Use Constellation KMS instead of deprecated vpn API for requesting keys (#248)

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

go.mod

@@ -33,10 +33,7 @@ replace (
 	k8s.io/sample-controller => k8s.io/sample-controller v0.24.0
 )
 
-replace (
+replace github.com/nmiculinic/wg-quick-go v0.1.3 => github.com/katexochen/wg-quick-go v0.1.3-beta.1
-	github.com/martinjungblut/go-cryptsetup => github.com/daniel-weisse/go-cryptsetup v0.0.0-20220511084044-b537356aa24b
-	github.com/nmiculinic/wg-quick-go v0.1.3 => github.com/katexochen/wg-quick-go v0.1.3-beta.1
-)
 
 require (
 	cloud.google.com/go/compute v1.5.0
@@ -82,7 +79,7 @@ require (
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/kr/text v0.2.0
-	github.com/martinjungblut/go-cryptsetup v0.0.0-20220421194528-92e17766b2e7
+	github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6
 	github.com/microsoft/ApplicationInsights-Go v0.4.4
 	github.com/schollz/progressbar/v3 v3.8.6
 	github.com/spf13/afero v1.8.2

go.sum

@@ -1042,6 +1042,8 @@ github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJ
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
+github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6 h1:YDjLk3wsL5ZLhLC4TIwIvT2NkSCAdAV6pzzZaRfj4jk=
+github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6/go.mod h1:gZoZ0+POlM1ge/VUxWpMmZVNPzzMJ7l436CgkQ5+qzU=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=

mount/kms/constellation.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/edgelesssys/constellation/coordinator/vpnapi/vpnproto"
+	"github.com/edgelesssys/constellation/kms/kmsproto"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
@@ -12,14 +12,14 @@ import (
 // ConstellationKMS is a key service using the Constellation Coordinator to fetch volume keys.
 type ConstellationKMS struct {
 	endpoint string
-	vpn      vpnClient
+	kms      kmsClient
 }
 
 // NewConstellationKMS initializes a ConstellationKMS.
 func NewConstellationKMS(coordinatorEndpoint string) *ConstellationKMS {
 	return &ConstellationKMS{
-		endpoint: coordinatorEndpoint, // default: "10.118.0.1:9027"
+		endpoint: coordinatorEndpoint, // default: "kms.kube-system:9000"
-		vpn:      &constellationVPNClient{},
+		kms:      &constellationKMSClient{},
 	}
 }
 
@@ -31,27 +31,27 @@ func (k *ConstellationKMS) GetDEK(ctx context.Context, dekID string, dekSize int
 	}
 	defer conn.Close()
 
-	res, err := k.vpn.GetDataKey(
+	res, err := k.kms.GetDataKey(
 		ctx,
-		&vpnproto.GetDataKeyRequest{
+		&kmsproto.GetDataKeyRequest{
 			DataKeyId: dekID,
 			Length:    uint32(dekSize),
 		},
 		conn,
 	)
 	if err != nil {
-		return nil, fmt.Errorf("getting data encryption key from Constellation Coordinator: %w", err)
+		return nil, fmt.Errorf("fetching data encryption key from Constellation KMS: %w", err)
 	}
 
 	return res.DataKey, nil
 }
 
-type vpnClient interface {
+type kmsClient interface {
-	GetDataKey(context.Context, *vpnproto.GetDataKeyRequest, *grpc.ClientConn) (*vpnproto.GetDataKeyResponse, error)
+	GetDataKey(context.Context, *kmsproto.GetDataKeyRequest, *grpc.ClientConn) (*kmsproto.GetDataKeyResponse, error)
 }
 
-type constellationVPNClient struct{}
+type constellationKMSClient struct{}
 
-func (c *constellationVPNClient) GetDataKey(ctx context.Context, req *vpnproto.GetDataKeyRequest, conn *grpc.ClientConn) (*vpnproto.GetDataKeyResponse, error) {
+func (c *constellationKMSClient) GetDataKey(ctx context.Context, req *kmsproto.GetDataKeyRequest, conn *grpc.ClientConn) (*kmsproto.GetDataKeyResponse, error) {
-	return vpnproto.NewAPIClient(conn).GetDataKey(ctx, req)
+	return kmsproto.NewAPIClient(conn).GetDataKey(ctx, req)
 }

mount/kms/constellation_test.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/edgelesssys/constellation/coordinator/vpnapi/vpnproto"
+	"github.com/edgelesssys/constellation/kms/kmsproto"
 	"github.com/stretchr/testify/assert"
 	"go.uber.org/goleak"
 	"google.golang.org/grpc"
@@ -16,26 +16,26 @@ func TestMain(m *testing.M) {
 	goleak.VerifyTestMain(m)
 }
 
-type stubVPNClient struct {
+type stubKMSClient struct {
 	getDataKeyErr error
 	dataKey       []byte
 }
 
-func (c *stubVPNClient) GetDataKey(context.Context, *vpnproto.GetDataKeyRequest, *grpc.ClientConn) (*vpnproto.GetDataKeyResponse, error) {
+func (c *stubKMSClient) GetDataKey(context.Context, *kmsproto.GetDataKeyRequest, *grpc.ClientConn) (*kmsproto.GetDataKeyResponse, error) {
-	return &vpnproto.GetDataKeyResponse{DataKey: c.dataKey}, c.getDataKeyErr
+	return &kmsproto.GetDataKeyResponse{DataKey: c.dataKey}, c.getDataKeyErr
 }
 
 func TestConstellationKMS(t *testing.T) {
 	testCases := map[string]struct {
-		vpn     *stubVPNClient
+		kms     *stubKMSClient
 		wantErr bool
 	}{
 		"GetDataKey success": {
-			vpn:     &stubVPNClient{dataKey: []byte{0x1, 0x2, 0x3}},
+			kms:     &stubKMSClient{dataKey: []byte{0x1, 0x2, 0x3}},
 			wantErr: false,
 		},
 		"GetDataKey error": {
-			vpn:     &stubVPNClient{getDataKeyErr: errors.New("error")},
+			kms:     &stubKMSClient{getDataKeyErr: errors.New("error")},
 			wantErr: true,
 		},
 	}
@@ -49,7 +49,7 @@ func TestConstellationKMS(t *testing.T) {
 
 			kms := &ConstellationKMS{
 				endpoint: listener.Addr().String(),
-				vpn:      tc.vpn,
+				kms:      tc.kms,
 			}
 			res, err := kms.GetDEK(context.Background(), "data-key", 64)