TLS Util: Support parsing PKCS1 and PKCS8 private keys

[brucec5]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

Is your feature request related to a problem? Please describe.

Similar to hashicorp/consul#7622, it appears that consul-k8s only supports EC private keys. This is despite the fact that consul itself supports EC, PKCS1, and PKCS8 private keys.

The consul-k8s code in question:

consul-k8s/helper/cert/tls_util.go

Lines 153 to 168 in 8946d1a

	// ParseSigner parses a crypto.Signer from a PEM-encoded key. The private key
	// is expected to be the first block in the PEM value.
	func ParseSigner(pemValue string) (crypto.Signer, error) {
	// The _ result below is not an error but the remaining PEM bytes.
	block, _ := pem.Decode([]byte(pemValue))
	if block == nil {
	return nil, fmt.Errorf("no PEM-encoded data found")
	}
	switch block.Type {
	case "EC PRIVATE KEY":
	return x509.ParseECPrivateKey(block.Bytes)
	default:
	return nil, fmt.Errorf("unknown PEM block type for signing key: %s", block.Type)
	}
	}

The similar code in consul:
https://github.com/hashicorp/consul/blob/27de64da7095570012e9f8f7aec16aaf66d2a773/agent/connect/parsing.go#L112-L141

Feature Description

Support parsing all of the private key formats that Consul supports. I'm not sure if you can just use the existing tlsutil package from the consul repo, so worst case I guess you could just copy/paste in that same bit of code.

Use Case(s)

We should be able to specify an RSA private key in the .global.tls.caKey values.yaml entry.

Contributions

[david-yu]

Hi @brucec5 thank you submitting this feature request. This is a great feature request and we will add this to our backlog. It is likely we won't be able to get to in some time since we have some other feature work going on right now. As a follow up question, I assume you are using PKCS1 or PKCS8 in Vault? Which one of the two do you have a preference for to helps us prioritize between the two?