Server: Allow Azure Managed HSM to be used in the azurekeyvault key manager plugin#6751
Server: Allow Azure Managed HSM to be used in the azurekeyvault key manager plugin#6751sorindumitru merged 6 commits intospiffe:mainfrom
Conversation
skeiffer
changed the title
| return nil, status.Error(codes.Internal, "key type is missing") | ||
| } | ||
| keyType := string(*keyVaultKey.Kty) | ||
| if strings.HasSuffix(keyType, "-HSM") { |
There was a problem hiding this comment.
Changes look good based on what they document about the key type, but could explicitly check for RSA-HSM and EC-HSM in case they add anything else in there that might be causing us issues in the future?
There was a problem hiding this comment.
Sorry for the delay, I have made this change.
skeiffer
requested review from
MarcosDY,
amartinezfayo,
evan2645 and
rturner3
as code owners
@nikotih, I tested these changes (after fixing the changed constant names) and it appeared to work as expected. I did not however test all the plugins that had their libraries updated. I have not included your changes in this PR to keep things clean. |
|
@sorindumitru Can you please approve the workflows to run? An upstream change to master introduced some new problems that I had to fix. Need to run the tests again. |
skeiffer
force-pushed
the
dev/fixMhsmKty
branch
4 times, most recently
from
5b4c376 to
333a9fb
Compare
Signed-off-by: Scott Keiffer edkeiffer@microsoft.com Signed-off-by: Scott Keiffer <edkeiffe@microsoft.com>
Signed-off-by: Scott Keiffer edkeiffer@microsoft.com Signed-off-by: Scott Keiffer <edkeiffe@microsoft.com>
Signed-off-by: Scott Keiffer edkeiffer@microsoft.com Signed-off-by: Scott Keiffer <edkeiffe@microsoft.com>
Signed-off-by: Scott Keiffer edkeiffer@microsoft.com Signed-off-by: Scott Keiffer <edkeiffe@microsoft.com>
Signed-off-by: Scott Keiffer edkeiffer@microsoft.com Signed-off-by: Scott Keiffer <edkeiffe@microsoft.com>
Signed-off-by: Scott Keiffer <edkeiffe@microsoft.com>
skeiffer
force-pushed
the
dev/fixMhsmKty
branch
from
333a9fb to
4f3e558
Compare
|
@sorindumitru, Third times a charm? I ran the workflows via my fork, should be good now. |
sorindumitru
left a comment
sorindumitru
left a comment
There was a problem hiding this comment.
LGTM, thanks @skeiffer !
3 participants
Pull Request check list
Affected functionality
The azure keyvault key manager plugin does not work with Azure Managed HSM.
Description of change
keyTypeFromKeySpecto allowRSA-HSMandEC-HSMas valid key types.keyVaultKeyToRawKeyto normalize thekty, removing-HSMso data can be parsed by go-jose.keyTypeFromKeySpec&keyVaultKeyToRawKeyWhich issue this PR fixes
#6750