Support AWS KMS credentials using decryption secretRef #641

aryan9600 · 2022-04-27T21:46:52Z

Adds support for using .spec.decryption to refer to custom AWS KMS credentials and override global decryption configuration.

Signed-off-by: Sanskar Jaiswal sanskar.jaiswal@weave.works

stefanprodan

Please extend the documentation to cover AWS KMS:

Explain static keys here https://github.com/fluxcd/kustomize-controller/blob/main/docs/spec/v1beta2/kustomization.md#decryption-secret-reference
Explain IRSA here https://github.com/fluxcd/kustomize-controller/blob/main/docs/spec/v1beta2/kustomization.md#controller-global-decryption

PS. For IRSA you can take some of the info from https://fluxcd.io/docs/guides/mozilla-sops/#encrypting-secrets-using-various-cloud-providers

aryan9600 · 2022-04-28T13:58:32Z

@stefanprodan I think it might be redundant to explain IRSA in both the sops guide and the kustomization docs, since IRSA is sufficiently explained in the sops guide (the wording can be improved to be clearer though), so maybe we can link that guide in the kustomization docs?

stefanprodan · 2022-04-28T14:56:12Z

@aryan9600 it's fine to link to the guide, but we need a section like this one https://github.com/fluxcd/kustomize-controller/blob/main/docs/spec/v1beta2/kustomization.md#gcp-kms for AWS.

aryan9600 · 2022-04-28T16:33:43Z

@stefanprodan we already have that, if i'm not mistaken: https://github.com/fluxcd/kustomize-controller/blob/main/docs/spec/v1beta2/kustomization.md#aws. we could add the link to the sops guide (and make the guide clearer) in this section?

hiddeco · 2022-04-28T16:49:57Z

There is no documentation which instructs how to supply a SecretRef and what data the Secret must contain for AWS. Which is explained in detail for any other custom implementation we have. See: https://github.com/fluxcd/kustomize-controller/blob/main/docs/spec/v1beta2/kustomization.md#azure-key-vault-secret-entry

aryan9600 · 2022-04-28T17:09:07Z

Yep, I'm working on that, I was talking about the ISRA stuff 😅

internal/sops/keyservice/server.go

internal/sops/awskms/keysource_test.go

internal/sops/awskms/keysource.go

aryan9600 · 2022-04-30T11:27:54Z

Fuzzing tests are failing because of invalid fuzzing tests in aws-sdk-go-v2, ref: aws/aws-sdk-go-v2#1693

hiddeco

This is shaping up well, couple of nitpicks mostly around making our lives easier when we look at this again in a couple months 😄

internal/sops/awskms/keysource.go

controllers/kustomization_decryptor.go

docs/spec/v1beta2/kustomization.md

internal/sops/awskms/keysource.go

hiddeco · 2022-05-04T08:16:21Z

internal/sops/awskms/keysource.go

+// CredsProvider is a wrapper around aws.CredentialsProvider used for authenticating
+// when using AWS KMS.


Suggested change

// CredsProvider is a wrapper around aws.CredentialsProvider used for authenticating

// when using AWS KMS.

// CredsProvider is a wrapper around aws.CredentialsProvider used for authenticating

// towards AWS KMS.

hiddeco · 2022-05-04T08:17:04Z

internal/sops/awskms/keysource.go

+// createKMSConfig returns a Config configured with the appropriate credentials.
+func (key MasterKey) createKMSConfig() (*aws.Config, error) {
+	// Uses the credentialsProvider if present, otherwise default to reading credentials
+	// from the enviornment.


Suggested change

// from the enviornment.

// from the environment.

hiddeco · 2022-05-04T08:18:17Z

internal/sops/awskms/keysource.go

+}
+
+// ToMap converts the MasterKey to a map for serialization purposes.
+func (key MasterKey) ToMap() map[string]interface{} {


This should be above private methods.

hiddeco · 2022-05-04T08:33:26Z

internal/sops/awskms/keysource.go

+	// epResolver IS ONLY MEANT TO BE USED FOR TESTS.
+	// it can be used to override the endpoint that the AWS client resolves to
+	// by default. it's hacky but there is no other choice, since you can't
+	// specify the endpoint as an env var like you can do with an access key.
+	epResolver aws.EndpointResolver


Suggested change

// epResolver IS ONLY MEANT TO BE USED FOR TESTS.

// it can be used to override the endpoint that the AWS client resolves to

// by default. it's hacky but there is no other choice, since you can't

// specify the endpoint as an env var like you can do with an access key.

epResolver aws.EndpointResolver

// epResolver can be used to override the endpoint the AWS client resolves

// to by default. This is mostly used for testing purposes as it can not be

// injected using e.g. an environment variable. The field is not publicly

// exposed, nor configurable.

epResolver aws.EndpointResolver

hiddeco · 2022-05-04T08:39:03Z

internal/sops/keyservice/options.go

@@ -56,6 +57,16 @@ func (o WithAgeIdentities) ApplyToServer(s *Server) {
 	s.ageIdentities = age.ParsedIdentities(o)
 }

+// WithAWSKeys configurs the AWS credentials on the Server


Suggested change

// WithAWSKeys configurs the AWS credentials on the Server

// WithAWSKeys configures the AWS credentials on the Server.

hiddeco · 2022-05-04T08:39:25Z

internal/sops/keyservice/server.go

@@ -43,6 +44,11 @@ type Server struct {
 	// When nil, the request will be handled by defaultServer.
 	azureToken *azkv.Token

+	// awsCredsProvider is the Credentials object used for Encrypt and Decrypt
+	// operations of AWS KMS requests.
+	// When nil, the request will be handled by defaultServer.


This is no longer correct.

internal/sops/awskms/keysource.go

hiddeco

Stellar job 💯

pjbgf

two tiny nits, apart from that LGTM

great work @aryan9600!

docs/spec/v1beta2/kustomization.md

internal/sops/awskms/keysource.go

stefanprodan · 2022-05-09T15:02:41Z

What are we going to do about fuzzing? We can't merge this and have all PRs from now on failing. Can we disable the AWS tests?

pjbgf · 2022-05-09T15:50:09Z

What are going to do about fuzzing? We can't merge this and have all PRs from now on failing. Can we disable the AWS tests?

We will disable them for the time being whilst we wait for the fix upstream. The approach we discussed so far is picking a different conditional tag for our own fuzz tests.

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

docs/spec/v1beta2/kustomization.md

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

pjbgf

Great job @aryan9600! 👏 👏

LGTM

hiddeco · 2022-05-20T10:34:05Z

Can we please change the license on this (internal/sops/awskms) to MPL 2.0 before we merge.

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

aryan9600 force-pushed the aws-kms-decryption branch 2 times, most recently from 4fb4b50 to 92851a2 Compare April 28, 2022 06:19

stefanprodan reviewed Apr 28, 2022

View reviewed changes

hiddeco self-requested a review April 28, 2022 13:38

hiddeco added enhancement New feature or request area/sops SOPS related issues and pull requests labels Apr 28, 2022

aryan9600 force-pushed the aws-kms-decryption branch from 2e62ca8 to 6477928 Compare April 29, 2022 06:21

hiddeco reviewed Apr 29, 2022

View reviewed changes

internal/sops/keyservice/server.go Outdated Show resolved Hide resolved

internal/sops/awskms/keysource_test.go Show resolved Hide resolved

hiddeco added this to the GA milestone Apr 29, 2022

hiddeco reviewed Apr 29, 2022

View reviewed changes

internal/sops/awskms/keysource.go Outdated Show resolved Hide resolved

aryan9600 force-pushed the aws-kms-decryption branch from 7134c39 to 4a25078 Compare April 30, 2022 09:53

aryan9600 requested review from hiddeco and stefanprodan May 3, 2022 06:59

hiddeco reviewed May 3, 2022

View reviewed changes

controllers/kustomization_decryptor.go Outdated Show resolved Hide resolved

hiddeco changed the title ~~Add support for AWS KMS credentials using .spec.decryption~~ Support AWS KMS credentials using decryption secretRef May 3, 2022

stefanprodan reviewed May 4, 2022

View reviewed changes

docs/spec/v1beta2/kustomization.md Outdated Show resolved Hide resolved

aryan9600 force-pushed the aws-kms-decryption branch 3 times, most recently from 6bfdba4 to 2942001 Compare May 4, 2022 08:13

hiddeco reviewed May 4, 2022

View reviewed changes

aryan9600 force-pushed the aws-kms-decryption branch from 2942001 to b9a3ca6 Compare May 4, 2022 10:06

hiddeco reviewed May 4, 2022

View reviewed changes

internal/sops/awskms/keysource.go Outdated Show resolved Hide resolved

aryan9600 force-pushed the aws-kms-decryption branch from b9a3ca6 to 8b907d3 Compare May 5, 2022 11:57

hiddeco approved these changes May 5, 2022

View reviewed changes

hiddeco requested a review from pjbgf May 5, 2022 16:01

aryan9600 force-pushed the aws-kms-decryption branch from 8b907d3 to 000d6db Compare May 9, 2022 08:08

pjbgf reviewed May 9, 2022

View reviewed changes

docs/spec/v1beta2/kustomization.md Outdated Show resolved Hide resolved

internal/sops/awskms/keysource.go Outdated Show resolved Hide resolved

aryan9600 force-pushed the aws-kms-decryption branch from 000d6db to 3be256f Compare May 9, 2022 08:52

stefanprodan mentioned this pull request May 10, 2022

Unable to decrypt files via sops and KMS using v0.26.1 version fluxcd/flux2#2405

Open

aryan9600 force-pushed the aws-kms-decryption branch from cf31abd to 28d40d7 Compare May 19, 2022 09:02

Sanskar Jaiswal added 5 commits May 19, 2022 14:33

add support for AWS KMS credentials using .spec.decryption

53aded2

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

add docs

c801f75

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

migrate aws kms implementation to aws-go-sdk-v2

e5a37b7

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

add and update tests for awskms and hcvault

1ee85e5

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

update code comments and kms decryption docs

326e20c

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

aryan9600 force-pushed the aws-kms-decryption branch 4 times, most recently from 8873d41 to 3f61e59 Compare May 19, 2022 14:13

pjbgf reviewed May 20, 2022

View reviewed changes

docs/spec/v1beta2/kustomization.md Outdated Show resolved Hide resolved

pjbgf reviewed May 20, 2022

View reviewed changes

docs/spec/v1beta2/kustomization.md Outdated Show resolved Hide resolved

add secret mount note in docs

d7307bb

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

aryan9600 force-pushed the aws-kms-decryption branch from 3f61e59 to d7307bb Compare May 20, 2022 09:13

pjbgf approved these changes May 20, 2022

View reviewed changes

update sops awskms files to use MPL 2.0

c8a00fb

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

hiddeco approved these changes May 20, 2022

View reviewed changes

hiddeco merged commit 4cde465 into fluxcd:main May 20, 2022

aryan9600 mentioned this pull request May 27, 2022

sops/awskms: Fix AWS KMS config creation #667

Merged

stefanprodan modified the milestones: GA, Bootstrap GA Jul 4, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support AWS KMS credentials using decryption secretRef #641

Support AWS KMS credentials using decryption secretRef #641

aryan9600 commented Apr 27, 2022

stefanprodan left a comment

aryan9600 commented Apr 28, 2022

stefanprodan commented Apr 28, 2022

aryan9600 commented Apr 28, 2022

hiddeco commented Apr 28, 2022 •

edited

aryan9600 commented Apr 28, 2022

aryan9600 commented Apr 30, 2022

hiddeco left a comment

hiddeco May 4, 2022

hiddeco May 4, 2022

hiddeco May 4, 2022

hiddeco May 4, 2022 •

edited

hiddeco May 4, 2022

hiddeco May 4, 2022

hiddeco left a comment

pjbgf left a comment

stefanprodan commented May 9, 2022 •

edited

pjbgf commented May 9, 2022

pjbgf left a comment

hiddeco commented May 20, 2022 •

edited

		// CredsProvider is a wrapper around aws.CredentialsProvider used for authenticating
		// when using AWS KMS.

	// WithAWSKeys configurs the AWS credentials on the Server
	// WithAWSKeys configures the AWS credentials on the Server.

Support AWS KMS credentials using decryption secretRef #641

Support AWS KMS credentials using decryption secretRef #641

Conversation

aryan9600 commented Apr 27, 2022

stefanprodan left a comment

Choose a reason for hiding this comment

aryan9600 commented Apr 28, 2022

stefanprodan commented Apr 28, 2022

aryan9600 commented Apr 28, 2022

hiddeco commented Apr 28, 2022 • edited

aryan9600 commented Apr 28, 2022

aryan9600 commented Apr 30, 2022

hiddeco left a comment

Choose a reason for hiding this comment

hiddeco May 4, 2022

Choose a reason for hiding this comment

hiddeco May 4, 2022

Choose a reason for hiding this comment

hiddeco May 4, 2022

Choose a reason for hiding this comment

hiddeco May 4, 2022 • edited

Choose a reason for hiding this comment

hiddeco May 4, 2022

Choose a reason for hiding this comment

hiddeco May 4, 2022

Choose a reason for hiding this comment

hiddeco left a comment

Choose a reason for hiding this comment

pjbgf left a comment

Choose a reason for hiding this comment

stefanprodan commented May 9, 2022 • edited

pjbgf commented May 9, 2022

pjbgf left a comment

Choose a reason for hiding this comment

hiddeco commented May 20, 2022 • edited

hiddeco commented Apr 28, 2022 •

edited

hiddeco May 4, 2022 •

edited

stefanprodan commented May 9, 2022 •

edited

hiddeco commented May 20, 2022 •

edited