feat: implement Hashicorp Vault signing service #4749
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
...mmon/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVault.java
Dismissed
Show dismissed
Hide dismissed
...mmon/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVault.java
Dismissed
Show dismissed
Hide dismissed
spi/common/boot-spi/src/main/java/org/eclipse/edc/spi/security/SignatureService.java
Dismissed
Show dismissed
Hide dismissed
spi/common/boot-spi/src/main/java/org/eclipse/edc/spi/security/SignatureService.java
Dismissed
Show dismissed
Hide dismissed
spi/common/boot-spi/src/main/java/org/eclipse/edc/spi/security/SignatureService.java
Dismissed
Show dismissed
Hide dismissed
paullatzelsperger
force-pushed
the
feat/implement_signing_service
branch
from
c7e7fd9 to
645661d
Compare
paullatzelsperger
force-pushed
the
feat/implement_signing_service
branch
from
645661d to
0639c83
Compare
paullatzelsperger
requested review from
ndr-brt and
a team
and removed request for
ndr-brt
jimmarino
approved these changes
Jan 22, 2025
...-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultSignatureService.java
Outdated
Show resolved
Hide resolved
wolf4ood
approved these changes
Jan 22, 2025
paullatzelsperger
force-pushed
the
feat/implement_signing_service
branch
from
3549d45 to
3edaa7f
Compare
ndr-brt
reviewed
Jan 22, 2025
spi/common/boot-spi/src/main/java/org/eclipse/edc/spi/security/SignatureService.java
Show resolved
Hide resolved
spi/common/boot-spi/src/main/java/org/eclipse/edc/spi/security/SignatureService.java
Outdated
Show resolved
Hide resolved
spi/common/boot-spi/src/main/java/org/eclipse/edc/spi/security/SignatureService.java
Outdated
Show resolved
Hide resolved
| */ | ||
| public class HashicorpVaultClient { | ||
| private static final String VAULT_DATA_ENTRY_NAME = "content"; | ||
| public class HashicorpVaultHealthService { |
There was a problem hiding this comment.
I'd also move the renew logic into the HashicorpVaultTokenRenewTask
There was a problem hiding this comment.
no argument there, but lets do this once #4720 is done, so we don't have to do it twice.
...ashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/health/HashicorpVaultHealthCheck.java
Outdated
Show resolved
Hide resolved
...mmon/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVault.java
Outdated
Show resolved
Hide resolved
...mmon/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVault.java
Outdated
Show resolved
Hide resolved
...mmon/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVault.java
Outdated
Show resolved
Hide resolved
...t/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultExtension.java
Show resolved
Hide resolved
...t/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultExtension.java
Outdated
Show resolved
Hide resolved
ndr-brt
approved these changes
Jan 22, 2025
|
note that configuration values are not yet implemented. this should also come in |
paullatzelsperger
force-pushed
the
feat/implement_signing_service
branch
from
f82b69a to
55c06d9
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What this PR changes/adds
This PR mainly adds the
SignatureServiceinterface and an implementation for it based on Hashicorp Vault.Why it does that
remote signing of content and key rotation
Further notes
the
HashicorpVaultimplementation was slightly refactored and simplified. And by "slightly" i mean massively. TheHashicorpVaultClientis now only responsible for token renewal and health checks and was thus renamed toHashicorpVaultHealthService.I think, the token renewal stuff should get pulled out into a separate service too, but I'd wait for #4720 for that, and do it in a subsequent PR
Linked Issue(s)
Closes # <-- insert Issue number if one exists
Please be sure to take a look at the contributing guidelines and our etiquette for pull requests.