Repository navigation
Kms describe public key - #150
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The regenerated kms_grpc.pb.go header reports a non-existent protoc v7.34.1, which is misleading and suggests the codegen toolchain/version metadata needs correction for reproducibility.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: None
What changed in this PR
Adds new KMS RPCs to separate full key metadata retrieval from public-key-only retrieval, while updating the Transit/OpenBao integration to correctly persist and return asymmetric public keys from versioned key responses.
Changes:
- Introduces
GetKeyMetadataandGetPublicKeyacross the public service proto, internal plugin proto, gateway routing/validation, and plugin implementation. - Fixes Transit asymmetric public-key extraction by reading OpenBao’s versioned
keysresponse shape. - Adds/updates Go and Rust tests plus documentation for the new APIs and JSON-RPC PascalCase behavior.
| File | Description |
|---|---|
| proto/services/kms.proto | Adds public RPCs/messages for key metadata and public-key retrieval. |
| proto/plugins/kms.proto | Adds internal plugin RPCs/messages carrying client_id for tenant scoping. |
| plugins/proto/plugins/kms.pb.go | Regenerated Go protobuf types for the plugin contract. |
| plugins/proto/plugins/kms_grpc.pb.go | Regenerated Go gRPC stubs for the plugin contract (new methods). |
| plugins/pkg/plugin/kms/transit_provider.go | Uses version-aware Transit public-key extraction when persisting metadata. |
| plugins/pkg/plugin/kms/README.md | Documents GetKeyMetadata/GetPublicKey semantics and tenant scoping. |
| plugins/pkg/plugin/kms/plugin.go | Implements GetKeyMetadata and GetPublicKey in the KMS plugin. |
| plugins/pkg/plugin/kms/plugin_test.go | Adds test coverage for new RPCs and updated Transit key response shape. |
| plugins/pkg/plugin/kms/openbao.go | Implements versioned Transit public-key extraction (keys map parsing). |
| gateway/src/services/kms.rs | Adds gateway RPC wiring, plugin calls, and validation for new methods. |
| gateway/src/services/jrpc.rs | Adds JSON-RPC routing + (de)serialization tests for new methods. |
| gateway/build.rs | Registers new KMS types for PascalCase JSON serialization. |
Files not reviewed (2)
- plugins/proto/plugins/kms.pb.go: Generated file
- plugins/proto/plugins/kms_grpc.pb.go: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
amirylm
approved these changes
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
PR renames the KMS metadata lookup API from kms.DescribeKey to kms.GetKeyMetadata and adds a narrower kms.GetPublicKey API for callers that only need verification material.
kms.GetKeyMetadata preserves the existing authenticated, tenant-scoped metadata lookup behavior and accepts either canonical key id (kms:) or raw alias.
kms.GetPublicKey uses the same lookup path, but returns only the public key for asymmetric signing/key-agreement keys.
Symmetric keys are rejected because they do not have public key material.
This also keeps the Transit asymmetric public-key extraction fix, which reads OpenBao’s versioned keys response shape so ECDSA public keys are correctly persisted and returned.
Validated in k8s dev using image tags:
v0.2.21-rc-1
v0.2.21-rc-2
Changes
Checklist
Fixes #XX)