Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Add support for gcp access token#1578

Open
marensofier wants to merge21 commits intogetsops:main
base:main
Choose a base branch
Loading
frommarensofier:add_access_token
Open
Show file tree
Hide file tree
Changes fromall commits
Commits
Show all changes
21 commits
Select commitHold shift + click to select a range
af64307
feat: add support for the use of gcp access tokens with the environme…
marensofierAug 6, 2024
5c01b44
Update README.rst
marensofierAug 26, 2024
0f7dad5
added error message when none of the ways of providing credentials fo…
marensofierAug 26, 2024
5cd41b2
build(deps): Bump github.com/docker/docker
dependabot[bot]Aug 9, 2024
caf7ac2
build(deps): Bump the ci group with 3 updates
dependabot[bot]Aug 12, 2024
f5c24b9
Note on the name of the configuration file
ErraticMakerJul 30, 2024
b97969a
Use ReST admonition syntax for note
ErraticMakerJul 30, 2024
6b52c79
build(deps): Bump the ci group with 2 updates
dependabot[bot]Aug 19, 2024
0bd5399
build(deps): Bump the go group across 1 directory with 15 updates
dependabot[bot]Aug 26, 2024
bb4bd8c
build(deps): Bump the ci group with 2 updates
dependabot[bot]Aug 26, 2024
6719977
add changes to readme-file
marensofierAug 26, 2024
3f7920a
remove unsaved diff from rebase
marensofierAug 26, 2024
7e43137
chore: fix error in readme
marensofierAug 30, 2024
8e336b4
chore: update changes in main
marensofierSep 4, 2024
6b407ea
chore: update doc string for getting gcp credentials file and oauth2 …
marensofierSep 9, 2024
043d87a
chore: add to doc strings that a nil byte slice will be returned with…
marensofierSep 9, 2024
5413fd2
Merge branch 'main' into add_access_token
marensofierSep 19, 2024
8ad26e8
update go.mod
marensofierSep 19, 2024
6f55e70
merge conflict
Mar 4, 2025
180d647
update go.mod
marensofierMar 4, 2025
c288864
remove unnecessary files and change go.mod
marensofierMar 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletionsREADME.rst
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -265,8 +265,12 @@ It is also possible to use ``updatekeys``, when adding or removing age recipient

Encrypting using GCP KMS
~~~~~~~~~~~~~~~~~~~~~~~~
GCP KMS uses `Application Default Credentials
<https://developers.google.com/identity/protocols/application-default-credentials>`_.
GCP KMS has support for authorization with the use of `Application Default Credentials
<https://developers.google.com/identity/protocols/application-default-credentials>`_ and using an oauth2 token.
Application default credentials precedes the use of access token.

Using Application Default Credentials you can authorize by doing this:

If you already logged in using

.. code:: sh
Expand All@@ -279,6 +283,19 @@ you can enable application default credentials using the sdk:

$ gcloud auth application-default login

Using oauth tokens you can authorize by doing this:

.. code:: sh

$ export GOOGLE_OAUTH_ACCESS_TOKEN=<your access token>

Or if you are logged in you can authorize by generating an access token:

.. code:: sh

$ export GOOGLE_OAUTH_ACCESS_TOKEN="$(gcloud auth print-access-token)"


Encrypting/decrypting with GCP KMS requires a KMS ResourceID. You can use the
cloud console the get the ResourceID or you can create one using the gcloud
sdk:
Expand All@@ -301,6 +318,7 @@ And decrypt it using::

$ sops decrypt test.enc.yaml


Encrypting using Azure Key Vault
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Expand Down
53 changes: 41 additions & 12 deletionsgcpkms/keysource.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,7 @@ import (
kms "cloud.google.com/go/kms/apiv1"
"cloud.google.com/go/kms/apiv1/kmspb"
"github.com/sirupsen/logrus"
"golang.org/x/oauth2"
"google.golang.org/api/option"
"google.golang.org/grpc"

Expand All@@ -23,6 +24,9 @@ const (
// a path to a credentials file, or directly as the variable's value in JSON
// format.
SopsGoogleCredentialsEnv = "GOOGLE_CREDENTIALS"
// SopsGoogleCredentialsOAuthToken is the environment variable used for the
// GCP Oauth2 Token.
SopsGoogleCredentialsOAuthToken = "GOOGLE_OAUTH_ACCESS_TOKEN"
Comment on lines +27 to +29
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
//SopsGoogleCredentialsOAuthToken is the environment variable used for the
// GCP Oauth2 Token.
SopsGoogleCredentialsOAuthToken="GOOGLE_OAUTH_ACCESS_TOKEN"
//SopsGoogleCredentialsOAuthTokenEnv is the environment variable used for the
// GCP Oauth2 Token.
SopsGoogleCredentialsOAuthTokenEnv="GOOGLE_OAUTH_ACCESS_TOKEN"

// KeyTypeIdentifier is the string used to identify a GCP KMS MasterKey.
KeyTypeIdentifier = "gcp_kms"
)
Expand DownExpand Up@@ -203,8 +207,8 @@ func (key *MasterKey) TypeToIdentifier() string {
return KeyTypeIdentifier
}

// newKMSClient returns a GCP KMS client configured with the credentialJSON
// and/or grpcConn, falling back to environmental defaults.
// newKMSClient returns a GCP KMS client configured with the credentialJSON,
//tokenSourceand/or grpcConn, falling back to environmental defaults.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I don't think the GCP authentication method introduced in this PR is quite what you would call "token source". A token source method would be similar to the equivalents of AWS and Azure:

// credentialsProvider is used to configure the AWS client config with
// credentials. It can be injected by a (local) keyservice.KeyServiceServer
// using CredentialsProvider.ApplyToMasterKey. If nil, the default client is used
// which utilizes runtime environmental values.
credentialsProvider aws.CredentialsProvider

// tokenCredential contains the azcore.TokenCredential used by the Azure
// client. It can be injected by a (local) keyservice.KeyServiceServer
// using TokenCredential.ApplyToMasterKey.
// If nil, azidentity.NewDefaultAzureCredential is used.
tokenCredential azcore.TokenCredential

// It returns an error if the ResourceID is invalid, or if the setup of the
// client fails.
func (key *MasterKey) newKMSClient() (*kms.KeyManagementClient, error) {
Expand All@@ -219,37 +223,62 @@ func (key *MasterKey) newKMSClient() (*kms.KeyManagementClient, error) {
case key.credentialJSON != nil:
opts = append(opts, option.WithCredentialsJSON(key.credentialJSON))
default:
credentials, err := getGoogleCredentials()
if err != nil {
return nil, err
}
credentials, err_credentials_file := getGoogleCredentials()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
credentials,err_credentials_file:=getGoogleCredentials()
credentials,errCredentialsFile:=getGoogleCredentials()

The Go idiom for variable names is camel case

if credentials != nil {
opts = append(opts, option.WithCredentialsJSON(credentials))
break
}

at_credentials, err_credentials_token := getGoogleOAuthToken()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
at_credentials,err_credentials_token:=getGoogleOAuthToken()
atCredentials,errCredentialsToken:=getGoogleOAuthToken()

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
at_credentials,err_credentials_token:=getGoogleOAuthToken()
at_credentials,err_credentials_token:=getGoogleOAuthTokenFromEnv()

if at_credentials != nil {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
ifat_credentials!=nil {
ifatCredentials!=nil {

opts = append(opts, option.WithTokenSource(at_credentials))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
opts=append(opts,option.WithTokenSource(at_credentials))
opts=append(opts,option.WithTokenSource(atCredentials))

}

if err_credentials_file != nil && err_credentials_token != nil {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
iferr_credentials_file!=nil&&err_credentials_token!=nil {
iferrCredentialsFile!=nil&&errCredentialsToken!=nil {

return nil, fmt.Errorf("credentials: failed to get credentials for gcp kms, add default credentials or oauth access token")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
returnnil,fmt.Errorf("credentials: failed to get credentials for gcp kms, add default credentials or oauth access token")
returnnil,fmt.Errorf("credentials: failed to get credentials for gcp kms, add default credentials or oauth access token from env")

}
}

if key.grpcConn != nil {
opts = append(opts, option.WithGRPCConn(key.grpcConn))
}

ctx := context.Background()
client,err := kms.NewKeyManagementClient(ctx, opts...)
iferr != nil {
return nil,err
client,err_credentials := kms.NewKeyManagementClient(ctx, opts...)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
client,err_credentials:=kms.NewKeyManagementClient(ctx,opts...)
client,errCredentials:=kms.NewKeyManagementClient(ctx,opts...)

iferr_credentials != nil {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
iferr_credentials!=nil {
iferrCredentials!=nil {

return nil,err_credentials
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
returnnil,err_credentials
returnnil,errCredentials

}

return client, nil
}

// getGoogleCredentials returns the SopsGoogleCredentialsEnv variable, as
// either the file contents of the path of a credentials file, or as value in
// JSON format. It returns an error if the file cannot be read, and may return
// a nil byte slice if no value is set.
// JSON format.
// It returns an error and a nil byte slice if the environment variable is not set,
// or the file cannot be read.
func getGoogleCredentials() ([]byte, error) {
if defaultCredentials, ok := os.LookupEnv(SopsGoogleCredentialsEnv); ok && len(defaultCredentials) > 0 {
if _, err := os.Stat(defaultCredentials); err == nil {
return os.ReadFile(defaultCredentials)
}

return []byte(defaultCredentials), nil
}
return nil, nil
return nil, fmt.Errorf("could not find Google credential file")
Comment on lines +265 to +268
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Can you update the function doc comment to reflect behavior change? Right now, it incorrectly readsand may return a nil byte slice if no value is set.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I also changed the description of the SopsGoogleCredentialsOAuthToken, where i forgot to update after removing the possibility of using a file path!

Thank you for all of your comments, and time! 🌻

}

// getGoogleOAuthToken returns the SopsGoogleCredentialsOauthToken variable,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
// getGoogleOAuthToken returns theSopsGoogleCredentialsOauthToken variable,
// getGoogleOAuthToken returns theSopsGoogleCredentialsOauthTokenEnv variable,

// as the oauth token.
// It returns an error and a nil byte slice if the envrionment variable is not set.
func getGoogleOAuthToken() (oauth2.TokenSource, error) {
Comment on lines +271 to +274
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
//getGoogleOAuthToken returns the SopsGoogleCredentialsOauthToken variable,
// as the oauth token.
// It returns an error and a nil byte slice if the envrionment variable is not set.
funcgetGoogleOAuthToken() (oauth2.TokenSource,error) {
//getGoogleOAuthTokenFromEnv returns the SopsGoogleCredentialsOauthToken variable,
// as the oauth token.
// It returns an error and a nil byte slice if the envrionment variable is not set.
funcgetGoogleOAuthTokenFromEnv() (oauth2.TokenSource,error) {

if token, isSet := os.LookupEnv(SopsGoogleCredentialsOAuthToken); isSet {
tokenSource := oauth2.StaticTokenSource(
&oauth2.Token{AccessToken: token},
)

return tokenSource, nil
}

return nil, fmt.Errorf("could not find Google OAuth token")
}
43 changes: 37 additions & 6 deletionsgcpkms/keysource_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -53,8 +53,9 @@ func TestMasterKey_Encrypt(t *testing.T) {
})

key := MasterKey{
grpcConn: newGRPCServer("0"),
ResourceID: testResourceID,
grpcConn: newGRPCServer("0"),
ResourceID: testResourceID,
credentialJSON: []byte("arbitrary credentials"),
}
err := key.Encrypt([]byte("encrypt"))
assert.NoError(t, err)
Expand All@@ -80,9 +81,10 @@ func TestMasterKey_Decrypt(t *testing.T) {
Plaintext: []byte(decryptedData),
})
key := MasterKey{
grpcConn: newGRPCServer("0"),
ResourceID: testResourceID,
EncryptedKey: "encryptedKey",
grpcConn: newGRPCServer("0"),
ResourceID: testResourceID,
EncryptedKey: "encryptedKey",
credentialJSON: []byte("arbitrary credentials"),
}
data, err := key.Decrypt()
assert.NoError(t, err)
Expand DownExpand Up@@ -116,7 +118,7 @@ func TestMasterKey_ToMap(t *testing.T) {
}, key.ToMap())
}

funcTestMasterKey_createCloudKMSService(t *testing.T) {
funcTestMasterKey_createCloudKMSService_withCredentialsFile(t *testing.T) {
tests := []struct {
key MasterKey
errString string
Expand All@@ -136,6 +138,12 @@ func TestMasterKey_createCloudKMSService(t *testing.T) {
"type": "authorized_user"}`),
},
},
{
key: MasterKey{
ResourceID: testResourceID,
},
errString: "credentials: failed to get credentials",
},
}

for _, tt := range tests {
Expand All@@ -149,6 +157,29 @@ func TestMasterKey_createCloudKMSService(t *testing.T) {
}
}

func TestMasterKey_createCloudKMSService_withOauthToken(t *testing.T) {
t.Setenv(SopsGoogleCredentialsOAuthToken, "token")

masterKey := MasterKey{
ResourceID: testResourceID,
}

_, err := masterKey.newKMSClient()

assert.NoError(t, err)
}

func TestMasterKey_createCloudKMSService_withoutCredentials(t *testing.T) {
masterKey := MasterKey{
ResourceID: testResourceID,
}

_, err := masterKey.newKMSClient()

assert.Error(t, err)
assert.ErrorContains(t, err, "credentials: failed to get credentials")
}

func newGRPCServer(port string) *grpc.ClientConn {
serv := grpc.NewServer()
kmspb.RegisterKeyManagementServiceServer(serv, &mockKeyManagement)
Expand Down
3 changes: 2 additions & 1 deletiongo.mod
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
module github.com/getsops/sops/v3

go 1.22

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Can you undo this change? Thanks.

toolchain go1.23.6

require (
Expand DownExpand Up@@ -36,6 +37,7 @@ require (
github.com/urfave/cli v1.22.16
golang.org/x/crypto v0.35.0
golang.org/x/net v0.35.0
golang.org/x/oauth2 v0.26.0
golang.org/x/sys v0.30.0
golang.org/x/term v0.29.0
google.golang.org/api v0.223.0
Expand DownExpand Up@@ -139,7 +141,6 @@ require (
go.opentelemetry.io/otel/sdk v1.34.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.33.0 // indirect
go.opentelemetry.io/otel/trace v1.34.0 // indirect
golang.org/x/oauth2 v0.26.0 // indirect
golang.org/x/sync v0.11.0 // indirect
golang.org/x/text v0.22.0 // indirect
golang.org/x/time v0.10.0 // indirect
Expand Down
[8]ページ先頭
©2009-2025 Movatter.jp