService.Client = client
98108

99109
client.SetNamespace(vaultService.Namespace)
100110

@@ -115,12 +125,20 @@ func NewVaultClientRemoteService(configFilePath string, debug bool) (service.Ser
115125

116126
func (s *hvaultRemoteService) Encrypt(ctx context.Context, uid string, plaintext []byte) (*service.EncryptResponse, error) {
117127

118-
if s.debug {
128+
if s.Debug {
119129
log.Println("DEBUG:--------------------------------------------------")
120130
log.Println("DEBUG: unencrypted payload:", string([]byte(plaintext)))
121131
log.Println("DEBUG:--------------------------------------------------")
122132
}
123133

134+
log.Println("DEBUG:--------------------------------------------------")
135+
log.Println("DEBUG: unmarshal JSON values:",
136+
"\n -> vaultService.debug", s.Debug,
137+
"\n -> vaultService.Address:", s.Address,
138+
"\n -> vaultService.Transitkey:", s.Transitkey,
139+
"\n -> vaultService.Vaultrole:", s.Vaultrole,
140+
"\n -> vaultService.Namespace:", s.Namespace)
141+
124142
enckeypath := fmt.Sprintf("transit/encrypt/%s", s.Transitkey)
125143
// keypath := "transit/encrypt/kleidi"
126144
encodepayload := map[string]interface{}{
@@ -130,7 +148,11 @@ func (s *hvaultRemoteService) Encrypt(ctx context.Context, uid string, plaintext
130148
encrypt, err := s.Logical().WriteWithContext(ctx, enckeypath, encodepayload)
131149
if err != nil {
132150
log.Println("--------------------------------------------------------")
133-
log.Println("DEBUG:encrypt:", "\nplaintext:", string([]byte(plaintext)), "\nkeypath:", enckeypath, "\nencodepayload:", encodepayload)
151+
log.Println("DEBUG:encrypt:",
152+
"\n debug:", s.Debug,
153+
"\nplaintext:", string([]byte(plaintext)),
154+
"\nkeypath:", enckeypath,
155+
"\nencodepayload:", encodepayload)
134156
log.Println("--------------------------------------------------------")
135157
log.Fatalln("EXIT:encrypt: with error:\n", err.Error())
136158
}

‎internal/providers/pkcs11.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,6 @@ import (
1616
"k8s.io/kms/pkg/service"
1717
)
1818

19-
const (
20-
annotationKey = "v2.kleidi.beezy.dev"
21-
)
22-
2319
var _ service.Service = &pkcs11RemoteService{}
2420

2521
type pkcs11RemoteService struct {

‎results.sarif‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,13 +38,13 @@
3838
},
3939
"region": {
4040
"endColumn": 2,
41-
"endLine": 53,
41+
"endLine": 55,
4242
"snippet": {
4343
"text": "json.Unmarshal(([]byte(ctx)), \u0026vaultService)"
4444
},
4545
"sourceLanguage": "go",
4646
"startColumn": 2,
47-
"startLine": 53
47+
"startLine": 55
4848
}
4949
}
5050
}

‎scripts/prd/vault/manifests/vault-encryption-config.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,9 @@ resources:
55
- secrets
66
- configmaps
77
providers:
8+
- kms:
9+
apiVersion: v2
10+
name: kleidi-kms-plugin
11+
endpoint: unix:///tmp/kleidi/kleidi-kms-plugin.socket
12+
timeout: 5s
813
- identity: {}

‎scripts/prd/vault/manifests/vault-pod-kleidi-kms.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ spec:
1212
hostNetwork: true
1313
containers:
1414
- name: kleidi-kms-plugin
15-
image: ghcr.io/beezy-dev/kleidi-kms-plugin:vault-1283a8e
15+
image: ghcr.io/beezy-dev/kleidi-kms-plugin:vault-00547ab
1616
imagePullPolicy: Always
1717
args:
1818
- -provider=hvault

0 commit comments

Comments
 (0)