Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for gcp access token #1578

Open
wants to merge 18 commits into
base: main
Choose a base branch
from
Open

Add support for gcp access token #1578

wants to merge 18 commits into from

Conversation

marensofier
Copy link

@marensofier marensofier commented Aug 6, 2024 •
edited by devstein
Loading

We are facing a situation where we want to use short lived access tokens with a minimum of permissions for the kms, and not use static long lived credentials ✨

That is why we really want to add support for the use of gcp access tokens in sops using the environment variable GOOGLE_OAUTH_ACCESS_TOKEN (also used by Pulumi/Terrafrom).

@devstein devstein requested a review from a team August 18, 2024 23:31
devstein
devstein requested changes Aug 18, 2024
View reviewed changes
Copy link
Contributor

@devstein devstein left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@marensofier Thank you for your contribution! This has been a frequently requested feature.

I left a few comments, but can you also please add test coverage?

gcpkms/keysource.go Outdated Show resolved Hide resolved
README.rst Outdated Show resolved Hide resolved
gcpkms/keysource.go Outdated Show resolved Hide resolved
gcpkms/keysource.go Outdated Show resolved Hide resolved
gcpkms/keysource.go Outdated Show resolved Hide resolved
@devstein
Copy link
Contributor

Related to #1358

@devstein devstein mentioned this pull request Aug 18, 2024
Closed
felixfontein
felixfontein reviewed Aug 19, 2024
View reviewed changes
README.rst Outdated Show resolved Hide resolved
gcpkms/keysource.go Outdated Show resolved Hide resolved
README.rst Show resolved Hide resolved
@christoffer-eide
Copy link

Regarding the name of the env var, I would consider naming it GOOGLE_OAUTH_ACCESS_TOKEN.
This is used by Pulumi and Terraform, and has the same GOOGLE_* prefix as the existing GOOGLE_CREDENTIALS env var.

Also, which of the two should take precedence? In Pulumi it's GOOGLE_OAUTH_ACCESS_TOKEN.

marensofier and others added 13 commits September 3, 2024 07:26
@marensofier
feat: add support for the use of gcp access tokens with the environme…
af64307 
…nt variable CLOUDSDK_AUTH_ACCESS_TOKEN

Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@marensofier @devstein
Update README.rst
5c01b44 
Co-authored-by: Devin Stein <devstein@alumni.upenn.edu>
Signed-off-by: Maren Sofie <marensofieringsby@gmail.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@marensofier
added error message when none of the ways of providing credentials fo…
0f7dad5 
…r gcp kms are used. Also renamed variables and added description.

Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@dependabot @marensofier
build(deps): Bump github.com/docker/docker
5cd41b2 
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 27.1.0+incompatible to 27.1.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v27.1.0...v27.1.1)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@dependabot @marensofier
build(deps): Bump the ci group with 3 updates
caf7ac2 
Bumps the ci group with 3 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [github/codeql-action](https://github.com/github/codeql-action) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).

Updates `actions/upload-artifact` from 4.3.5 to 4.3.6
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@89ef406...834a144)

Updates `github/codeql-action` from 3.25.15 to 3.26.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@afb54ba...eb055d7)

Updates `sigstore/cosign-installer` from 3.5.0 to 3.6.0
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@59acb62...4959ce0)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@ErraticMaker @marensofier
Note on the name of the configuration file
f5c24b9 
Making explicit that only files named `.sops.yaml` will be auto-discovered. And alternative names (like `.sops.yml`) need to be used with the `--config` flag.

Signed-off-by: Carlos Zubieta <1976312+ErraticMaker@users.noreply.github.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@ErraticMaker @felixfontein @marensofier
Use ReST admonition syntax for note
b97969a 
Co-authored-by: Felix Fontein <felix@fontein.de>
Signed-off-by: Carlos Zubieta <1976312+ErraticMaker@users.noreply.github.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@dependabot @marensofier
build(deps): Bump the ci group with 2 updates
6b52c79 
Bumps the ci group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [anchore/sbom-action](https://github.com/anchore/sbom-action).

Updates `github/codeql-action` from 3.26.0 to 3.26.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@eb055d7...429e197)

Updates `anchore/sbom-action` from 0.17.0 to 0.17.1
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](anchore/sbom-action@d94f46e...ab9d16d)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@dependabot @marensofier
build(deps): Bump the go group across 1 directory with 15 updates
0bd5399 
Bumps the go group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) | `1.18.4` | `1.19.0` |
| [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go) | `1.13.0` | `1.14.0` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.30.3` | `1.30.4` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.27.27` | `1.27.30` |
| [github.com/aws/aws-sdk-go-v2/feature/s3/manager](https://github.com/aws/aws-sdk-go-v2) | `1.17.10` | `1.17.14` |
| [github.com/aws/aws-sdk-go-v2/service/kms](https://github.com/aws/aws-sdk-go-v2) | `1.35.3` | `1.35.5` |
| [github.com/ory/dockertest/v3](https://github.com/ory/dockertest) | `3.10.0` | `3.11.0` |

Updates `cloud.google.com/go/kms` from 1.18.4 to 1.19.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](googleapis/google-cloud-go@kms/v1.18.4...kms/v1.19.0)

Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.13.0 to 1.14.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/release.md)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.13.0...sdk/azcore/v1.14.0)

Updates `github.com/aws/aws-sdk-go-v2` from 1.30.3 to 1.30.4
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.30.3...v1.30.4)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.27.27 to 1.27.30
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.27.27...config/v1.27.30)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.17.27 to 1.17.29
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@credentials/v1.17.27...credentials/v1.17.29)

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/manager` from 1.17.10 to 1.17.14
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.17.10...credentials/v1.17.14)

Updates `github.com/aws/aws-sdk-go-v2/service/kms` from 1.35.3 to 1.35.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ivs/v1.35.3...service/ecs/v1.35.5)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.58.3 to 1.60.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.58.3...service/s3/v1.60.1)

Updates `github.com/aws/aws-sdk-go-v2/service/sts` from 1.30.3 to 1.30.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.30.3...service/s3/v1.30.5)

Updates `github.com/ory/dockertest/v3` from 3.10.0 to 3.11.0
- [Release notes](https://github.com/ory/dockertest/releases)
- [Commits](ory/dockertest@v3.10.0...v3.11.0)

Updates `golang.org/x/net` from 0.27.0 to 0.28.0
- [Commits](golang/net@v0.27.0...v0.28.0)

Updates `golang.org/x/sys` from 0.23.0 to 0.24.0
- [Commits](golang/sys@v0.23.0...v0.24.0)

Updates `golang.org/x/term` from 0.22.0 to 0.23.0
- [Commits](golang/term@v0.22.0...v0.23.0)

Updates `google.golang.org/api` from 0.190.0 to 0.193.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.190.0...v0.193.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20240730163845-b1a4ccb954bf to 0.0.0-20240814211410-ddb44dafa142
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/kms
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azcore
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/manager
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/kms
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sts
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/ory/dockertest/v3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/term
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@dependabot @marensofier
build(deps): Bump the ci group with 2 updates
bb4bd8c 
Bumps the ci group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [anchore/sbom-action](https://github.com/anchore/sbom-action).

Updates `github/codeql-action` from 3.26.2 to 3.26.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@429e197...2c779ab)

Updates `anchore/sbom-action` from 0.17.1 to 0.17.2
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](anchore/sbom-action@ab9d16d...61119d4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@marensofier
add changes to readme-file
6719977 
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@marensofier
remove unsaved diff from rebase
3f7920a 
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@marensofier
chore: fix error in readme
7e43137 
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
devstein
devstein reviewed Sep 8, 2024
View reviewed changes
Copy link
Contributor

@devstein devstein left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! Thanks for incorporating the feedback. One last minor change

gcpkms/keysource.go
Comment on lines +264 to +267

return []byte(defaultCredentials), nil
}
return nil, nil
return nil, fmt.Errorf("could not find Google credential file")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you update the function doc comment to reflect behavior change? Right now, it incorrectly reads and may return a nil byte slice if no value is set.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also changed the description of the SopsGoogleCredentialsOAuthToken, where i forgot to update after removing the possibility of using a file path!

Thank you for all of your comments, and time! 🌻

@marensofier
chore: update doc string for getting gcp credentials file and oauth2 …
6b407ea 
…access token variable

Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@marensofier
chore: add to doc strings that a nil byte slice will be returned with…
043d87a 
… the error

Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
@felixfontein felixfontein added this to the 3.10.0 milestone Sep 14, 2024
@marensofier
Merge branch 'main' into add_access_token
5413fd2
@marensofier
update go.mod
8ad26e8 
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hiddeco hiddeco Awaiting requested review from hiddeco

@felixfontein felixfontein Awaiting requested review from felixfontein

@devstein devstein Awaiting requested review from devstein

Requested changes must be addressed to merge this pull request.

Assignees

@marensofier marensofier

Labels
None yet
Projects
None yet
Milestone
3.10.0
Development

Successfully merging this pull request may close these issues.
5 participants
@marensofier @devstein @christoffer-eide @felixfontein @ErraticMaker