Initial support for OCI key manager #4
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| /* | ||
| * Copyright (c) 2024 Oracle Corporation | ||
| * All rights reserved. | ||
| * SPDX-License-Identifier: BSD-3-Clause | ||
| */ | ||
|
|
||
| package keymanager | ||
|
|
||
| import ( | ||
| "intel/kbs/v1/model" | ||
| "intel/kbs/v1/ociclient" | ||
| "time" | ||
|
|
||
| "github.com/google/uuid" | ||
| "github.com/pkg/errors" | ||
| log "github.com/sirupsen/logrus" | ||
| ) | ||
|
|
||
| type OCIManager struct { | ||
| client ociclient.OCIClient | ||
| } | ||
|
|
||
| func NewOCIManager(c ociclient.OCIClient) *OCIManager { | ||
| return &OCIManager{c} | ||
| } | ||
|
|
||
| func (om *OCIManager) CreateKey(keyRequest *model.KeyRequest) (*model.KeyAttributes, error) { | ||
| if keyRequest.KeyInfo.OciCompartmentId == "" || keyRequest.KeyInfo.OciKeyId == "" || | ||
| keyRequest.KeyInfo.OciSecretName == "" || keyRequest.KeyInfo.OciVaultId == "" { | ||
| return nil, errors.New("Missing oci_compartment_id, oci_key_id, oci_secret_name, or oci_vault_id") | ||
| } | ||
|
|
||
| newUuid, err := uuid.NewRandom() | ||
| if err != nil { | ||
| return nil, errors.Wrap(err, "failed to create new UUID") | ||
| } | ||
| keyAttributes := &model.KeyAttributes{ | ||
| ID: newUuid, | ||
| Algorithm: keyRequest.KeyInfo.Algorithm, | ||
| KeyLength: keyRequest.KeyInfo.KeyLength, | ||
| OciCompartmentId: keyRequest.KeyInfo.OciCompartmentId, | ||
| OciKeyId: keyRequest.KeyInfo.OciKeyId, | ||
| OciSecretName: keyRequest.KeyInfo.OciSecretName, | ||
| OciVaultId: keyRequest.KeyInfo.OciVaultId, | ||
| TransferPolicyId: keyRequest.TransferPolicyID, | ||
| CreatedAt: time.Now().UTC(), | ||
| } | ||
|
|
||
| log.Infof("OCI: Creating key: algorithm = %q; secret name = %q", keyAttributes.Algorithm, keyAttributes.OciSecretName) | ||
|
|
||
| if err := om.client.CreateKey(keyAttributes); err != nil { | ||
| return nil, errors.Wrap(err, "failed to create key") | ||
| } | ||
|
|
||
| return keyAttributes, nil | ||
| } | ||
|
|
||
| func (om *OCIManager) DeleteKey(keyAttributes *model.KeyAttributes) error { | ||
| err := om.client.DeleteKey(keyAttributes.OciSecretId) | ||
| if err != nil { | ||
| log.Errorf("Error while deleting key: %s", err.Error()) | ||
| return err | ||
| } | ||
|
|
||
| log.Infof("OCI: Deleting key: algorithm = %q; secret id = %q", keyAttributes.Algorithm, keyAttributes.OciSecretId) | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func (om *OCIManager) RegisterKey(keyRequest *model.KeyRequest) (*model.KeyAttributes, error) { | ||
| if keyRequest.KeyInfo.OciSecretId == "" { | ||
| return nil, errors.New("oci_secret_id cannot be empty for register operation in OCI mode") | ||
| } | ||
|
|
||
| newUuid, err := uuid.NewRandom() | ||
| if err != nil { | ||
| return nil, errors.Wrap(err, "failed to create new UUID") | ||
| } | ||
| keyAttributes := &model.KeyAttributes{ | ||
| ID: newUuid, | ||
| Algorithm: keyRequest.KeyInfo.Algorithm, | ||
| KeyLength: keyRequest.KeyInfo.KeyLength, | ||
| OciSecretId: keyRequest.KeyInfo.OciSecretId, | ||
| TransferPolicyId: keyRequest.TransferPolicyID, | ||
| CreatedAt: time.Now().UTC(), | ||
| } | ||
|
|
||
| log.Infof("OCI: Registering key: algorithm = %q; secret id = %q", keyAttributes.Algorithm, keyAttributes.OciSecretId) | ||
|
|
||
| return keyAttributes, nil | ||
| } | ||
|
|
||
| func (om *OCIManager) TransferKey(keyAttributes *model.KeyAttributes) ([]byte, error) { | ||
| if keyAttributes.OciSecretId == "" { | ||
| return nil, errors.New("key is not created with OCI key manager") | ||
| } | ||
|
|
||
| secretVersionNumber := int64(0) | ||
|
|
||
| log.Infof("OCI: Transferring key: secret id = %q; secret version = %d", keyAttributes.OciSecretId, secretVersionNumber) | ||
|
|
||
| return om.client.GetKey(keyAttributes.OciSecretId, secretVersionNumber) | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| /* | ||
| * Copyright (c) 2024 Oracle Corporation | ||
| * All rights reserved. | ||
| * SPDX-License-Identifier: BSD-3-Clause | ||
| */ | ||
|
|
||
| package ociclient | ||
|
|
||
| import ( | ||
| "intel/kbs/v1/model" | ||
|
|
||
| "github.com/stretchr/testify/mock" | ||
| ) | ||
|
|
||
| // MockOCIClient is a mock of OCIClient interface | ||
| type MockOCIClient struct { | ||
| mock.Mock | ||
| } | ||
|
|
||
| // NewMockOCIClient creates a new mock instance | ||
| func NewMockOCIClient() *MockOCIClient { | ||
| return &MockOCIClient{} | ||
| } | ||
|
|
||
| // InitializeClient mocks base method | ||
| func (m *MockOCIClient) InitializeClient(serverIP, serverPort, clientToken string) error { | ||
| args := m.Called(serverIP, serverPort, clientToken) | ||
| return args.Error(0) | ||
| } | ||
|
|
||
| // CreateKey mocks base method | ||
| func (m *MockOCIClient) CreateKey(keyAttrib *model.KeyAttributes) error { | ||
| args := m.Called(keyAttrib) | ||
| return args.Error(0) | ||
| } | ||
|
|
||
| // DeleteKey mocks base method | ||
| func (m *MockOCIClient) DeleteKey(id string) error { | ||
| args := m.Called(id) | ||
| return args.Error(0) | ||
| } | ||
|
|
||
| // GetKey mocks base method | ||
| func (m *MockOCIClient) GetKey(id string) ([]byte, error) { | ||
| args := m.Called(id) | ||
| return args.Get(0).([]byte), args.Error(1) | ||
| } |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
use errors.wrap() for consistency.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd suggest to re-consider the usage of
github.com/pkg/errorssince it's archived and not maintained. In general, projects are trying to move away from it and use error wrapping from the std library.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll update it to errors.Wrap() for now. I was just copying the code from vault_key_manager.go:DeleteKey(). If we want to move the std library implementation, I would suggest doing that as a separate patch(set) that updates error usage everywhere.
I'm also not 100% sure what wrapping from the std library you want to do -- I don't see an errors.Wrap() function there. Do you mean using fmt.Errorf() or errors.Join()?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was thinking
%wwitherr