Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

keyring: safely handle missing keys and restore GC #15092

Merged
merged 11 commits into from
Nov 1, 2022
Merged

keyring: safely handle missing keys and restore GC #15092

merged 11 commits into from
Nov 1, 2022

Commits on Oct 31, 2022

  1. Revert "keyring: remove root key GC (#15034)" 

    This reverts commit b583f78.
But keeps the changelog entry from #15034.
    @tgross
    tgross committed Oct 31, 2022
    Configuration menu
    Copy the full SHA
    e880bce View commit details
    Browse the repository at this point in the history

  2. store key ID used for workload identity signing with alloc

    @tgross
    tgross committed Oct 31, 2022
    Configuration menu
    Copy the full SHA
    6c3a830 View commit details
    Browse the repository at this point in the history

  3. keyring GC: check if a key has been used to sign a workload identity

    @tgross
    tgross committed Oct 31, 2022
    Configuration menu
    Copy the full SHA
    ae083a2 View commit details
    Browse the repository at this point in the history

  4. keyring: fix early return on replication errors 

    When replication of a single key fails, the replication loop broke early and
therefore keys that fell later in the sorting order would never get
replicated. Log the error and continue.

Refactor the replication loop so that each key replicated in a function call
that returns an error, to make the workflow more clear and reduce nesting.
    @tgross
    tgross committed Oct 31, 2022
    Configuration menu
    Copy the full SHA
    7fb2d1d View commit details
    Browse the repository at this point in the history

  5. improve stability of keyring replication tests 

    We no longer block leadership on initializing the keyring, so there's a race
condition in the keyring tests where we can test for the existence of the root
key before the keyring has been initialize. Change this to an "eventually" test.
    @tgross
    tgross committed Oct 31, 2022
    Configuration menu
    Copy the full SHA
    15fd16a View commit details
    Browse the repository at this point in the history

  6. changelog entries

    @tgross
    tgross committed Oct 31, 2022
    Configuration menu
    Copy the full SHA
    782d03e View commit details
    Browse the repository at this point in the history

Commits on Nov 1, 2022

  1. code review: use compound index over liveness

    @tgross
    tgross committed Nov 1, 2022
    Configuration menu
    Copy the full SHA
    571118f View commit details
    Browse the repository at this point in the history

  2. code review: clean up logs and docstrings

    @tgross
    tgross committed Nov 1, 2022
    Configuration menu
    Copy the full SHA
    2b571f0 View commit details
    Browse the repository at this point in the history

  3. code review: remove dead code

    @tgross
    tgross committed Nov 1, 2022
    Configuration menu
    Copy the full SHA
    6962168 View commit details
    Browse the repository at this point in the history

  4. code review: drop deprecated state

    @tgross
    tgross committed Nov 1, 2022
    Configuration menu
    Copy the full SHA
    bd3c556 View commit details
    Browse the repository at this point in the history

  5. Update nomad/encrypter.go 

    Co-authored-by: Charlie Voiselle <464492+angrycub@users.noreply.github.com>
    @tgross @angrycub
    tgross and angrycub committed Nov 1, 2022
    Configuration menu
    Copy the full SHA
    3d98ea1 View commit details
    Browse the repository at this point in the history