Remove the key_metadata_file and use_msi (azure_key_vault only) settings #5207
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Agustín Martínez Fayó <amartinezfayo@gmail.com>
amartinezfayo
requested review from
evan2645,
azdagron,
MarcosDY and
rturner3
as code owners
azdagron
reviewed
Jun 10, 2024
Comment on lines
30
to
33
| If you need more control over the identifier that's used for the server, the | ||
| `key_identifier_value` setting can be used instead. This allows to specify a | ||
| static identifier for the server instance, and is appropriate in situations | ||
| where a key identifier file can't be persisted. |
There was a problem hiding this comment.
Suggested change
| If you need more control over the identifier that's used for the server, the | |
| `key_identifier_value` setting can be used instead. This allows to specify a | |
| static identifier for the server instance, and is appropriate in situations | |
| where a key identifier file can't be persisted. | |
| If you need more control over the identifier that's used for the server, the | |
| `key_identifier_value` setting can be used to specify a | |
| static identifier for the server instance. This setting is appropriate in situations | |
| where a key identifier file can't be persisted. |
|
|
||
| Aliases managed by the plugin have the following form: `alias/SPIRE_SERVER/{TRUST_DOMAIN}/{SERVER_ID}/{KEY_ID}`. The `{SERVER_ID}` is an auto-generated ID unique to the server and is persisted in the _Key Metadata File_ (see the `key_metadata_file` configurable). This ID allows multiple servers in the same trust domain (e.g. servers in HA deployments) to manage keys with identical `{KEY_ID}`'s without collision. The `{KEY_ID}` in the alias name is encoded to use a [character set accepted by KMS](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html#API_CreateAlias_RequestSyntax). | ||
| The plugin assigns [aliases](https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html) to the Customer Master Keys that manages. The aliases are used to identify and name keys that are managed by the plugin. |
There was a problem hiding this comment.
Suggested change
| The plugin assigns [aliases](https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html) to the Customer Master Keys that manages. The aliases are used to identify and name keys that are managed by the plugin. | |
| The plugin assigns [aliases](https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html) to the Customer Master Keys that it manages. The aliases are used to identify and name keys that are managed by the plugin. |
Comment on lines
68
to
71
| If you need more control over the identifier that's used for the server, the | ||
| `key_identifier_value` setting can be used instead. This allows to specify a | ||
| static identifier for the server instance, and is appropriate in situations | ||
| where a key identifier file can't be persisted. |
| Consequently, if the file is lost, the plugin will not be able to identify keys | ||
| that it has previously managed and will recreate new keys on demand. | ||
|
|
||
| If you need more control over the identifier that's used for the server, the |
Signed-off-by: Agustín Martínez Fayó <amartinezfayo@gmail.com>
azdagron
approved these changes
Jun 10, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
key_metadata_filefrom theaws_kms,azure_key_vaultandgcp_kmsplugins.key_identifier_fileandkey_identifier_valuesettings are used.use_msisetting from theazure_key_vaultplugin. A separate PR removing that setting from theazure_msiplugin will be opened.