kms: AWS SDK V2, allow creds config, add tests #1065
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ajvb
approved these changes
Jun 6, 2022
There was a problem hiding this comment.
Two small comments, but this looks awesome.
@hiddeco we can chat outside of this PR as well, but I wanted to ask if there was any other changes you'd like into v3.8? I'm thinking that once this PR is in I can get a draft release ready and get some user testing here at Mozilla, especially as it relates to the AWS and PGP changes.
|
@ajvb we literally have a fork for every key source implementation, so there are two to go (GCP KMS and HC Vault). I hope to be contributing them early next week, as today was a national holiday here, and I am off from Wednesday – Sunday this week for tattoos and other fun stuff. Given this, could we aim to cut end of next week? I am fine with e.g. release candidates going out in the meantime. |
This updates the AWS SDK for Go to V2, adds extensive test coverage based on a mocking server, and a general tidying of bits of code. The improvements are based on a fork of the key source in the Flux project's kustomize-controller, built due to SOPS' limitation around credential management without relying on runtime environment variables. - AWS SDK has been updated to V2. There are still bits in `publish/` which would need updating to drop the dependency on V1. - It introduces a `CredentialsProvider` type which holds an `aws.CredentialsProvider`, and can be applied to the `MasterKey`. When applied, the provider is used in the AWS client configuration instead of relying on the SDK default (environmental) values. This is most useful when working with SOPS as an SDK, in combination with e.g. a local key service server implementation. - Extensive test coverage. STS session implementation details are not tested due to mocking complexities, but the wiring is. The forked version of this has compatibility tests to ensure it works with current SOPS: - https://github.com/fluxcd/kustomize-controller/blob/8b7e7ecb1aea34a7a14ebed159bf0f2fc1f2f7f3/internal/sops/awskms/keysource_test.go#L134 - https://github.com/fluxcd/kustomize-controller/blob/8b7e7ecb1aea34a7a14ebed159bf0f2fc1f2f7f3/internal/sops/awskms/keysource_test.go#L200 Co-authored-by: Sanskar Jaiswal <[email protected]> Signed-off-by: Hidde Beydals <[email protected]>
Signed-off-by: Hidde Beydals <[email protected]>
This was only required for the test mocks for the V1 AWS SDK tests, which have been removed with the rewrite to V2. Signed-off-by: Hidde Beydals <[email protected]>
ajvb
approved these changes
Jun 27, 2022
This was referenced Jul 3, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This updates the AWS SDK for Go to V2, adds extensive test coverage
based on a mocking server, and a general tidying of bits of code.
The improvements are based on a fork of the key source in the Flux
project's kustomize-controller, built due to SOPS' limitation around
credential management without relying on runtime environment variables.
There are still bits inPatchedpublish/which would need updating to drop the dependency on V1.
in d2ce37d.
CredentialsProvidertype which holds anaws.CredentialProvider, and can be applied to theMasterKey.When applied, the provider is used in the AWS client configuration
instead of relying on the SDK default (environmental) values.
This is most useful when working with SOPS as an SDK, in combination
with e.g. a local key service server implementation.
tested due to mocking complexities, but the wiring is.
The forked version of this has compatibility tests to ensure it works
with current SOPS: