Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-01-12 16:09:39 -05:00
Code Issues Packages Projects Releases Wiki Activity

Use Constellation KMS instead of deprecated vpn API for requesting keys (#248)

Browse Source 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße 2022-07-05 09:48:47 +02:00 committed by GitHub
parent 4be29b04dc
commit 24cba8d91a
4 changed files with 24 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
go.mod
View File

@ -33,10 +33,7 @@ replace (
k8s.io/sample-controller => k8s.io/sample-controller v0.24.0 k8s.io/sample-controller => k8s.io/sample-controller v0.24.0
) )
replace ( replace github.com/nmiculinic/wg-quick-go v0.1.3 => github.com/katexochen/wg-quick-go v0.1.3-beta.1
github.com/martinjungblut/go-cryptsetup => github.com/daniel-weisse/go-cryptsetup v0.0.0-20220511084044-b537356aa24b
github.com/nmiculinic/wg-quick-go v0.1.3 => github.com/katexochen/wg-quick-go v0.1.3-beta.1
)
require ( require (
cloud.google.com/go/compute v1.5.0 cloud.google.com/go/compute v1.5.0
@ -82,7 +79,7 @@ require (
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
github.com/hashicorp/go-multierror v1.1.1 github.com/hashicorp/go-multierror v1.1.1
github.com/kr/text v0.2.0 github.com/kr/text v0.2.0
github.com/martinjungblut/go-cryptsetup v0.0.0-20220421194528-92e17766b2e7 github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6
github.com/microsoft/ApplicationInsights-Go v0.4.4 github.com/microsoft/ApplicationInsights-Go v0.4.4
github.com/schollz/progressbar/v3 v3.8.6 github.com/schollz/progressbar/v3 v3.8.6
github.com/spf13/afero v1.8.2 github.com/spf13/afero v1.8.2

2
go.sum
View File

@ -1042,6 +1042,8 @@ github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJ
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho= github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6 h1:YDjLk3wsL5ZLhLC4TIwIvT2NkSCAdAV6pzzZaRfj4jk=
github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6/go.mod h1:gZoZ0+POlM1ge/VUxWpMmZVNPzzMJ7l436CgkQ5+qzU=
github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ= github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=

24
mount/kms/constellation.go
View File

@ -4,7 +4,7 @@ import (
"context" "context"
"fmt" "fmt"
"github.com/edgelesssys/constellation/coordinator/vpnapi/vpnproto" "github.com/edgelesssys/constellation/kms/kmsproto"
"google.golang.org/grpc" "google.golang.org/grpc"
"google.golang.org/grpc/credentials/insecure" "google.golang.org/grpc/credentials/insecure"
) )
@ -12,14 +12,14 @@ import (
// ConstellationKMS is a key service using the Constellation Coordinator to fetch volume keys. // ConstellationKMS is a key service using the Constellation Coordinator to fetch volume keys.
type ConstellationKMS struct { type ConstellationKMS struct {
endpoint string endpoint string
vpn vpnClient kms kmsClient
} }
// NewConstellationKMS initializes a ConstellationKMS. // NewConstellationKMS initializes a ConstellationKMS.
func NewConstellationKMS(coordinatorEndpoint string) *ConstellationKMS { func NewConstellationKMS(coordinatorEndpoint string) *ConstellationKMS {
return &ConstellationKMS{ return &ConstellationKMS{
endpoint: coordinatorEndpoint, // default: "10.118.0.1:9027" endpoint: coordinatorEndpoint, // default: "kms.kube-system:9000"
vpn: &constellationVPNClient{}, kms: &constellationKMSClient{},
} }
} }
@ -31,27 +31,27 @@ func (k *ConstellationKMS) GetDEK(ctx context.Context, dekID string, dekSize int
} }
defer conn.Close() defer conn.Close()
res, err := k.vpn.GetDataKey( res, err := k.kms.GetDataKey(
ctx, ctx,
&vpnproto.GetDataKeyRequest{ &kmsproto.GetDataKeyRequest{
DataKeyId: dekID, DataKeyId: dekID,
Length: uint32(dekSize), Length: uint32(dekSize),
}, },
conn, conn,
) )
if err != nil { if err != nil {
return nil, fmt.Errorf("getting data encryption key from Constellation Coordinator: %w", err) return nil, fmt.Errorf("fetching data encryption key from Constellation KMS: %w", err)
} }
return res.DataKey, nil return res.DataKey, nil
} }
type vpnClient interface { type kmsClient interface {
GetDataKey(context.Context, *vpnproto.GetDataKeyRequest, *grpc.ClientConn) (*vpnproto.GetDataKeyResponse, error) GetDataKey(context.Context, *kmsproto.GetDataKeyRequest, *grpc.ClientConn) (*kmsproto.GetDataKeyResponse, error)
} }
type constellationVPNClient struct{} type constellationKMSClient struct{}
func (c *constellationVPNClient) GetDataKey(ctx context.Context, req *vpnproto.GetDataKeyRequest, conn *grpc.ClientConn) (*vpnproto.GetDataKeyResponse, error) { func (c *constellationKMSClient) GetDataKey(ctx context.Context, req *kmsproto.GetDataKeyRequest, conn *grpc.ClientConn) (*kmsproto.GetDataKeyResponse, error) {
return vpnproto.NewAPIClient(conn).GetDataKey(ctx, req) return kmsproto.NewAPIClient(conn).GetDataKey(ctx, req)
} }

16
mount/kms/constellation_test.go
View File

@ -5,7 +5,7 @@ import (
"errors" "errors"
"testing" "testing"
"github.com/edgelesssys/constellation/coordinator/vpnapi/vpnproto" "github.com/edgelesssys/constellation/kms/kmsproto"
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
"go.uber.org/goleak" "go.uber.org/goleak"
"google.golang.org/grpc" "google.golang.org/grpc"
@ -16,26 +16,26 @@ func TestMain(m *testing.M) {
goleak.VerifyTestMain(m) goleak.VerifyTestMain(m)
} }
type stubVPNClient struct { type stubKMSClient struct {
getDataKeyErr error getDataKeyErr error
dataKey []byte dataKey []byte
} }
func (c *stubVPNClient) GetDataKey(context.Context, *vpnproto.GetDataKeyRequest, *grpc.ClientConn) (*vpnproto.GetDataKeyResponse, error) { func (c *stubKMSClient) GetDataKey(context.Context, *kmsproto.GetDataKeyRequest, *grpc.ClientConn) (*kmsproto.GetDataKeyResponse, error) {
return &vpnproto.GetDataKeyResponse{DataKey: c.dataKey}, c.getDataKeyErr return &kmsproto.GetDataKeyResponse{DataKey: c.dataKey}, c.getDataKeyErr
} }
func TestConstellationKMS(t *testing.T) { func TestConstellationKMS(t *testing.T) {
testCases := map[string]struct { testCases := map[string]struct {
vpn *stubVPNClient kms *stubKMSClient
wantErr bool wantErr bool
}{ }{
"GetDataKey success": { "GetDataKey success": {
vpn: &stubVPNClient{dataKey: []byte{0x1, 0x2, 0x3}}, kms: &stubKMSClient{dataKey: []byte{0x1, 0x2, 0x3}},
wantErr: false, wantErr: false,
}, },
"GetDataKey error": { "GetDataKey error": {
vpn: &stubVPNClient{getDataKeyErr: errors.New("error")}, kms: &stubKMSClient{getDataKeyErr: errors.New("error")},
wantErr: true, wantErr: true,
}, },
} }
@ -49,7 +49,7 @@ func TestConstellationKMS(t *testing.T) {
kms := &ConstellationKMS{ kms := &ConstellationKMS{
endpoint: listener.Addr().String(), endpoint: listener.Addr().String(),
vpn: tc.vpn, kms: tc.kms,
} }
res, err := kms.GetDEK(context.Background(), "data-key", 64) res, err := kms.GetDEK(context.Background(), "data-key", 64)