mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-13 09:54:29 -05:00
4842d29aff
* Deploy activation service on cluster init * Use base image with CA certificates for activation service * Improve KMS server Signed-off-by: Daniel Weiße <dw@edgeless.systems>
51 lines
1.5 KiB
Go
51 lines
1.5 KiB
Go
// Package kmsapi implements an API to manage encryption keys.
|
|
package kmsapi
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/edgelesssys/constellation/kms/kms"
|
|
"github.com/edgelesssys/constellation/kms/server/kmsapi/kmsproto"
|
|
"go.uber.org/zap"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
"k8s.io/klog/v2"
|
|
)
|
|
|
|
// API resembles an encryption key management api server through logger, CloudKMS and proto-unimplemented server.
|
|
type API struct {
|
|
logger *zap.Logger
|
|
conKMS kms.CloudKMS
|
|
kmsproto.UnimplementedAPIServer
|
|
}
|
|
|
|
// New creates a new API.
|
|
func New(logger *zap.Logger, conKMS kms.CloudKMS) *API {
|
|
return &API{
|
|
logger: logger,
|
|
conKMS: conKMS,
|
|
}
|
|
}
|
|
|
|
// GetDataKey returns a data key.
|
|
func (a *API) GetDataKey(ctx context.Context, in *kmsproto.GetDataKeyRequest) (*kmsproto.GetDataKeyResponse, error) {
|
|
// Error on 0 key length
|
|
if in.Length == 0 {
|
|
klog.Error("GetDataKey: requested key length is zero")
|
|
return nil, status.Error(codes.InvalidArgument, "can't derive key with length zero")
|
|
}
|
|
|
|
// Error on empty DataKeyId
|
|
if in.DataKeyId == "" {
|
|
klog.Error("GetDataKey: no data key ID specified")
|
|
return nil, status.Error(codes.InvalidArgument, "no data key ID specified")
|
|
}
|
|
|
|
key, err := a.conKMS.GetDEK(ctx, "Constellation", "key-"+in.DataKeyId, int(in.Length))
|
|
if err != nil {
|
|
klog.Errorf("GetDataKey: failed to get data key: %v", err)
|
|
return nil, status.Errorf(codes.Internal, "%v", err)
|
|
}
|
|
return &kmsproto.GetDataKeyResponse{DataKey: key}, nil
|
|
}
|