Add support for GCP KMS

[omerlh]

For kubernetes cluster running on GCP. Look like there is an SDK for dotnet.
How do we handle authentication?

[bweston92]

Service account token mounted on the container should be able to provide access to Google’s KMS.

Or we can store the token file as a secret and mount to the relevant place.

https://cloud.google.com/docs/authentication/getting-started

[omerlh]

Yep, I assumed that is something we can do easily - the same integration can be done for AWS and Azure. Does KMS is the right choice here? I think it does not have the same support for HSM as Azure KeyVault.
Also, is that something you'll be interested at? I can help writing the code, but need help testing it :)

[bweston92]

Google also supports a HSM.

I would be more then willing to test it.

When I first looked at this with out it I wanted to add it but then noticed it was is in C# which is new to me.

[omerlh]

Cool! What is your preference here? HSM or KMS? From a security point of view, I would say HSM, but it might have additional cost and PKCS11 is not something I would like to do again...

[bweston92]

I believe they use the same API on GCS. When you create the key ring you specify whether you want to use a HSM or not. I’m fine either way and to be honest I don’t have much experience with crypto beyond using the APIs.

[omerlh]

Ohh I see. This is a bit different than AWS I think. I'll try to find time in the next few days and work on a quick POC so you can test it out :)

[bweston92]

Thanks, if there is anything I can do let me know, looking forward to testing it.

On Sun, 6 Jan 2019 at 17:50, Omer Levi Hevroni ***@***.***> wrote: Ohh I see. This is a bit different than AWS I think. I'll try to find time in the next few days and work on a quick POC so you can test it out :) — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#61 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABrq2e9bjH08UxsQ5K-pWg8MQPOcjkidks5vAjdtgaJpZM4Zlk34> .

-- - Bradley Weston (bradwestonwigston@gmail.com)

[omerlh]

I had some time tonight, it was a bit harder than I was thinking. I try tomorrow to finish the decryption part (it should take far less time now that I know how the magic is working).
Let's move to talk on Slack? It will be a lot faster to resolve issues. I'll release tests images when I'm done so you can test it out. Use this link to join :)