Skip to content

feat: enable key rotation #15066

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 42 commits into from
Oct 25, 2024
Merged

feat: enable key rotation #15066

merged 42 commits into from
Oct 25, 2024

Conversation

sreya
Copy link
Collaborator

@sreya sreya commented Oct 14, 2024

This PR contains the remaining logic necessary to hook up key rotation to the product.

closes coder/internal#52

sreya added 13 commits October 16, 2024 21:06
This commit updates the cryptographic key handling by separating
workspace app token and API key features. It corrects feature identifiers
for clearer distinction between OIDC conversion and API key usage, enhancing
the maintainability and clarity around cryptographic key usage within the
system. Additionally, reworks related tests and migration scripts to align
with these changes.
- Consolidates key cache handling by replacing legacy key cache references with central key caches.
- Enhances modularity and maintainability by using consistent key management methods.
- Removes redundant `StaticKeyManager` implementation for streamlined code.
- Adjusts cryptographic key generation and cache utilization across critical components.
Enhances flexibility by making the `Fetcher` interface
receive a `CryptoKeyFeature` parameter. This change aligns
various call sites that implement or utilize `Fetcher`, allowing
for more granular queries.
- Improve code clarity by refactoring key caching logic.
- Simplify logger initialization for signing and encryption caches.
- Ensure consistent closing of caches in the API and server.
This change enhances the crypto_keys table by updating enum
handling for features. It introduces distinct roles for key
storage, aiding in better distinction and maintenance of key
features.
- Improve clarity by naming loggers used in key cache creation.
- Adjust key cache context to utilize KeyReader for consistent
  context handling.
- Refactor API to use central key cache management approach.
- Enhance error messages for crypto key fetching.
- Update test to add safety against unexpected panics.
sreya added 9 commits October 17, 2024 00:21
- Enhance testing scenarios for cryptokey features including cases
  with no keys and specific key states.
- Update tests to ensure new cryptokey features are handled correctly.
- Remove outdated migration scripts for cryptokey features as they
  are not required anymore.
- Refactor workspace proxy keys to only allow whitelisted
  cryptokey features, improving security and stability.
Enhances the cache functionality by wrapping the context with a key
reader, ensuring proper authorization checks during cryptographic
operations. This change aligns cache behavior with security practices.
Adjust comments to accurately describe cache functionality
and fix a typo in the `New` function parameters for clarity.
@sreya sreya marked this pull request as ready for review October 17, 2024 02:49
@sreya sreya requested a review from spikecurtis October 17, 2024 02:50
sreya added 12 commits October 20, 2024 18:51
Refactored various tests to eliminate the need for manually setting up
a database connection and generating crypto keys. This change simplifies
the test setup and makes it less dependent on database-specific
configurations, aligning with recent structural refactoring.
Ensure that logging only occurs when an error is present during the initialization of the key caches. This prevents unnecessary log entries when no error is encountered, improving log clarity and reducing noise.
Remove redundant database setup for tests by generating keys in memory.
Enhance tests by validating both inclusion and exclusion of specific keys.
@sreya sreya requested a review from spikecurtis October 22, 2024 00:52
@sreya sreya requested a review from spikecurtis October 22, 2024 17:37
Copy link
Contributor

@spikecurtis spikecurtis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

sreya added 4 commits October 24, 2024 16:58
移動StaticKeyからcryptokeysパッケージへのjwtutils。
これにより、jwtutilsとのセキュリティおよび独立性の一貫性が強化されます。
また、tailnetの依存関係を減らします。
@sreya sreya merged commit cd890aa into main Oct 25, 2024
28 of 30 checks passed
@sreya sreya deleted the jon/glue branch October 25, 2024 16:14
@github-actions github-actions bot locked and limited conversation to collaborators Oct 25, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

feat: automatic key rotation
2 participants