05eef2b95c
This changeset implements the keystore serialization/deserialization: * Adds a JSON serialization extension for the `RootKey` struct, along with a metadata stub. When we serialize RootKey to the on-disk keystore, we want to base64 encode the key material but also exclude any frequently-changing fields which are stored in raft. * Implements methods for loading/saving keys to the keystore. * Implements methods for restoring the whole keystore from disk. * Wires it all up with the `Keyring` RPC handlers and fixes up any fallout on tests.
65 lines
1.6 KiB
Go
65 lines
1.6 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"math/rand"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/hashicorp/nomad/api/internal/testutil"
|
|
)
|
|
|
|
func TestKeyring_CRUD(t *testing.T) {
|
|
testutil.Parallel(t)
|
|
c, s := makeClient(t, nil, nil)
|
|
defer s.Stop()
|
|
|
|
kr := c.Keyring()
|
|
|
|
// Create a key by requesting a rotation
|
|
key, wm, err := kr.Rotate(nil, nil)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, key)
|
|
assertWriteMeta(t, wm)
|
|
|
|
// Read all the keys
|
|
keys, qm, err := kr.List(&QueryOptions{WaitIndex: key.CreateIndex})
|
|
require.NoError(t, err)
|
|
assertQueryMeta(t, qm)
|
|
// TODO: there'll be 2 keys here once we get bootstrapping done
|
|
require.Len(t, keys, 1)
|
|
|
|
// Write a new active key, forcing a rotation
|
|
id := "fd77c376-9785-4c80-8e62-4ec3ab5f8b9a"
|
|
buf := make([]byte, 32)
|
|
rand.Read(buf)
|
|
encodedKey := make([]byte, base64.StdEncoding.EncodedLen(32))
|
|
base64.StdEncoding.Encode(encodedKey, buf)
|
|
|
|
wm, err = kr.Update(&RootKey{
|
|
Key: string(encodedKey),
|
|
Meta: &RootKeyMeta{
|
|
KeyID: id,
|
|
Active: true,
|
|
Algorithm: EncryptionAlgorithmAES256GCM,
|
|
EncryptionsCount: 100,
|
|
}}, nil)
|
|
require.NoError(t, err)
|
|
assertWriteMeta(t, wm)
|
|
|
|
// Delete the old key
|
|
wm, err = kr.Delete(&KeyringDeleteOptions{KeyID: keys[0].KeyID}, nil)
|
|
require.NoError(t, err)
|
|
assertWriteMeta(t, wm)
|
|
|
|
// Read all the keys back
|
|
keys, qm, err = kr.List(&QueryOptions{WaitIndex: key.CreateIndex})
|
|
require.NoError(t, err)
|
|
assertQueryMeta(t, qm)
|
|
// TODO: there'll be 2 keys here once we get bootstrapping done
|
|
require.Len(t, keys, 1)
|
|
require.Equal(t, id, keys[0].KeyID)
|
|
|
|
}
|