enj/citadel

Turn an arbitrary command into a Kubernetes Key Management Service GRPC server

citadel's Issues

support secretbox

It would be cool.

Add logging

So it is easier to understand what KMS is doing.

document things

We should have documentation. README.md is a good place to start.

Build example container with clevis + citadel

Will allow the use of clevis + citadel on OSOS.

integrations tests

Create a small GRPC client that pretends to be Kube.

travisci should run tests

duh.

Consider moving to configuration file

#27 made me realize that we are probably going to be adding more parameters to the command line to handle configuration. It might make more sense to just move to a single required parameter that points to the configuration file. TOML seems like a good choice for the format of the file.

Experiment with vgo with go1.11

We do not need any fancy versioning logic for citadel and it would make it easy for us to remove the vendor directory.

need to store crypto mode in return value

Currently, we return the ciphertext from AES-CBC. However, if we add other encryption modes in the future we will not be able to distinguish ciphertexts. We should store the mode with the ciphertext so that we can automatically distinguish which decryption mode to use.

Add HSM support via PKCS 11

Use https://github.com/miekg/pkcs11 and possibly the extended wrapper https://github.com/ThalesIgnite/crypto11 to add HSM support.

Would require having a very different mode:

1. The current command based KEK mode where we do the crypto
2. An HSM mode where we send the DEK/EDEK to the HSM for all crypto operations

Add build instructions to README.md

Add contributing to README.md

Some basic setup, how to get it running (in whatever state it currently is in) against a kubernetes cluster (ex, oc cluster up?).

use memguard for key protection

https://github.com/awnumar/memguard

Improve help menu

• Include a nice description
• Use -- when printing arguments

unit tests

We want unit tests.

e2e tests

Tests that actually run this with OpenShift

Change project name to lazaret

And update all the paths and such.

Add a small custom error package

So we can actually tell where errors originate.

Would complement #15

GPRC Version() should return hash of git commit

Automate vendor bump to track latest stable Fedora

Manually bumping git SHAs is painful.

package for fedora

This is so that clevis-kms can depend on it. Also, we need a release to package for Fedora.

Create a logo

Should reference citadel in some way:

https://en.wikipedia.org/wiki/Armored_citadel