Server: Allow Azure Managed HSM to be used in the azurekeyvault key manager plugin#6751
Server: Allow Azure Managed HSM to be used in the azurekeyvault key manager plugin#6751skeiffer wants to merge 3 commits intospiffe:mainfrom
Conversation
Signed-off-by: Scott Keiffer <[email protected]>
Signed-off-by: Scott Keiffer <[email protected]>
skeiffer
changed the title
| return nil, status.Error(codes.Internal, "key type is missing") | ||
| } | ||
| keyType := string(*keyVaultKey.Kty) | ||
| if strings.HasSuffix(keyType, "-HSM") { |
There was a problem hiding this comment.
Changes look good based on what they document about the key type, but could explicitly check for RSA-HSM and EC-HSM in case they add anything else in there that might be causing us issues in the future?
There was a problem hiding this comment.
Sorry for the delay, I have made this change.
skeiffer
requested review from
MarcosDY,
amartinezfayo,
evan2645 and
rturner3
as code owners
@nikotih, I tested these changes (after fixing the changed constant names) and it appeared to work as expected. I did not however test all the plugins that had their libraries updated. I have not included your changes in this PR to keep things clean. |
3 participants
Pull Request check list
Affected functionality
The azure keyvault key manager plugin does not work with Azure Managed HSM.
Description of change
keyTypeFromKeySpecto allowRSA-HSMandEC-HSMas valid key types.keyVaultKeyToRawKeyto normalize thekty, removing-HSMso data can be parsed by go-jose.keyTypeFromKeySpec&keyVaultKeyToRawKeyWhich issue this PR fixes
#6750