Skip to content
This repository has been archived by the owner on Dec 4, 2019. It is now read-only.

Rename to citadel #23

Merged
merged 3 commits into from
Mar 29, 2018
Merged

Rename to citadel #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e7ea3e6
Rename to citadel: minimum move and imports change
enj Mar 28, 2018
e31361e
Rename to citadel: add api package
enj Mar 28, 2018
9b46f75
Rename to citadel: Update README
enj Mar 28, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,21 @@
# Welcome to KMS!
# Welcome to Citadel!

KMS is a simple daemon that implements the Kubernetes Key Management Service
Citadel (c5l) is a simple daemon that implements the Kubernetes Key Management Service (KMS)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like the c5l abbreviation. citadel isn't that long.

Copy link
Owner Author

@enj enj Mar 28, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I used it as the short name in the prefix code (to mimic kube), so I wanted to actually use it so people would know what it was referring to.

I am not really worried about the length in the docs, it is more of "google will find it"

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I still don't like it, but if you want to mimic kube, I can accept that.

interface by acquiring a key encryption key (KEK) from an arbitrary command.
This makes it easy to plug in your own key management solution as a simple unix
command that returns the KEK.

## How does it work?

When KMS starts, it runs the command you provide it. This command returns the
KEK on standard output. If this command fails during startup, the KMS will exit.
When c5l starts, it runs the command you provide it. This command returns the
KEK on standard output. If this command fails during startup, c5l will exit.
Otherwise, it will use the KEK from the command to encrypt and decrypt input
from Kubernetes.

KMS caches the KEK, and thus does not call the command on every incoming
c5l caches the KEK, and thus does not call the command on every incoming
request. The time limit of this cache is specified by the `timeout` argument.
If the KMS is not able to refresh the cache after trying several times, it will
purge the KEK and report errors to Kubernetes. If the KMS eventually succeeds
If c5l is not able to refresh the cache after trying several times, it will
purge the KEK and report errors to Kubernetes. If c5l eventually succeeds
in acquiring the KEK, normal operation will resume.

To specify the socket to create, use the `endpoint` argument. Otherwise,
Expand All @@ -29,7 +29,7 @@ socket activation is assumed.

### Optional

* `--endpoint string`: the listen address (ex. `unix:///tmp/kms.sock`)
* `--endpoint string`: the listen address (ex. `unix:///tmp/socket`)

* `--timeout duration`: maximum time to cache KEK locally (default 1h)

Expand Down
13 changes: 13 additions & 0 deletions cmd/citadel/citadel.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
package main

import (
"log"

"github.com/enj/citadel/pkg/cmd/citadel"
)

func main() {
if err := citadel.Execute(); err != nil {
log.Fatal(err)
}
}
13 changes: 0 additions & 13 deletions cmd/kms/kms.go
View file
Open in desktop

This file was deleted.

7 changes: 7 additions & 0 deletions pkg/api/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
package api

const (
Name = "citadel"
ShortName = "c5l"
Version = "v0.0.2" // TODO embed git sha on build
)
10 changes: 5 additions & 5 deletions pkg/cmd/kms/execute.go → pkg/cmd/citadel/execute.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
package kms
package citadel

import (
"github.com/enj/kms/api/v1beta1"
"github.com/enj/kms/pkg/encryption/prefix"
"github.com/enj/kms/pkg/kek"
"github.com/enj/kms/pkg/kms"
"github.com/enj/citadel/api/v1beta1"
"github.com/enj/citadel/pkg/encryption/prefix"
"github.com/enj/citadel/pkg/kek"
"github.com/enj/citadel/pkg/kms"

"google.golang.org/grpc"
)
Expand Down
8 changes: 4 additions & 4 deletions pkg/cmd/kms/options.go → pkg/cmd/citadel/options.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
package kms
package citadel

import (
"flag"
Expand All @@ -8,8 +8,8 @@ import (
"os"
"time"

"github.com/enj/kms/pkg/encryption"
"github.com/enj/kms/pkg/encryption/aes"
"github.com/enj/citadel/pkg/encryption"
"github.com/enj/citadel/pkg/encryption/aes"
)

const (
Expand Down Expand Up @@ -48,7 +48,7 @@ var (
)

func init() {
flag.StringVar(&args.endpoint, "endpoint", "", `the listen address (ex. unix:///tmp/kms.sock)`)
flag.StringVar(&args.endpoint, "endpoint", "", `the listen address (ex. unix:///tmp/socket)`)
flag.StringVar(&args.command, "command", "", "the command to retrieve the key encryption key")
flag.StringVar(&args.mode, "mode", encryptionModes[0].Name, fmt.Sprintf("encryption mode to use, the options are %s", encryptionModes))
flag.DurationVar(&args.timeout, "timeout", time.Hour, "maximum time to cache KEK locally")
Expand Down
4 changes: 2 additions & 2 deletions pkg/encryption/aes/cbc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ import (
"errors"
"io"

"github.com/enj/kms/pkg/encryption"
"github.com/enj/kms/pkg/kek"
"github.com/enj/citadel/pkg/encryption"
"github.com/enj/citadel/pkg/kek"
)

func NewAESCBCService(kek kek.KeyEncryptionKeyService) (encryption.EncryptionService, error) {
Expand Down
2 changes: 1 addition & 1 deletion pkg/encryption/encryption.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ package encryption
import (
"fmt"

"github.com/enj/kms/pkg/kek"
"github.com/enj/citadel/pkg/kek"
)

type EncryptionService interface {
Expand Down
10 changes: 4 additions & 6 deletions pkg/encryption/prefix/prefix.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,16 +5,14 @@ import (
"errors"
"strings"

"github.com/enj/kms/pkg/encryption"
"github.com/enj/citadel/pkg/api"
"github.com/enj/citadel/pkg/encryption"
)

const (
kmsName = "ck"
sep = ":"
)
const sep = ":"

func NewPrefixEncryption(mode encryption.EncryptionMode, delegate encryption.EncryptionService) encryption.EncryptionService {
modeStr := strings.Join([]string{kmsName, mode.Name, mode.Version}, sep)
modeStr := strings.Join([]string{api.ShortName, mode.Name, mode.Version}, sep)
return &prefixEncryption{
prefix: []byte(sep + modeStr + sep),
delegate: delegate,
Expand Down
21 changes: 9 additions & 12 deletions pkg/kms/kms.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,22 +3,19 @@ package kms
import (
"fmt"

"github.com/enj/kms/api/v1beta1"
"github.com/enj/kms/pkg/encryption"
"github.com/enj/citadel/api/v1beta1"
"github.com/enj/citadel/pkg/api"
"github.com/enj/citadel/pkg/encryption"

"golang.org/x/net/context"
)

const (
version = "v1beta1"
runtimeName = "kms_cmd"
runtimeVersion = "0.0.1" // TODO embed git sha on build
)
const kmsAPIVersion = "v1beta1"

var apiVersionResponse = &v1beta1.VersionResponse{
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume this is what you are renaming later?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as its still kms in this file.

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I actually plan to make a v1beta1 folder and, in the future, a v1 folder (so a single daemon process will support all versions of the KMS API).

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This kms is correct because it refers to the Kube API only.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 for the rename, then.

😄

Version: version,
RuntimeName: runtimeName,
RuntimeVersion: runtimeVersion,
Version: kmsAPIVersion,
RuntimeName: api.Name,
RuntimeVersion: api.Version,
}

func NewKeyManagementService(service encryption.EncryptionService) v1beta1.KeyManagementServiceServer {
Expand Down Expand Up @@ -67,8 +64,8 @@ func (k *kms) Encrypt(ctx context.Context, req *v1beta1.EncryptRequest) (*v1beta
}

func checkVersion(v string) error {
if v != version {
return fmt.Errorf("unsupported version %q, use %q", v, version)
if v != kmsAPIVersion {
return fmt.Errorf("unsupported version %q, use %q", v, kmsAPIVersion)
}
return nil
}