Repository navigation
Conversation
Collaborator
|
Hey @Gottox we fixed the build on main. Can you solve the conflicts? |
The overrideSourceImageRegistry and skipVersionfilter options were added without rerunning the docs generator. Bring docs/configuration.md back in sync with options.go before adding new options on top.
… KMS STACKIT KMS offers no RSA signing, so it cannot act as the signer the way Azure Key Vault and AWS KMS do. Instead the file-based private keys are stored as ciphertext of a symmetric KMS key. At startup they are decrypted and served to the imager over its signer sockets, so no plaintext key ever touches the filesystem. In memory the keys live in memguard enclaves: encrypted, locked against swapping and excluded from core dumps. They are opened for the duration of a single signing operation only. Importing memguard disables core dumps for the whole process. The new secureBoot.stackitKMS options select the KMS key. They are wired in through a small hook in buildSecureBootService; everything else lives in new files so the upstream code stays easy to rebase.
The dev config carried the hostname of one developer machine. Compose publishes the factory on localhost:8080, so use that for everyone.
Enable SecureBoot in the dev config with the key files decrypted by STACKIT KMS, and add a small script that exchanges a service account key for a short-lived access token. The token is for the curl calls around the setup, for example creating the key ring and encrypting the key files; the factory itself authenticates through the STACKIT SDK.
Gottox
force-pushed
the
feature/kms-integration
branch
from
October 22, 2026 17:42
d4ea2b4 to
146cc35
Compare
Author
|
rebased! |
kyzrfranz
reviewed
Oct 27, 2026
| IF_ARTIFACTS_INSTALLER_INTERNAL_NAMESPACE=siderolabs | ||
| IF_ARTIFACTS_INSTALLER_INTERNAL_REGISTRY=ghcr.io | ||
| IF_ARTIFACTS_INSTALLER_INTERNAL_REPOSITORY= | ||
| IF_ARTIFACTS_OVERRIDESOURCEIMAGEREGISTRY= |
There was a problem hiding this comment.
could you use some underscores pls to myke it more readable :)
kyzrfranz
reviewed
Oct 27, 2026
| IF_ARTIFACTS_SCHEMATIC_NAMESPACE=siderolabs/image-factory | ||
| IF_ARTIFACTS_SCHEMATIC_REGISTRY=ghcr.io | ||
| IF_ARTIFACTS_SCHEMATIC_REPOSITORY=schematics | ||
| IF_ARTIFACTS_SKIPVERSIONFILTER=false |
Author
There was a problem hiding this comment.
I haven't find a nice way to do that. But I'll look into it!
| return nil, status.Errorf(codes.InvalidArgument, "unsupported hash %s", req.GetHash()) | ||
| } | ||
|
|
||
| key, buf, err := s.key.open() |
There was a problem hiding this comment.
why do you return the buffer when you don't use it?
can you defer & destroy in open() instead?
Author
There was a problem hiding this comment.
Right, that's an tinkering artifact. Thanks for noticing.
| // | ||
| // The path is fixed so that it does not change the profile hash between restarts. | ||
| func serveSigner(ctx context.Context, name string, srv *signerServer) (string, error) { | ||
| path := filepath.Join(os.TempDir(), "image-factory-signer", name+".sock") |
| server := grpc.NewServer() | ||
| signer.RegisterSignerServiceServer(server, srv) | ||
|
|
||
| go server.Serve(lis) //nolint:errcheck |
cynt4k
requested changes
Oct 27, 2026
| signingKeyPath, signingCertPath, pcrKeyPath string, | ||
| kmsOpts ...config.ConfigurationOption, | ||
| ) (*Service, error) { | ||
| ctx, cancel := context.WithTimeout(ctx, time.Minute) |
| func sealKey(der []byte) (*sealedKey, error) { | ||
| key, err := x509.ParsePKCS1PrivateKey(der) | ||
| if err != nil { | ||
| memguard.WipeBytes(der) |
There was a problem hiding this comment.
We must discuss if we want to add this sensitive package from some person from github.
We can try out the go stdlib runtime/secret, but this is unfortunately behind the experimental flag.
Haven't taken a deeper look if it has the same features as with this memguard lib.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
There are a few commits missing in main. These are included here too.