keyring: E2E testing for KMS/rotation #23601
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tgross
force-pushed
the
keyring-external-kms
branch
from
ca0ad51
to
8f123e7
Compare
tgross
force-pushed
the
keyring-external-kms
branch
from
8f123e7
to
2167010
Compare
tgross
force-pushed
the
e2e-keyring-external-kms
branch
2 times, most recently
from
62910f6
to
e93d439
Compare
tgross
force-pushed
the
keyring-external-kms
branch
from
2167010
to
f29a23d
Compare
tgross
force-pushed
the
e2e-keyring-external-kms
branch
from
e93d439
to
42a638b
Compare
tgross
force-pushed
the
keyring-external-kms
branch
from
f29a23d
to
0f2ca08
Compare
tgross
force-pushed
the
e2e-keyring-external-kms
branch
from
42a638b
to
c178ddd
Compare
tgross
changed the title
tgross
changed the title
In #23580 we're implementing support for encrypting Nomad's key material with external KMS providers or Vault Transit. This changeset breaks out the E2E infrastructure and testing from that PR to keep the review manageable. Ref: https://hashicorp.atlassian.net/browse/NET-10334 Ref: #14852 Ref: #23580
tgross
force-pushed
the
e2e-keyring-external-kms
branch
from
c178ddd
to
677b7f1
Compare
tgross
force-pushed
the
e2e-keyring-external-kms
branch
from
e3d449a
to
c1e9132
Compare
gulducat
approved these changes
Jul 18, 2024
|
|
||
| func getJWKS(t *testing.T) *jose.JSONWebKeySet { | ||
| t.Helper() | ||
| out, err := e2eutil.Commandf("nomad operator api /.well-known/jwks.json") |
There was a problem hiding this comment.
tangent: intriguing that our api package doesn't have a method for this.
There was a problem hiding this comment.
Yeah, I considered adding that here but I wanted to see if there was a reason that @schmichael didn't implement it first.
Co-authored-by: Daniel Bennett <dbennett@hashicorp.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In #23580 we're implementing support for encrypting Nomad's key material with external KMS providers or Vault Transit. In #23577 we're implementing support for prepublishing keys. This changeset updates the E2E infrastructure to use an external KMS and adds tests for rotation.
Ref: https://hashicorp.atlassian.net/browse/NET-10398
Ref: https://hashicorp.atlassian.net/browse/NET-10280
Ref: https://hashicorp.atlassian.net/browse/NET-10334
Ref: #14852
Ref: #23580
Note to reviewers: this PR requires #23580 and #23577 to be merged before we can merge this. Test run against a build that includes both PRs: