Documentation
¶
Overview ¶
Package gcpkms implements keys.ManagerInterface with a Google Cloud Platform Key Management Service (GCP KMS) client.
The key management operations Bootstrap/Rotate/Wipeout are primarily implemented in rotate/, but any extra KMS-specific arguments for the commands are defined as context types within their respective <command>.go file.
Index ¶
- Variables
- func NewBootstrapContext(ctx context.Context, f *BootstrapContext) context.Context
- func NewSigningKeyContext(ctx context.Context, f *SigningKeyContext) context.Context
- type BootstrapContext
- type Manager
- func (m *Manager) AddFlags(cmd *cobra.Command)
- func (m *Manager) CertificateTemplate(ctx context.Context, issuer *x509.Certificate, subjectPubKey any) (*x509.Certificate, error)
- func (m *Manager) CreateFirstSigningKey(ctx context.Context) (string, error)
- func (m *Manager) CreateNewRootKey(ctx context.Context) (string, error)
- func (m *Manager) CreateNewSigningKeyVersion(ctx context.Context) (string, error)
- func (m *Manager) DestroyKeyVersion(ctx context.Context, keyVersionName string) error
- func (m *Manager) FullKeyName(keyName string) string
- func (m *Manager) FullKeyRingName() string
- func (m *Manager) FullLocationName() string
- func (m *Manager) InitContext(ctx context.Context) (context.Context, error)
- func (m *Manager) PersistentPreRunE(*cobra.Command, []string) error
- func (m *Manager) Wipeout(ctx context.Context) error
- type Signer
- type SigningKeyContext
Constants ¶
This section is empty.
Variables ¶
var ( // ErrNoKeyVersions is returned when bootstrapping fails to find a key version under a created // key. ErrNoKeyVersions = errors.New("no enabled or pending_generation key versions post key-creation") // ErrNoBootstrapContext is returned when gcpkms.FromBootstrapContext can't find the requisite // context. ErrNoBootstrapContext = errors.New("no gcpkms.BootstrapContext in context") )
var ( // ErrNoSigningKeyContext is returned when gcpkms.FromSigningKeyContext can't find the requisite // context. ErrNoSigningKeyContext = errors.New("no gcpkms.SigningKeyContext in context") )
Functions ¶
func NewBootstrapContext ¶
func NewBootstrapContext(ctx context.Context, f *BootstrapContext) context.Context
NewBootstrapContext returns ctx extended with the given KmsBootstrapContext.
func NewSigningKeyContext ¶
func NewSigningKeyContext(ctx context.Context, f *SigningKeyContext) context.Context
NewSigningKeyContext returns ctx extended with the given gcpkms.SigningKeyContext.
Types ¶
type BootstrapContext ¶
type BootstrapContext struct {
// KeyRingID is the base name for the root ring within the given project, location, and key ring.
RootKeyID string
// SigningKeyID is the base name for the signing key within the given project, location, and key ring.
SigningKeyID string
// SigningKeyOperators are IAM member strings to assign the given accounts as a signing key operator.
SigningKeyOperators []string
}
BootstrapContext encapsulates the KMS-specific options for key bootstrapping.
func FromBootstrapContext ¶
func FromBootstrapContext(ctx context.Context) (*BootstrapContext, error)
FromBootstrapContext returns the KmsBootstrapContext in the context if it exists.
func (*BootstrapContext) AddFlags ¶
func (kbc *BootstrapContext) AddFlags(cmd *cobra.Command)
AddFlags adds GCP KMS cryptoKey name flags for the root and signing keys to create.
func (*BootstrapContext) InitContext ¶
InitContext returns the given context without changes.
func (*BootstrapContext) PersistentPreRunE ¶
func (kbc *BootstrapContext) PersistentPreRunE(*cobra.Command, []string) (err error)
PersistentPreRunE returns an error if either root_key or signing_key are unset.
type Manager ¶
type Manager struct {
// Project is the GCP project name that will own the assets.
Project string
// Location is the GCP location name that will host the key ring.
Location string
// KeyRingID is the base name for the key ring within the given project and location.
KeyRingID string
// KeyClient is a connected CloudKMS client.
KeyClient kmspb.KeyManagementServiceClient
// IAMClient is a connected IAM client.
IAMClient iampb.IAMPolicyClient
}
Manager defines KMS-specific input parameters for key operations.
func (*Manager) AddFlags ¶
AddFlags defines GCP KMS-specific key management flags for all key subcommands.
func (*Manager) CertificateTemplate ¶
func (m *Manager) CertificateTemplate(ctx context.Context, issuer *x509.Certificate, subjectPubKey any) (*x509.Certificate, error)
CertificateTemplate returns a certificate template that will be used for signing.
func (*Manager) CreateFirstSigningKey ¶
CreateFirstSigningKey is called during CA bootstrapping to create the first signing key that can be used for endorse.
func (*Manager) CreateNewRootKey ¶
CreateNewRootKey establishes a new key for use as the root CA key.
func (*Manager) CreateNewSigningKeyVersion ¶
CreateNewSigningKeyVersion is callable after CreateNewSigningKey, and is meant for key rotation. The signing key's name ought to be available from the context.
func (*Manager) DestroyKeyVersion ¶
DestroyKeyVersion destroys a single key version.
func (*Manager) FullKeyName ¶
FullKeyName returns the key name as CloudKMS understands names given the project, location, key ring name, and key name.
func (*Manager) FullKeyRingName ¶
FullKeyRingName returns the keyRing name as CloudKMS understands names given the project, location, and the keyRing name.
func (*Manager) FullLocationName ¶
FullLocationName returns the location-based parent resource name as CloudKMS understands names given the project and location names.
func (*Manager) InitContext ¶
InitContext initializes keys.Context's Manager to the gcskms.Manager and the signer to a gcpkms Signer.
func (*Manager) PersistentPreRunE ¶
PersistentPreRunE returns an error if any flag values are invalid.
type Signer ¶
type Signer struct {
Manager *Manager
}
Signer implements sops.Signer for signing hashes with named keys.
type SigningKeyContext ¶
type SigningKeyContext struct {
// SigningKeyID is the base name for the signing key within the given project, location, and key
// ring.
SigningKeyID string
}
SigningKeyContext holds the KMS-specific arguments needed for specifying a key rotation.
func FromSigningKeyContext ¶
func FromSigningKeyContext(ctx context.Context) (*SigningKeyContext, error)
FromSigningKeyContext returns the gcpkms.SigningKeyContext in the context if it exists.
func (*SigningKeyContext) AddFlags ¶
func (skc *SigningKeyContext) AddFlags(cmd *cobra.Command)
AddFlags adds a GCP KMS cryptoKey name flag for the signing key to rotate.
func (*SigningKeyContext) InitContext ¶
InitContext returns the given context without changes.
func (*SigningKeyContext) PersistentPreRunE ¶
func (skc *SigningKeyContext) PersistentPreRunE(*cobra.Command, []string) error
PersistentPreRunE returns an error if signing_key is unset.
Source Files