mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-02 23:31:08 +08:00
Nic Klaassen
bfbb71734d
* feat: add GCP KMS support for Teleport CA key material This commit implements support for GCP KMS as a backend for CA operations in Teleport. This is able to take advantage of much of the infrastucture that we have already created for HSM support, and simply appears as a new backend for the private key material. The necessary configuration parameters include only the name of the KMS keyring to use, and the protection level (which can be HSM or SOFTWARE). These are configured in the teleport.yaml directly, in a new section under the existing `ca_key_params` used for HSM configuration. The GCP credentials are expected to be provided to the Teleport auth server via the [Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc). This means that it "just works" if the auth server is running on a GCP compute instance with the correct attached role, and you can run tests locally by authenticating with `gcloud auth login`. This does not support Teleport Cloud, as our current HSM support does not, because the Auth server needs the configuration and the access to the GCP account. That would be a larger effort probably requiring a new Teleport service.
95 lines
3.4 KiB
Go
95 lines
3.4 KiB
Go
/*
|
|
Copyright 2021 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
// Package keystore provides a generic client and associated helpers for handling
|
|
// private keys that may be backed by an HSM or KMS.
|
|
//
|
|
// # Notes on testing
|
|
//
|
|
// Fully testing the Keystore package predictably requires an HSM. Testcases are
|
|
// currently written for the software KeyStore (no HSM), SoftHSMv2, YubiHSM2,
|
|
// AWS CloudHSM, and GCP KMS. Only the software tests run without any setup, but
|
|
// testing for SoftHSM is enabled by default in the Teleport docker buildbox and
|
|
// will be run in CI.
|
|
//
|
|
// # Testing this package with SoftHSMv2
|
|
//
|
|
// To test with SoftHSMv2, you must install it (see
|
|
// https://github.com/opendnssec/SoftHSMv2 or
|
|
// https://packages.ubuntu.com/search?keywords=softhsm2) and set the
|
|
// "SOFTHSM2_PATH" environment variable to the location of SoftHSM2's PKCS11
|
|
// library. Depending how you installed it, this is likely to be
|
|
// /usr/lib/softhsm/libsofthsm2.so or /usr/local/lib/softhsm/libsofthsm2.so.
|
|
//
|
|
// The test will create its own config file and token, and clean up after itself.
|
|
//
|
|
// # Testing this package with YubiHSM2
|
|
//
|
|
// To test with YubiHSM2, you must:
|
|
//
|
|
// 1. have a physical YubiHSM plugged in
|
|
//
|
|
// 2. install the SDK (https://developers.yubico.com/YubiHSM2/Releases/)
|
|
//
|
|
// 3. start the connector "yubihsm-connector -d"
|
|
//
|
|
// 4. create a config file
|
|
// connector = http://127.0.0.1:12345
|
|
// debug
|
|
//
|
|
// 5. set "YUBIHSM_PKCS11_CONF" to the location of your config file
|
|
//
|
|
// 6. set "YUBIHSM_PKCS11_PATH" to the location of the PKCS11 library
|
|
//
|
|
// The test will use the factory default pin of "0001password" in slot 0.
|
|
//
|
|
// # Testing this package with AWS CloudHSM
|
|
//
|
|
// 1. Create a CloudHSM Cluster and HSM, and activate them https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started.html
|
|
//
|
|
// 2. Connect an EC2 instance to the cluster https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sg-client-instance.html
|
|
//
|
|
// 3. Install the CloudHSM client on the EC2 instance https://docs.aws.amazon.com/cloudhsm/latest/userguide/install-and-configure-client-linux.html
|
|
//
|
|
// 4. Create a Crypto User (CU) https://docs.aws.amazon.com/cloudhsm/latest/userguide/manage-hsm-users.html
|
|
//
|
|
// 5. Set "CLOUDHSM_PIN" to "<username>:<password>" of your crypto user, eg "TestUser:hunter2"
|
|
//
|
|
// 6. Run the test on the connected EC2 instance
|
|
//
|
|
// # Testing this package with GCP CloudHSM
|
|
//
|
|
// 1. Sign into the Gcloud CLI
|
|
//
|
|
// 2. Create a keyring
|
|
// ```
|
|
// gcloud kms keyrings create "test" --location global
|
|
// ```
|
|
//
|
|
// 3. Set GCP_KMS_KEYRING to the name of the keyring you just created
|
|
// ```
|
|
// gcloud kms keyrings list --location global
|
|
// export GCP_KMS_KEYRING=<name from above>
|
|
// ```
|
|
//
|
|
// 4. Run the unit tests
|
|
//
|
|
// # Testing Teleport with an HSM-backed CA
|
|
//
|
|
// Integration tests can be found in integration/hsm. They run with SoftHSM by
|
|
// default, manually alter the auth config as necessary to test different HSMs.
|
|
package keystore
|