Add keyring fallback hierarchy for containerized environments#387
Conversation
…file based keyring provider. This enables containres to store the encryption key more safely as env var or as k8s secret in k8s pods Signed-off-by: Patrick Eschenbach <patrickeschenbach96@gmail.com>
|
@Vad1mo I added this additional implementation to give people the possibility to store they encryption private key somewhere else when using containers. The FilekeyRing provider should only be the non-production fallback option. In production people can store their private key in the container env or in K8s secrets. Where would we document such kind of code? And add some parts about it in the README.md? |
There was a problem hiding this comment.
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
Comments suppressed due to low confidence (2)
test/e2e/encryption_test.go:88
- Consider adding a negative test case to verify the behavior when the expected environment variable is not set, ensuring that proper error handling is in place.
func Test_EncryptionWithEnvironmentKeyring(t *testing.T) {
pkg/utils/encryption.go:117
- [nitpick] The error message in this Delete function currently states that deletion is not supported; consider elaborating on the limitation or referencing documentation to help users understand the intended behavior.
func (e *EnvironmentKeyring) Delete(service, user string) error {
|
@qcserestipy the examples are great, do you think we can get them out of the PR into general docs? e.g. manpages, so that users can find them later too.. |
|
@Vad1mo Yes, I can add them into the docs, before merging. Do you have any preference about the place where to put them? |
|
I don't have any preference, we have the If we could have it somewhere that can be rendered into the website or similar, that would be great.. |
Fixes #386
Problem
Harbor CLI fails to run in container environments due to missing system keyring services.
Solution
This PR implements a hierarchical keyring fallback system that prioritizes:
Implementation details
Usage examples
Docker container with environment key:
Kubernetes usage:
Testing
Added comprehensive tests for keyring providers: Test_EncryptionWithEnvironmentKeyring
Documentation updates:
Where do they go? Into the main README.md?