mirror of https://github.com/edgelesssys/constellation.git synced 2024-09-19 15:56:03 +00:00

History

Malte Poll 3a5753045e goleak: ignore rules_go SIGTERM handler rules_go added a SIGTERM handler that has a goroutine that survives the scope of the goleak check. Currently, the best known workaround is to ignore this goroutine. https://github.com/uber-go/goleak/issues/119 https://github.com/bazelbuild/rules_go/pull/3749 https://github.com/bazelbuild/rules_go/pull/3827#issuecomment-1894002120		2024-01-22 13:11:58 +01:00
..
cmd	cli: use Semver type to represent microservice versions (#2125 )	2023-07-25 14:20:25 +02:00
internal/server	goleak: ignore rules_go SIGTERM handler	2024-01-22 13:11:58 +01:00
keyserviceproto	deps: update module github.com/sigstore/rekor to v1.2.2 (#2033 )	2023-07-06 15:41:14 +02:00
README.md	dev-docs: Go package docs (#958 )	2023-01-19 15:57:50 +01:00

README.md

KeyService

The KeyService is one of Constellation's Kubernetes components, responsible for distributing keys and secrets to other services. This includes the JoinService, which contacts the KeyService to derive state disk keys and measurement secrets for newly-joining, and rejoining nodes, and Constellation's CSI drivers, which contact the KeyService for disk encryption keys.

The service is not exposed outside the cluster, and should be kept for internal usage only.

gRPC API

Keys can be requested through simple gRPC API based on an ID and key length.

Backends

The KeyService supports multiple backends to store keys and manage crypto operations. The default option holds a master secret in memory. Keys are derived on demand from this secret, and not stored anywhere. Other backends make use of external Key Management Systems (KMS) for key derivation and securing a master secret. When using an external KMS backend, encrypted keys are stored in cloud buckets.