Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-12-24 15:09:39 -05:00
Code Issues Packages Projects Releases Wiki Activity

Use Constellation KMS instead of deprecated vpn API for requesting keys (#248)

Browse Source 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße 2022-07-05 09:48:47 +02:00 committed by GitHub
parent 4be29b04dc
commit 24cba8d91a
4 changed files with 24 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
go.mod
View File

@ -33,10 +33,7 @@ replace (
k8s.io/sample-controller => k8s.io/sample-controller v0.24.0
)
replace (
github.com/martinjungblut/go-cryptsetup => github.com/daniel-weisse/go-cryptsetup v0.0.0-20220511084044-b537356aa24b
github.com/nmiculinic/wg-quick-go v0.1.3 => github.com/katexochen/wg-quick-go v0.1.3-beta.1
)
replace github.com/nmiculinic/wg-quick-go v0.1.3 => github.com/katexochen/wg-quick-go v0.1.3-beta.1
require (
cloud.google.com/go/compute v1.5.0
@ -82,7 +79,7 @@ require (
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
github.com/hashicorp/go-multierror v1.1.1
github.com/kr/text v0.2.0
github.com/martinjungblut/go-cryptsetup v0.0.0-20220421194528-92e17766b2e7
github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6
github.com/microsoft/ApplicationInsights-Go v0.4.4
github.com/schollz/progressbar/v3 v3.8.6
github.com/spf13/afero v1.8.2

2
go.sum
View File

@ -1042,6 +1042,8 @@ github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJ
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6 h1:YDjLk3wsL5ZLhLC4TIwIvT2NkSCAdAV6pzzZaRfj4jk=
github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6/go.mod h1:gZoZ0+POlM1ge/VUxWpMmZVNPzzMJ7l436CgkQ5+qzU=
github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=

24
mount/kms/constellation.go
View File

@ -4,7 +4,7 @@ import (
"context"
"fmt"
"github.com/edgelesssys/constellation/coordinator/vpnapi/vpnproto"
"github.com/edgelesssys/constellation/kms/kmsproto"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials/insecure"
)
@ -12,14 +12,14 @@ import (
// ConstellationKMS is a key service using the Constellation Coordinator to fetch volume keys.
type ConstellationKMS struct {
endpoint string
vpn vpnClient
kms kmsClient
}
// NewConstellationKMS initializes a ConstellationKMS.
func NewConstellationKMS(coordinatorEndpoint string) *ConstellationKMS {
return &ConstellationKMS{
endpoint: coordinatorEndpoint, // default: "10.118.0.1:9027"
vpn: &constellationVPNClient{},
endpoint: coordinatorEndpoint, // default: "kms.kube-system:9000"
kms: &constellationKMSClient{},
}
}
@ -31,27 +31,27 @@ func (k *ConstellationKMS) GetDEK(ctx context.Context, dekID string, dekSize int
}
defer conn.Close()
res, err := k.vpn.GetDataKey(
res, err := k.kms.GetDataKey(
ctx,
&vpnproto.GetDataKeyRequest{
&kmsproto.GetDataKeyRequest{
DataKeyId: dekID,
Length: uint32(dekSize),
},
conn,
)
if err != nil {
return nil, fmt.Errorf("getting data encryption key from Constellation Coordinator: %w", err)
return nil, fmt.Errorf("fetching data encryption key from Constellation KMS: %w", err)
}
return res.DataKey, nil
}
type vpnClient interface {
GetDataKey(context.Context, *vpnproto.GetDataKeyRequest, *grpc.ClientConn) (*vpnproto.GetDataKeyResponse, error)
type kmsClient interface {
GetDataKey(context.Context, *kmsproto.GetDataKeyRequest, *grpc.ClientConn) (*kmsproto.GetDataKeyResponse, error)
}
type constellationVPNClient struct{}
type constellationKMSClient struct{}
func (c *constellationVPNClient) GetDataKey(ctx context.Context, req *vpnproto.GetDataKeyRequest, conn *grpc.ClientConn) (*vpnproto.GetDataKeyResponse, error) {
return vpnproto.NewAPIClient(conn).GetDataKey(ctx, req)
func (c *constellationKMSClient) GetDataKey(ctx context.Context, req *kmsproto.GetDataKeyRequest, conn *grpc.ClientConn) (*kmsproto.GetDataKeyResponse, error) {
return kmsproto.NewAPIClient(conn).GetDataKey(ctx, req)
}

16
mount/kms/constellation_test.go
View File

@ -5,7 +5,7 @@ import (
"errors"
"testing"
"github.com/edgelesssys/constellation/coordinator/vpnapi/vpnproto"
"github.com/edgelesssys/constellation/kms/kmsproto"
"github.com/stretchr/testify/assert"
"go.uber.org/goleak"
"google.golang.org/grpc"
@ -16,26 +16,26 @@ func TestMain(m *testing.M) {
goleak.VerifyTestMain(m)
}
type stubVPNClient struct {
type stubKMSClient struct {
getDataKeyErr error
dataKey []byte
}
func (c *stubVPNClient) GetDataKey(context.Context, *vpnproto.GetDataKeyRequest, *grpc.ClientConn) (*vpnproto.GetDataKeyResponse, error) {
return &vpnproto.GetDataKeyResponse{DataKey: c.dataKey}, c.getDataKeyErr
func (c *stubKMSClient) GetDataKey(context.Context, *kmsproto.GetDataKeyRequest, *grpc.ClientConn) (*kmsproto.GetDataKeyResponse, error) {
return &kmsproto.GetDataKeyResponse{DataKey: c.dataKey}, c.getDataKeyErr
}
func TestConstellationKMS(t *testing.T) {
testCases := map[string]struct {
vpn *stubVPNClient
kms *stubKMSClient
wantErr bool
}{
"GetDataKey success": {
vpn: &stubVPNClient{dataKey: []byte{0x1, 0x2, 0x3}},
kms: &stubKMSClient{dataKey: []byte{0x1, 0x2, 0x3}},
wantErr: false,
},
"GetDataKey error": {
vpn: &stubVPNClient{getDataKeyErr: errors.New("error")},
kms: &stubKMSClient{getDataKeyErr: errors.New("error")},
wantErr: true,
},
}
@ -49,7 +49,7 @@ func TestConstellationKMS(t *testing.T) {
kms := &ConstellationKMS{
endpoint: listener.Addr().String(),
vpn: tc.vpn,
kms: tc.kms,
}
res, err := kms.GetDEK(context.Background(), "data-key", 64)