getsops/sops
1
0
Fork 0
mirror of https://github.com/getsops/sops.git synced 2026-02-05 03:45:44 +01:00
Code Issues Activity

fix(gcpkms): Set quota project to API project

Browse Source 
Like described in the linked issue, if the GCP KMS key is stored in
project foo, but the service account is created in project bar, sops
complains that KMS API is not enabled in project bar.

The quota project used by default is the one encoded in the service
account key. With this commit, the behavior changes, so the project
where the KMS key and API reside, is read from the key ID and set
via the quota project option.

Fixes #1142

Signed-off-by: Johannes Rothe <mail@johannes-rothe.de>
This commit is contained in:
Johannes Rothe
2024-12-06 15:53:31 +01:00
parent 53cc5fd2a2
commit 5184d1a9f9
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
gcpkms/keysource.go
View File

@@ -280,13 +280,14 @@ func (key *MasterKey) TypeToIdentifier() string {
// It returns an error if the ResourceID is invalid, or if the setup of the
// client fails.
func (key *MasterKey) newKMSClient(ctx context.Context) (*kms.KeyManagementClient, error) {
re := regexp.MustCompile(`^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$`)
re := regexp.MustCompile(`^projects/(?P<project>[^/]+)/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$`)
matches := re.FindStringSubmatch(key.ResourceID)
if matches == nil {
return nil, fmt.Errorf("no valid resource ID found in %q", key.ResourceID)
}
var opts []option.ClientOption
opts = append(opts, option.WithQuotaProject(matches[1]))
switch {
case key.tokenSource != nil:
opts = append(opts, option.WithTokenSource(key.tokenSource))