feat(core): Deprecate server.CryptoProvider for kas.keyring #1834
Conversation
dmihalcik-virtru
changed the title
dmihalcik-virtru
force-pushed
the
feature/cryptwo
branch
3 times, most recently
from
23f9d81 to
6f2bb64
Compare
dmihalcik-virtru
changed the title
dmihalcik-virtru
changed the title
dmihalcik-virtru
force-pushed
the
feature/cryptwo
branch
from
87970e3 to
b6e78ca
Compare
- New service crypto package, recrypto, which provides a shared interface for necessary TDF operations, both for ZTDF (Wrap) and Nano (Derive) - This includes a shift to yet another configuration for the crypto layer. Notably, the keys can now be completely configured in the `services.kas.keyring`, without needing the `server.cryptoprovider` field
dmihalcik-virtru
force-pushed
the
feature/cryptwo
branch
from
b6e78ca to
57a5d9b
Compare
| logger.Debug("updating kas key configuration", slog.String("namespace", ns), slog.Any("legacyConfig", cfg.Server.CryptoConfig2024)) | ||
| // Upgrade the the kas configuration, if there is a legacy `CryptoProvider` configuration | ||
| // present in the otdf server config. | ||
| if cfg.Server.CryptoConfig2024 != nil { |
There was a problem hiding this comment.
cfg.Server.CryptoConfig2024 is this the legacy config renamed. should the new config be named cfg.Server.CryptoConfig2025. I have also seen append _V1
is this versioned in the yaml?
There was a problem hiding this comment.
There is no new config under Server; after this it is moved entirely to the services.kas field.
The type names are not exposed in the YAML config file, and the names of the fields can/will be overridden with tags (e.g. mapstructure:"config2025") as needed. The config struct types and their fields need to be exported (capitalized) for use with the mapstructure` library, but we have as of yet not treated them as part of the API and subject to standard versioning considerations. However, we may want to do that before marking this whole library as 1.x.
I did a grep through our internal code and was unable to find references to the moved/removed/renamed types
Proposed Changes
access.CryptoProviderwithrecrypt.Provider, with simplified interface for implementation of 3rd party crypto layersChecklist
Testing Instructions