From f53d5f32d56314175fd95ef9fc95c3fd5cf5a092 Mon Sep 17 00:00:00 2001 From: bernie-g Date: Wed, 5 Aug 2026 14:30:05 -0400 Subject: [PATCH 1/6] feat: wire KMIP server certificate auto-renewal token refresh Bumps infisical-kmip to the auto-renewal version (pseudo-version off the feature branch; swap for the release tag once it lands). enrollKmipServer now also returns a refresh function passed to the server as RefreshAccessToken: AWS enrollment re-authenticates via STS and persists the new token, token enrollment has no refresh since enrollment tokens are single-use. --- go.mod | 2 +- go.sum | 4 ++-- packages/cmd/kmip.go | 34 ++++++++++++++++++++++++++++------ 3 files changed, 31 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index bc4dc53d..dd126b84 100644 --- a/go.mod +++ b/go.mod @@ -23,7 +23,7 @@ require ( github.com/google/uuid v1.6.0 github.com/h2non/filetype v1.1.3 github.com/infisical/go-sdk v0.7.0 - github.com/infisical/infisical-kmip v0.3.19 + github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14 github.com/jackc/pgx/v5 v5.9.2 github.com/jcmturner/gokrb5/v8 v8.4.4 github.com/masterzen/winrm v0.0.0-20260407182533-5570be7f80cf diff --git a/go.sum b/go.sum index 3ba40cf0..e7cf0001 100644 --- a/go.sum +++ b/go.sum @@ -416,8 +416,8 @@ github.com/indece-official/go-ebcdic v1.2.0 h1:nKCubkNoXrGvBp3MSYuplOQnhANCDEY51 github.com/indece-official/go-ebcdic v1.2.0/go.mod h1:RBddVJt0Ks0eDLRG5dhPwBDRiTNA7n+yv0dVFpSs46Q= github.com/infisical/go-sdk v0.7.0 h1:x9/1PczL+ioVD1jCp4LHQzPpBawatbmkjAC0S1OAtUA= github.com/infisical/go-sdk v0.7.0/go.mod h1:yEfXF+3YDDXiJ9zzJUSzW6me6XXPPEDK52fSU6JfpCA= -github.com/infisical/infisical-kmip v0.3.19 h1:JDndxhM9+GoHTqSOX47H3KIxIuDmrEHsq17wvhw3RL8= -github.com/infisical/infisical-kmip v0.3.19/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= +github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14 h1:6//zuxPFhsx8EE3y5E/ooS9KigSsvTIbk2jf91BTNtw= +github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= diff --git a/packages/cmd/kmip.go b/packages/cmd/kmip.go index 49d33051..a4ab969e 100644 --- a/packages/cmd/kmip.go +++ b/packages/cmd/kmip.go @@ -4,6 +4,7 @@ Copyright (c) 2023 Infisical Inc. package cmd import ( + "context" "errors" "fmt" "os" @@ -128,7 +129,7 @@ func startKmipServer(cmd *cobra.Command, args []string) { isResourceAuth := enrollMethod == localkmip.EnrollMethodToken || enrollMethod == localkmip.EnrollMethodAws if isResourceAuth { - serverConfig.AccessToken = enrollKmipServer(cmd, enrollMethod, serverName) + serverConfig.AccessToken, serverConfig.RefreshAccessToken = enrollKmipServer(cmd, enrollMethod, serverName) } else { // No enroll method given: reuse the stored enrollment access token unless explicit identity // credentials were passed. This keeps a manual restart of an enrolled server from silently @@ -149,8 +150,10 @@ func startKmipServer(cmd *cobra.Command, args []string) { } // enrollKmipServer obtains a KMIP server access token via token or AWS enrollment, -// persisting the relevant state under the KMIP server's config file. -func enrollKmipServer(cmd *cobra.Command, enrollMethod, serverName string) string { +// persisting the relevant state under the KMIP server's config file. For AWS enrollment it +// also returns a refresh function so the server can re-authenticate when its access token +// expires before its certificate does; token enrollment is single-use, so no refresh exists. +func enrollKmipServer(cmd *cobra.Command, enrollMethod, serverName string) (string, func() (string, error)) { httpClient, err := util.GetRestyClientWithCustomHeaders() if err != nil { util.HandleError(err, "unable to create HTTP client") @@ -183,7 +186,26 @@ func enrollKmipServer(cmd *cobra.Command, enrollMethod, serverName string) strin } log.Info().Msgf("KMIP server authenticated via AWS Auth. State saved to %s", localkmip.GetConfPathDisplay(serverName)) - return accessToken + + refreshAccessToken := func() (string, error) { + refreshClient, err := util.GetRestyClientWithCustomHeaders() + if err != nil { + return "", fmt.Errorf("unable to create HTTP client: %w", err) + } + + newToken, err := localkmip.LoginKmipServerWithAws(context.Background(), refreshClient, kmipServerID) + if err != nil { + return "", fmt.Errorf("AWS Auth re-login failed: %w", err) + } + + if err := localkmip.SaveAccessToken(serverName, newToken); err != nil { + log.Warn().Msgf("failed to persist refreshed KMIP access token: %v", err) + } + + return newToken, nil + } + + return accessToken, refreshAccessToken } // Enrollment token path @@ -197,7 +219,7 @@ func enrollKmipServer(cmd *cobra.Command, enrollMethod, serverName string) strin storedAccessToken, err := localkmip.LoadStoredAccessToken(serverName) if err == nil && storedAccessToken != "" { log.Info().Msg("Reusing stored KMIP server access token.") - return storedAccessToken + return storedAccessToken, nil } if enrollToken == "" { util.HandleError(errors.New("--token is required when --enroll-method=token and no access token is stored")) @@ -228,7 +250,7 @@ func enrollKmipServer(cmd *cobra.Command, enrollMethod, serverName string) strin } log.Info().Msgf("KMIP server enrolled successfully. Access token saved to %s", localkmip.GetConfPathDisplay(serverName)) - return enrollResp.AccessToken + return enrollResp.AccessToken, nil } // resolveKmipIdentityCredentials parses the legacy machine-identity credentials. From 0dea9a714a75435fd31ab7773b496df7c286a938 Mon Sep 17 00:00:00 2001 From: bernie-g Date: Wed, 5 Aug 2026 15:01:22 -0400 Subject: [PATCH 2/6] chore: tidy e2e module for infisical-kmip bump --- e2e/go.mod | 2 +- e2e/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/e2e/go.mod b/e2e/go.mod index 81c1389c..739fd67f 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -168,7 +168,7 @@ require ( github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/indece-official/go-ebcdic v1.2.0 // indirect github.com/infisical/go-sdk v0.7.0 // indirect - github.com/infisical/infisical-kmip v0.3.19 // indirect + github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14 // indirect github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect diff --git a/e2e/go.sum b/e2e/go.sum index 04c3e52c..1c5a774a 100644 --- a/e2e/go.sum +++ b/e2e/go.sum @@ -591,8 +591,8 @@ github.com/indece-official/go-ebcdic v1.2.0 h1:nKCubkNoXrGvBp3MSYuplOQnhANCDEY51 github.com/indece-official/go-ebcdic v1.2.0/go.mod h1:RBddVJt0Ks0eDLRG5dhPwBDRiTNA7n+yv0dVFpSs46Q= github.com/infisical/go-sdk v0.7.0 h1:x9/1PczL+ioVD1jCp4LHQzPpBawatbmkjAC0S1OAtUA= github.com/infisical/go-sdk v0.7.0/go.mod h1:yEfXF+3YDDXiJ9zzJUSzW6me6XXPPEDK52fSU6JfpCA= -github.com/infisical/infisical-kmip v0.3.19 h1:JDndxhM9+GoHTqSOX47H3KIxIuDmrEHsq17wvhw3RL8= -github.com/infisical/infisical-kmip v0.3.19/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= +github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14 h1:6//zuxPFhsx8EE3y5E/ooS9KigSsvTIbk2jf91BTNtw= +github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf h1:FtEj8sfIcaaBfAKrE1Cwb61YDtYq9JxChK1c7AKce7s= github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf/go.mod h1:yrqSXGoD/4EKfF26AOGzscPOgTTJcyAwM2rpixWT+t4= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= From 878168b82ef2f660433596d86a568b787f16e675 Mon Sep 17 00:00:00 2001 From: bernie-g Date: Wed, 5 Aug 2026 15:08:37 -0400 Subject: [PATCH 3/6] chore: bump infisical-kmip to key/cert pair validation fix --- e2e/go.mod | 2 +- e2e/go.sum | 4 ++-- go.mod | 2 +- go.sum | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/e2e/go.mod b/e2e/go.mod index 739fd67f..ae6394a6 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -168,7 +168,7 @@ require ( github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/indece-official/go-ebcdic v1.2.0 // indirect github.com/infisical/go-sdk v0.7.0 // indirect - github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14 // indirect + github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3 // indirect github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect diff --git a/e2e/go.sum b/e2e/go.sum index 1c5a774a..ae60d68f 100644 --- a/e2e/go.sum +++ b/e2e/go.sum @@ -591,8 +591,8 @@ github.com/indece-official/go-ebcdic v1.2.0 h1:nKCubkNoXrGvBp3MSYuplOQnhANCDEY51 github.com/indece-official/go-ebcdic v1.2.0/go.mod h1:RBddVJt0Ks0eDLRG5dhPwBDRiTNA7n+yv0dVFpSs46Q= github.com/infisical/go-sdk v0.7.0 h1:x9/1PczL+ioVD1jCp4LHQzPpBawatbmkjAC0S1OAtUA= github.com/infisical/go-sdk v0.7.0/go.mod h1:yEfXF+3YDDXiJ9zzJUSzW6me6XXPPEDK52fSU6JfpCA= -github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14 h1:6//zuxPFhsx8EE3y5E/ooS9KigSsvTIbk2jf91BTNtw= -github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= +github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3 h1:4rwG5XE+IFUOXsfiBx6UW7dVgJeWM/RxQNgh4gd1kwg= +github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf h1:FtEj8sfIcaaBfAKrE1Cwb61YDtYq9JxChK1c7AKce7s= github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf/go.mod h1:yrqSXGoD/4EKfF26AOGzscPOgTTJcyAwM2rpixWT+t4= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= diff --git a/go.mod b/go.mod index dd126b84..028b2339 100644 --- a/go.mod +++ b/go.mod @@ -23,7 +23,7 @@ require ( github.com/google/uuid v1.6.0 github.com/h2non/filetype v1.1.3 github.com/infisical/go-sdk v0.7.0 - github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14 + github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3 github.com/jackc/pgx/v5 v5.9.2 github.com/jcmturner/gokrb5/v8 v8.4.4 github.com/masterzen/winrm v0.0.0-20260407182533-5570be7f80cf diff --git a/go.sum b/go.sum index e7cf0001..a44cc7e3 100644 --- a/go.sum +++ b/go.sum @@ -416,8 +416,8 @@ github.com/indece-official/go-ebcdic v1.2.0 h1:nKCubkNoXrGvBp3MSYuplOQnhANCDEY51 github.com/indece-official/go-ebcdic v1.2.0/go.mod h1:RBddVJt0Ks0eDLRG5dhPwBDRiTNA7n+yv0dVFpSs46Q= github.com/infisical/go-sdk v0.7.0 h1:x9/1PczL+ioVD1jCp4LHQzPpBawatbmkjAC0S1OAtUA= github.com/infisical/go-sdk v0.7.0/go.mod h1:yEfXF+3YDDXiJ9zzJUSzW6me6XXPPEDK52fSU6JfpCA= -github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14 h1:6//zuxPFhsx8EE3y5E/ooS9KigSsvTIbk2jf91BTNtw= -github.com/infisical/infisical-kmip v0.3.20-0.20260805182853-a96df71b6d14/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= +github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3 h1:4rwG5XE+IFUOXsfiBx6UW7dVgJeWM/RxQNgh4gd1kwg= +github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= From 8759a781b1f78ab4dbdb74e29d42a49bbeb1ee28 Mon Sep 17 00:00:00 2001 From: bernie-g Date: Fri, 7 Aug 2026 14:43:22 -0400 Subject: [PATCH 4/6] chore: bump infisical-kmip past isRenewal flag removal --- e2e/go.mod | 2 +- e2e/go.sum | 4 ++-- go.mod | 2 +- go.sum | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/e2e/go.mod b/e2e/go.mod index ae6394a6..aa539ef1 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -168,7 +168,7 @@ require ( github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/indece-official/go-ebcdic v1.2.0 // indirect github.com/infisical/go-sdk v0.7.0 // indirect - github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3 // indirect + github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b // indirect github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect diff --git a/e2e/go.sum b/e2e/go.sum index ae60d68f..b79855c8 100644 --- a/e2e/go.sum +++ b/e2e/go.sum @@ -591,8 +591,8 @@ github.com/indece-official/go-ebcdic v1.2.0 h1:nKCubkNoXrGvBp3MSYuplOQnhANCDEY51 github.com/indece-official/go-ebcdic v1.2.0/go.mod h1:RBddVJt0Ks0eDLRG5dhPwBDRiTNA7n+yv0dVFpSs46Q= github.com/infisical/go-sdk v0.7.0 h1:x9/1PczL+ioVD1jCp4LHQzPpBawatbmkjAC0S1OAtUA= github.com/infisical/go-sdk v0.7.0/go.mod h1:yEfXF+3YDDXiJ9zzJUSzW6me6XXPPEDK52fSU6JfpCA= -github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3 h1:4rwG5XE+IFUOXsfiBx6UW7dVgJeWM/RxQNgh4gd1kwg= -github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= +github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b h1:T/lEyqFeZz0T4B6tomhlgjmJ1+ffuF2irFRtjOEC5Gw= +github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf h1:FtEj8sfIcaaBfAKrE1Cwb61YDtYq9JxChK1c7AKce7s= github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf/go.mod h1:yrqSXGoD/4EKfF26AOGzscPOgTTJcyAwM2rpixWT+t4= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= diff --git a/go.mod b/go.mod index 028b2339..a38b2ddb 100644 --- a/go.mod +++ b/go.mod @@ -23,7 +23,7 @@ require ( github.com/google/uuid v1.6.0 github.com/h2non/filetype v1.1.3 github.com/infisical/go-sdk v0.7.0 - github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3 + github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b github.com/jackc/pgx/v5 v5.9.2 github.com/jcmturner/gokrb5/v8 v8.4.4 github.com/masterzen/winrm v0.0.0-20260407182533-5570be7f80cf diff --git a/go.sum b/go.sum index a44cc7e3..f97ca450 100644 --- a/go.sum +++ b/go.sum @@ -416,8 +416,8 @@ github.com/indece-official/go-ebcdic v1.2.0 h1:nKCubkNoXrGvBp3MSYuplOQnhANCDEY51 github.com/indece-official/go-ebcdic v1.2.0/go.mod h1:RBddVJt0Ks0eDLRG5dhPwBDRiTNA7n+yv0dVFpSs46Q= github.com/infisical/go-sdk v0.7.0 h1:x9/1PczL+ioVD1jCp4LHQzPpBawatbmkjAC0S1OAtUA= github.com/infisical/go-sdk v0.7.0/go.mod h1:yEfXF+3YDDXiJ9zzJUSzW6me6XXPPEDK52fSU6JfpCA= -github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3 h1:4rwG5XE+IFUOXsfiBx6UW7dVgJeWM/RxQNgh4gd1kwg= -github.com/infisical/infisical-kmip v0.3.20-0.20260805190802-0b7dadb616b3/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= +github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b h1:T/lEyqFeZz0T4B6tomhlgjmJ1+ffuF2irFRtjOEC5Gw= +github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= From d0384f34dc96f8c09505d27ef12e1c71417a8235 Mon Sep 17 00:00:00 2001 From: bernie-g Date: Fri, 7 Aug 2026 14:55:57 -0400 Subject: [PATCH 5/6] fix: bound AWS token refresh with timeouts and wire it on flagless restarts The refresh closure's HTTP client and STS login now have deadlines so a hung API call cannot stall certificate renewal. A flagless restart of an AWS-enrolled server (stored-token path) now detects the persisted server ID and wires the same refresh function, so it can still recover from a rejected token. --- packages/cmd/kmip.go | 53 ++++++++++++++++++++++++++++---------------- 1 file changed, 34 insertions(+), 19 deletions(-) diff --git a/packages/cmd/kmip.go b/packages/cmd/kmip.go index a4ab969e..d64d21d6 100644 --- a/packages/cmd/kmip.go +++ b/packages/cmd/kmip.go @@ -10,6 +10,7 @@ import ( "os" "os/exec" "runtime" + "time" "github.com/Infisical/infisical-merge/packages/api" "github.com/Infisical/infisical-merge/packages/config" @@ -139,6 +140,11 @@ func startKmipServer(cmd *cobra.Command, args []string) { if storedToken, _ := localkmip.LoadStoredAccessToken(serverName); storedToken != "" { log.Info().Msg("Using stored KMIP server access token") serverConfig.AccessToken = storedToken + // Only AWS enrollment persists a server ID, so its presence means this server can + // re-authenticate via STS when the stored token is rejected mid-run. + if storedServerID, _ := localkmip.LoadStoredServerID(serverName); storedServerID != "" { + serverConfig.RefreshAccessToken = newAwsRefreshAccessTokenFunc(serverName, storedServerID) + } } } if serverConfig.AccessToken == "" { @@ -149,6 +155,33 @@ func startKmipServer(cmd *cobra.Command, args []string) { kmip.StartServer(serverConfig) } +// newAwsRefreshAccessTokenFunc returns a function that re-authenticates the KMIP server via +// AWS STS and persists the new access token, used by the renewal loop when the current token +// is rejected. Bounded timeouts so a hung API call cannot stall renewal indefinitely. +func newAwsRefreshAccessTokenFunc(serverName, kmipServerID string) func() (string, error) { + return func() (string, error) { + refreshClient, err := util.GetRestyClientWithCustomHeaders() + if err != nil { + return "", fmt.Errorf("unable to create HTTP client: %w", err) + } + refreshClient.SetTimeout(30 * time.Second) + + ctx, cancel := context.WithTimeout(context.Background(), time.Minute) + defer cancel() + + newToken, err := localkmip.LoginKmipServerWithAws(ctx, refreshClient, kmipServerID) + if err != nil { + return "", fmt.Errorf("AWS Auth re-login failed: %w", err) + } + + if err := localkmip.SaveAccessToken(serverName, newToken); err != nil { + log.Warn().Msgf("failed to persist refreshed KMIP access token: %v", err) + } + + return newToken, nil + } +} + // enrollKmipServer obtains a KMIP server access token via token or AWS enrollment, // persisting the relevant state under the KMIP server's config file. For AWS enrollment it // also returns a refresh function so the server can re-authenticate when its access token @@ -187,25 +220,7 @@ func enrollKmipServer(cmd *cobra.Command, enrollMethod, serverName string) (stri log.Info().Msgf("KMIP server authenticated via AWS Auth. State saved to %s", localkmip.GetConfPathDisplay(serverName)) - refreshAccessToken := func() (string, error) { - refreshClient, err := util.GetRestyClientWithCustomHeaders() - if err != nil { - return "", fmt.Errorf("unable to create HTTP client: %w", err) - } - - newToken, err := localkmip.LoginKmipServerWithAws(context.Background(), refreshClient, kmipServerID) - if err != nil { - return "", fmt.Errorf("AWS Auth re-login failed: %w", err) - } - - if err := localkmip.SaveAccessToken(serverName, newToken); err != nil { - log.Warn().Msgf("failed to persist refreshed KMIP access token: %v", err) - } - - return newToken, nil - } - - return accessToken, refreshAccessToken + return accessToken, newAwsRefreshAccessTokenFunc(serverName, kmipServerID) } // Enrollment token path From e00f8650ec59eb33d2df128ac8de994696904637 Mon Sep 17 00:00:00 2001 From: bernie-g Date: Fri, 7 Aug 2026 21:40:52 -0400 Subject: [PATCH 6/6] chore: bump infisical-kmip for renewal loop review fixes --- e2e/go.mod | 2 +- e2e/go.sum | 4 ++-- go.mod | 2 +- go.sum | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/e2e/go.mod b/e2e/go.mod index aa539ef1..826cb969 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -168,7 +168,7 @@ require ( github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/indece-official/go-ebcdic v1.2.0 // indirect github.com/infisical/go-sdk v0.7.0 // indirect - github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b // indirect + github.com/infisical/infisical-kmip v0.3.20-0.20260808014015-39f64ec76f78 // indirect github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect diff --git a/e2e/go.sum b/e2e/go.sum index b79855c8..50710085 100644 --- a/e2e/go.sum +++ b/e2e/go.sum @@ -591,8 +591,8 @@ github.com/indece-official/go-ebcdic v1.2.0 h1:nKCubkNoXrGvBp3MSYuplOQnhANCDEY51 github.com/indece-official/go-ebcdic v1.2.0/go.mod h1:RBddVJt0Ks0eDLRG5dhPwBDRiTNA7n+yv0dVFpSs46Q= github.com/infisical/go-sdk v0.7.0 h1:x9/1PczL+ioVD1jCp4LHQzPpBawatbmkjAC0S1OAtUA= github.com/infisical/go-sdk v0.7.0/go.mod h1:yEfXF+3YDDXiJ9zzJUSzW6me6XXPPEDK52fSU6JfpCA= -github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b h1:T/lEyqFeZz0T4B6tomhlgjmJ1+ffuF2irFRtjOEC5Gw= -github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= +github.com/infisical/infisical-kmip v0.3.20-0.20260808014015-39f64ec76f78 h1:p145uaPRke7N1kP5lMcO/XX/OOosHhQ2JS3095aQVhM= +github.com/infisical/infisical-kmip v0.3.20-0.20260808014015-39f64ec76f78/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf h1:FtEj8sfIcaaBfAKrE1Cwb61YDtYq9JxChK1c7AKce7s= github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf/go.mod h1:yrqSXGoD/4EKfF26AOGzscPOgTTJcyAwM2rpixWT+t4= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= diff --git a/go.mod b/go.mod index a38b2ddb..b1c046b6 100644 --- a/go.mod +++ b/go.mod @@ -23,7 +23,7 @@ require ( github.com/google/uuid v1.6.0 github.com/h2non/filetype v1.1.3 github.com/infisical/go-sdk v0.7.0 - github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b + github.com/infisical/infisical-kmip v0.3.20-0.20260808014015-39f64ec76f78 github.com/jackc/pgx/v5 v5.9.2 github.com/jcmturner/gokrb5/v8 v8.4.4 github.com/masterzen/winrm v0.0.0-20260407182533-5570be7f80cf diff --git a/go.sum b/go.sum index f97ca450..be0e57ea 100644 --- a/go.sum +++ b/go.sum @@ -416,8 +416,8 @@ github.com/indece-official/go-ebcdic v1.2.0 h1:nKCubkNoXrGvBp3MSYuplOQnhANCDEY51 github.com/indece-official/go-ebcdic v1.2.0/go.mod h1:RBddVJt0Ks0eDLRG5dhPwBDRiTNA7n+yv0dVFpSs46Q= github.com/infisical/go-sdk v0.7.0 h1:x9/1PczL+ioVD1jCp4LHQzPpBawatbmkjAC0S1OAtUA= github.com/infisical/go-sdk v0.7.0/go.mod h1:yEfXF+3YDDXiJ9zzJUSzW6me6XXPPEDK52fSU6JfpCA= -github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b h1:T/lEyqFeZz0T4B6tomhlgjmJ1+ffuF2irFRtjOEC5Gw= -github.com/infisical/infisical-kmip v0.3.20-0.20260807184232-e21f475ca02b/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= +github.com/infisical/infisical-kmip v0.3.20-0.20260808014015-39f64ec76f78 h1:p145uaPRke7N1kP5lMcO/XX/OOosHhQ2JS3095aQVhM= +github.com/infisical/infisical-kmip v0.3.20-0.20260808014015-39f64ec76f78/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=