You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat: Add Azure Key Vault support and validate_key option
- Add Azure Key Vault as a supported provider for GitHub App private
keys
- Add validate_key option to check key accessibility and suitability at
startup
- Update Helm chart and documentation for Azure and validate_key,
bumping version to 0.3.0
- Bump go-github and ghait dependencies to v84
Copy file name to clipboardExpand all lines: README.md
+50-6Lines changed: 50 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ This operator solves the problem by functioning like cert-manager for GitHub tok
15
15
16
16
## Features
17
17
18
-
-**🔐 Zero-Trust Security**: Never store GitHub App private keys in-cluster - integrates with AWS KMS, Google Cloud KMS, and HashiCorp Vault
18
+
-**🔐 Zero-Trust Security**: Never store GitHub App private keys in-cluster - integrates with AWS KMS, Azure Key Vault, Google Cloud KMS, and HashiCorp Vault
19
19
-**⏰ Ephemeral & Auto-Rotating**: Tokens expire in 1 hour and refresh automatically before expiration
20
20
-**🎯 Fine-Grained Permissions**: Each token can have different scopes, down to specific repositories and permissions
21
21
-**🏢 Multi-Tenancy**: Namespace isolation with `Token` CRD, cluster-wide control with `ClusterToken`
@@ -28,7 +28,7 @@ This operator solves the problem by functioning like cert-manager for GitHub tok
| `provider` | no | `file` | Key provider: `aws`, `azure`, `gcp`, `vault`, or `file` |
104
+
| `key` | yes | | Key identifier (alias, URI, path, or embedded key depending on provider) |
105
+
| `validate_key` | no | `false` | Validate the key on startup, failing fast on misconfiguration |
106
+
107
+
When `validate_key` is enabled, the operator verifies at startup that the configured key is accessible and suitable for signing. This requires additional read permissions on the key (e.g., `kms:DescribeKey` for AWS, `keys/get` for Azure, `cloudkms.cryptoKeyVersions.get` for GCP, `read` on the key path for Vault).
108
+
81
109
**Cloud KMS Permissions Required:**
82
110
83
-
- **AWS KMS**: IAM permissions `kms:DescribeKey` and `kms:Sign` on the KMS key
84
-
- **GCP KMS**: Permission `cloudkms.cryptoKeyVersions.useToSign` or role `roles/cloudkms.cryptoKeyVersionsSigner`
85
-
- **Vault**: Policy with `write` capability on transit sign path (e.g., `transit/sign/<keyName>`)
111
+
- **AWS KMS**: `kms:Sign` on the KMS key (+ `kms:DescribeKey` if `validate_key` is enabled)
112
+
- **Azure Key Vault**: `keys/sign` on the key (+ `keys/get` if `validate_key` is enabled)
113
+
- **GCP KMS**: `cloudkms.cryptoKeyVersions.useToSign` or role `roles/cloudkms.cryptoKeyVersionsSigner` (+ `cloudkms.cryptoKeyVersions.get` if `validate_key` is enabled)
114
+
- **Vault**: `write` capability on transit sign path, e.g. `transit/sign/<keyName>` (+ `read` on `transit/keys/<keyName>` if `validate_key` is enabled)
86
115
87
116
**Pod Authentication:**
88
117
89
118
- **AWS**: IRSA, Pod Identity, or instance profile with above KMS permissions
119
+
- **Azure**: Workload Identity or managed identity with Key Vault access
90
120
- **GCP**: Workload Identity or service account with Cloud KMS access
91
121
- **Vault**: Kubernetes auth method configured with appropriate transit policy
The default build includes all KMS providers (AWS, Azure, GCP, Vault, file). To produce a smaller binary that excludes unwanted providers and their dependencies, use Go build tags:
188
+
189
+
```bash
190
+
# Exclude AWS and Azure providers
191
+
go build -tags ghait.no_aws,ghait.no_azure ./cmd/manager
192
+
193
+
# Build with only file and Vault providers
194
+
go build -tags ghait.no_aws,ghait.no_azure,ghait.no_gcp ./cmd/manager
195
+
```
196
+
197
+
Available opt-out tags: `ghait.no_aws`, `ghait.no_azure`, `ghait.no_gcp`, `ghait.no_vault`, `ghait.no_file`
config.validate_key | Validate the key on startup | `false` |
31
32
rbac.serviceAccount.annotations | Annotations for the service account | `{}` |
32
33
commonAnnotations | Common annotations for all resources | `{}` |
33
34
34
35
The `config.provider` field supported options are:
35
36
-`aws`: The GitHub App private key is stored in AWS KMS (asymmetric, RSA_2048, sign and verify key) and the `config.key` field should be set to the alias of this KMS key.
37
+
-`azure`: The GitHub App private key is stored in Azure Key Vault and the `config.key` field should be set to the key URI (e.g. `https://<vault-name>.vault.azure.net/keys/<key-name>`).
36
38
-`file`: The GitHub App private key is embedded by YAML multiline string in the `config.key` field.
37
39
-`gcp`: The GitHub App private key is stored in GCP KMS.
38
-
-`vault`: The GitHub App private key is stored in HashiCorp Vault.
40
+
-`vault`: The GitHub App private key is stored in HashiCorp Vault Transit Engine.
39
41
40
-
When using external providers like `aws`, `gcp`, or `vault`, the controller's `ServiceAccount` must be configured with the necessary permissions to access the external store.
42
+
When `config.validate_key` is set to `true`, the operator validates that the configured key is accessible and suitable for signing at startup, failing fast on misconfiguration. This may require additional read permissions on the key.
43
+
44
+
When using external providers like `aws`, `azure`, `gcp`, or `vault`, the controller's `ServiceAccount` must be configured with the necessary permissions to access the external store.
41
45
42
46
### Example values.yaml configuration for aws provider
0 commit comments