getsops/sops
1
0
Fork 0
mirror of https://github.com/getsops/sops.git synced 2026-02-05 12:45:21 +01:00
Code Issues Activity

AZKV: Also allow to omit version for AZKV keys specified in key groups.

Browse Source 
Signed-off-by: Felix Fontein <felix@fontein.de>
This commit is contained in:
Felix Fontein
2025-09-12 22:30:05 +02:00
parent e7837416c7
commit 61cc3f79ea
3 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
azkv/keysource.go
View File

@@ -64,9 +64,9 @@ type MasterKey struct {
clientOptions *azkeys.ClientOptions
}
// NewMasterKey creates a new MasterKey from a URL, key name and version,
// newMasterKey creates a new MasterKey from a URL, key name and version,
// setting the creation date to the current date.
func NewMasterKey(vaultURL string, keyName string, keyVersion string) *MasterKey {
func newMasterKey(vaultURL string, keyName string, keyVersion string) *MasterKey {
return &MasterKey{
VaultURL: vaultURL,
Name: keyName,
@@ -75,6 +75,14 @@ func NewMasterKey(vaultURL string, keyName string, keyVersion string) *MasterKey
}
}
// NewMasterKey creates a new MasterKey from a URL, key name and (optional) version,
// setting the creation date to the current date.
func NewMasterKey(vaultURL string, keyName string, keyVersion string) (*MasterKey, error) {
key := newMasterKey(vaultURL, keyName, keyVersion)
err := key.ensureKeyHasVersion(context.Background())
return key, err
}
// NewMasterKeyFromURL takes an Azure Key Vault key URL, and returns a new
// MasterKey. The URL format is {vaultUrl}/keys/{keyName}/{keyVersion}.
func NewMasterKeyFromURL(url string) (*MasterKey, error) {
@@ -88,9 +96,9 @@ func NewMasterKeyFromURL(url string) (*MasterKey, error) {
// version of the key. We need to put the actual version in the sops metadata block though
var key *MasterKey
if len(parts[3]) > 1 {
key = NewMasterKey(parts[1], parts[2], parts[3][1:])
key = newMasterKey(parts[1], parts[2], parts[3][1:])
} else {
key = NewMasterKey(parts[1], parts[2], "")
key = newMasterKey(parts[1], parts[2], "")
}
err := key.ensureKeyHasVersion(context.Background())
return key, err

4
azkv/keysource_test.go
View File

@@ -181,7 +181,7 @@ func TestMasterKey_EncryptIfNeeded(t *testing.T) {
}
func TestMasterKey_NeedsRotation(t *testing.T) {
key := NewMasterKey("", "", "")
key := newMasterKey("", "", "")
assert.False(t, key.NeedsRotation())
key.CreationDate = key.CreationDate.Add(-(azkvTTL + time.Second))
@@ -189,7 +189,7 @@ func TestMasterKey_NeedsRotation(t *testing.T) {
}
func TestMasterKey_ToString(t *testing.T) {
key := NewMasterKey("https://test.vault.azure.net", "key-name", "key-version")
key := newMasterKey("https://test.vault.azure.net", "key-name", "key-version")
assert.Equal(t, "https://test.vault.azure.net/keys/key-name/key-version", key.ToString())
}

6
config/config.go
View File

@@ -330,7 +330,11 @@ func extractMasterKeys(group keyGroup) (sops.KeyGroup, error) {
keyGroup = append(keyGroup, gcpkms.NewMasterKeyFromResourceID(k.ResourceID))
}
for _, k := range group.AzureKV {
keyGroup = append(keyGroup, azkv.NewMasterKey(k.VaultURL, k.Key, k.Version))
if key, err := azkv.NewMasterKey(k.VaultURL, k.Key, k.Version); err == nil {
keyGroup = append(keyGroup, key)
} else {
return nil, err
}
}
for _, k := range group.Vault {
if masterKey, err := hcvault.NewMasterKeyFromURI(k); err == nil {