Documentation
¶
Overview ¶
Package kmstest provides in-repo stand-ins for the key-management services pkg/kms speaks to (Task 20433): a Kubernetes KMS v2 plugin served over a real unix socket with the protocol's own generated server stubs, and a Vault Transit server over HTTP on loopback.
They are fakes of the KMS, not of the protocol: a test drives the real client, over the real transport, against a server that encrypts for real (AES-256-GCM under keys it holds and never shows) and can be made slow, unhealthy, unavailable, rotated or refusing. Neither keeps or logs a plaintext it is given, so a test scanning for leaked key material scans a fake that cannot be the leak.
Index ¶
- Constants
- type Plugin
- func (p *Plugin) Calls(op string) int
- func (p *Plugin) Cleanup()
- func (p *Plugin) CurrentKeyID() string
- func (p *Plugin) Decrypt(ctx context.Context, req *kmsapi.DecryptRequest) (*kmsapi.DecryptResponse, error)
- func (p *Plugin) Encrypt(ctx context.Context, req *kmsapi.EncryptRequest) (*kmsapi.EncryptResponse, error)
- func (p *Plugin) Endpoint() string
- func (p *Plugin) FailWith(op string, code codes.Code)
- func (p *Plugin) Restart() error
- func (p *Plugin) Rotate() string
- func (p *Plugin) SetDelay(d time.Duration)
- func (p *Plugin) SetHealthz(s string)
- func (p *Plugin) Socket() string
- func (p *Plugin) Status(ctx context.Context, _ *kmsapi.StatusRequest) (*kmsapi.StatusResponse, error)
- func (p *Plugin) Stop()
- type Transit
Constants ¶
const AnnotationKey = "version.kmstest.cloop.dev"
AnnotationKey is the annotation the fake plugin returns with every ciphertext, naming the key version, as real plugins do (the Azure plugin's version.azure.akv.io, say). Decrypt requires it back.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Plugin ¶
type Plugin struct {
kmsapi.UnimplementedKeyManagementServiceServer
// contains filtered or unexported fields
}
Plugin is a fake KMS v2 plugin listening on a unix socket.
func NewPlugin ¶
NewPlugin starts a plugin the caller stops with Stop and cleans up after with Cleanup — for a process that runs one beside the hubs it starts.
func StartPlugin ¶
StartPlugin starts a plugin with one key, "key-1", on a socket in a fresh directory only this user can write. It stops when the test ends.
func (*Plugin) Cleanup ¶
func (p *Plugin) Cleanup()
Cleanup removes the plugin's directory. Stop first.
func (*Plugin) CurrentKeyID ¶
CurrentKeyID is the key the plugin encrypts under.
func (*Plugin) Decrypt ¶
func (p *Plugin) Decrypt(ctx context.Context, req *kmsapi.DecryptRequest) (*kmsapi.DecryptResponse, error)
Decrypt implements the protocol.
func (*Plugin) Encrypt ¶
func (p *Plugin) Encrypt(ctx context.Context, req *kmsapi.EncryptRequest) (*kmsapi.EncryptResponse, error)
Encrypt implements the protocol.
func (*Plugin) FailWith ¶
FailWith makes every call of op ("Status", "Encrypt", "Decrypt") fail with code; codes.OK clears it.
func (*Plugin) Rotate ¶
Rotate adds a new key version and makes it current; old versions still decrypt, as a KMS's do. It returns the new key id.
func (*Plugin) SetHealthz ¶
SetHealthz sets what Status reports ("ok" when healthy).
func (*Plugin) Status ¶
func (p *Plugin) Status(ctx context.Context, _ *kmsapi.StatusRequest) (*kmsapi.StatusResponse, error)
Status implements the protocol.
type Transit ¶
type Transit struct {
Server *httptest.Server
Mount string
Key string
// Token is the static token the server accepts.
Token string
// Role and JWT are what a Kubernetes login must present; the token it
// issues expires after LeaseSeconds.
Role string
JWT string
LeaseSeconds int
// contains filtered or unexported fields
}
Transit is a fake Vault Transit server on loopback: one mount, one key with versions, token and Kubernetes-login authentication.
func StartTransit ¶
StartTransit starts the server with key version 1. It stops when the test ends.
func (*Transit) RevokeIssued ¶
func (tr *Transit) RevokeIssued()
RevokeIssued invalidates every token a Kubernetes login issued.
Source Files