Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature Request: Use HashiCorp Vault as a SPIRE Server KeyManager #5058

Open
InverseIntegral opened this issue Apr 11, 2024 · 3 comments · May be fixed by #5500
Open

Feature Request: Use HashiCorp Vault as a SPIRE Server KeyManager #5058

InverseIntegral opened this issue Apr 11, 2024 · 3 comments · May be fixed by #5500
Assignees
@InverseIntegral
Labels
priority/backlog Issue is approved and in the backlog

Comments

@InverseIntegral
Copy link

We are currently using HashiCorp Vault as our UpstreamAuthority for our SPIRE setup and we would like to also use the Vault as a KeyManager. Therefore, we propose the addition of a new plugin that integrates Vault into the SPIRE ecosystem via a KeyManager plugin. This plugin could be applied to both the spire-server and the spire-agent. One thing that we should consider is whether Vault supports the appropriate key types that are used by SPIRE.

I would also be willing to implement such a plugin but I'm not quite sure where to get started.
@rturner3 rturner3 added the triage/in-progress Issue triage is in progress label Apr 11, 2024
@evan2645
Copy link
Member

Thanks for opening this @InverseIntegral ❤️

I think there's a clear use case for Vault-based KeyManager on SPIRE Server .. I took the liberty of updating this issue title to reflect that. Use case around SPIRE Agent plugin for this is a little more hazy to me, so I'd like to suggest you create a new issue for that if you're interested, there will probably be some questions there.

In terms of moving this contribution forward, the best resource will be the SPIRE channel in SPIFFE slack .. post a message there that you're trying to author a plugin and someone can help. You can see current plugin implementations here and SDK containing the protos and utils for building out-of-tree plugins here

@evan2645 evan2645 changed the title Feature Request: Use HashiCorp Vault as a KeyManager Feature Request: Use HashiCorp Vault as a SPIRE Server KeyManager Apr 18, 2024
@evan2645 evan2645 added help wanted Issues with this label are ready to start work but are in need of someone to do it priority/backlog Issue is approved and in the backlog and removed triage/in-progress Issue triage is in progress labels Apr 18, 2024
@evan2645
Copy link
Member

@InverseIntegral if you're still willing to carry this forward please let me know and I'll assign the issue to you. You can find me on SPIFFE slack as well. Thank you!! 🙏

@InverseIntegral
Copy link
Author

@evan2645 Thanks for getting back to me. Yes, my intention was to implement this for the SPIRE server first. I've also thought about a use-case for a similar plugin for the SPIRE agent but that would require a separate issue. I would love to work on this once I'm back home from my extended holidays, so feel free to assign the issue to me 🙂 And thank you for the pointers to previous plugin implementations!

@evan2645 evan2645 removed the help wanted Issues with this label are ready to start work but are in need of someone to do it label Apr 26, 2024
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Aug 16, 2024
@InverseIntegral
Create skeleton of HC Vault based server keymanager plugin (spiffe#5058)
4a137ce
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Aug 18, 2024
@InverseIntegral
Start implementing signing function for HC vault (spiffe#5058)
2a3de21
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Aug 22, 2024
@InverseIntegral
Make SignData work with HC Vault keymanager plugin (spiffe#5058)
2a920d1
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Aug 22, 2024
@InverseIntegral
Rename transit key type constants (spiffe#5058)
3dc796e
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Aug 22, 2024
@InverseIntegral
Make vault client more robust by handling invariant violations (spiff…
1cf1d8f 
…e#5058)
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 2, 2024
@InverseIntegral
Move logic from plugin to vault client (spiffe#5058)
b5aeefe
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 8, 2024
@InverseIntegral
Refactor logic to generate vault client (spiffe#5058)
25c0475
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 8, 2024
@InverseIntegral
Use latest key version to sign data (spiffe#5058)
9d3d15d
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 8, 2024
@InverseIntegral
Move data encoding to vault client (spiffe#5058)
ed6cb04
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 8, 2024
@InverseIntegral
Add simple vault client auth test (spiffe#5058)
bb9fb10
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 9, 2024
@InverseIntegral
Remove unused test code (spiffe#5058)
133a0f4
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 9, 2024
@InverseIntegral
Support configuring vault namespace (spiffe#5058)
89c8b77
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 9, 2024
@InverseIntegral
Support AppRole authentication (spiffe#5058)
f5f1c14
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 11, 2024
@InverseIntegral
Make transit engine path configurable (spiffe#5058)
dc8fea9
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 11, 2024
@InverseIntegral
Add comments to exported functions (spiffe#5058)
d2e173c
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 11, 2024
@InverseIntegral
Support certificate authentication (spiffe#5058)
0adbae3
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 11, 2024
@InverseIntegral
Add missing app role auth test case (spiffe#5058)
0197130
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 12, 2024
@InverseIntegral
Support K8s auth (spiffe#5058)
d67fcd6
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 16, 2024
@InverseIntegral
Support verifying server certificate via CA (spiffe#5058)
489d493
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 16, 2024
@InverseIntegral
Test vault client create key function (spiffe#5058)
d74610e
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Rename transit key type constants (spiffe#5058)
beabe56 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Make vault client more robust by handling invariant violations (spiff…
39e4803 
…e#5058)

Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Move logic from plugin to vault client (spiffe#5058)
8d60d50 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Refactor logic to generate vault client (spiffe#5058)
90f68fd 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Use latest key version to sign data (spiffe#5058)
c6332a0 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Move data encoding to vault client (spiffe#5058)
8042877 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Add simple vault client auth test (spiffe#5058)
702193a 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Remove unused test code (spiffe#5058)
0d78ffa 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Support configuring vault namespace (spiffe#5058)
41b91e5 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Support AppRole authentication (spiffe#5058)
c8e9b0b 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Make transit engine path configurable (spiffe#5058)
573cca6 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Add comments to exported functions (spiffe#5058)
7d3d9f7 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Support certificate authentication (spiffe#5058)
53f5709 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Add missing app role auth test case (spiffe#5058)
9d6ea3e 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Support K8s auth (spiffe#5058)
82f4be6 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Support verifying server certificate via CA (spiffe#5058)
12fe8c4 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Test vault client create key function (spiffe#5058)
d15d8ff 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Test vault client get key function (spiffe#5058)
5c33e05 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Test vault client sign data function (spiffe#5058)
1438bc4 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Test vault key manager configure function (spiffe#5058)
c2879e2 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Test vault key manager generate key function (spiffe#5058)
2a074d9 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Load keys from Vault on configure (spiffe#5058)
d739d8e 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Test get key entry function (spiffe#5058)
2ba4eb4 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Test get keys function (spiffe#5058)
4f1b244 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Add simple plugin documentation (spiffe#5058)
307a2a7 
Signed-off-by: Matteo Kamm <[email protected]>
@InverseIntegral InverseIntegral linked a pull request Sep 18, 2024 that will close this issue
Open
3 tasks
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 18, 2024
@InverseIntegral
Remove unused hooks (spiffe#5058)
3176da5
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Sep 19, 2024
@InverseIntegral
Remove unused hooks (spiffe#5058)
db491f3 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Oct 20, 2024
@InverseIntegral
Fix hcl examples in documentation (spiffe#5058)
f57fd03 
Signed-off-by: Matteo Kamm <[email protected]>
InverseIntegral added a commit to InverseIntegral/spire that referenced this issue Nov 2, 2024
@InverseIntegral
Add KeyManager vault integration test (spiffe#5058)
7113b7b 
Signed-off-by: Matteo Kamm <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@InverseIntegral InverseIntegral

Labels
priority/backlog Issue is approved and in the backlog
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add HashiCorp Vault key manager plugin to SPIRE server InverseIntegral/spire
3 participants
@evan2645 @InverseIntegral @rturner3