Jeff Mitchell
163ce184b8
This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.
15 lines
439 B
Go
15 lines
439 B
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package globals
|
|
|
|
const (
|
|
KmsPurposeRoot = "root"
|
|
KmsPurposePreviousRoot = "previous-root"
|
|
KmsPurposeWorkerAuth = "worker-auth"
|
|
KmsPurposeWorkerAuthStorage = "worker-auth-storage"
|
|
KmsPurposeRecovery = "recovery"
|
|
KmsPurposeConfig = "config"
|
|
KmsPurposeDownstreamWorkerAuth = "downstream-worker-auth"
|
|
)
|