-
Notifications
You must be signed in to change notification settings - Fork 887
feat: enable key rotation #15066
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
feat: enable key rotation #15066
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit updates the cryptographic key handling by separating workspace app token and API key features. It corrects feature identifiers for clearer distinction between OIDC conversion and API key usage, enhancing the maintainability and clarity around cryptographic key usage within the system. Additionally, reworks related tests and migration scripts to align with these changes.
- Consolidates key cache handling by replacing legacy key cache references with central key caches. - Enhances modularity and maintainability by using consistent key management methods. - Removes redundant `StaticKeyManager` implementation for streamlined code. - Adjusts cryptographic key generation and cache utilization across critical components.
Enhances flexibility by making the `Fetcher` interface receive a `CryptoKeyFeature` parameter. This change aligns various call sites that implement or utilize `Fetcher`, allowing for more granular queries.
- Improve code clarity by refactoring key caching logic. - Simplify logger initialization for signing and encryption caches. - Ensure consistent closing of caches in the API and server.
This change enhances the crypto_keys table by updating enum handling for features. It introduces distinct roles for key storage, aiding in better distinction and maintenance of key features.
- Improve clarity by naming loggers used in key cache creation. - Adjust key cache context to utilize KeyReader for consistent context handling. - Refactor API to use central key cache management approach. - Enhance error messages for crypto key fetching. - Update test to add safety against unexpected panics.
- Enhance testing scenarios for cryptokey features including cases with no keys and specific key states. - Update tests to ensure new cryptokey features are handled correctly. - Remove outdated migration scripts for cryptokey features as they are not required anymore. - Refactor workspace proxy keys to only allow whitelisted cryptokey features, improving security and stability.
Enhances the cache functionality by wrapping the context with a key reader, ensuring proper authorization checks during cryptographic operations. This change aligns cache behavior with security practices.
Adjust comments to accurately describe cache functionality and fix a typo in the `New` function parameters for clarity.
spikecurtis
reviewed
Oct 17, 2024
Refactored various tests to eliminate the need for manually setting up a database connection and generating crypto keys. This change simplifies the test setup and makes it less dependent on database-specific configurations, aligning with recent structural refactoring.
Ensure that logging only occurs when an error is present during the initialization of the key caches. This prevents unnecessary log entries when no error is encountered, improving log clarity and reducing noise.
Remove redundant database setup for tests by generating keys in memory. Enhance tests by validating both inclusion and exclusion of specific keys.
spikecurtis
reviewed
Oct 22, 2024
spikecurtis
approved these changes
Oct 23, 2024
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
移動StaticKeyからcryptokeysパッケージへのjwtutils。 これにより、jwtutilsとのセキュリティおよび独立性の一貫性が強化されます。 また、tailnetの依存関係を減らします。
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the remaining logic necessary to hook up key rotation to the product.
closes coder/internal#52