bitnami/sealed-secrets

Offload crypto to a plugin mechanism to enable HSM and managed cloud crypto support

Open

#779 opened on Mar 22, 2022

View on GitHubContributor guide
 (13 comments) (15 reactions) (0 assignees)Go (771 forks)auto 404
enhancementhelp wanted

Repository metrics

Stars
 (9,222 stars)
PR merge metrics
 (PR metrics pending)

Description

In the README I see this line:

NOTE: we are working on providing key management mechanisms that offload the encryption to HSM based modules or managed cloud crypto solutions such as KMS.

This is clearly not happening right now:

  • the ticket for KMS was closed as 'wontfix'. #64
  • the Hashicorp Vault ticket got closed as Stale: #293

There should be a managed crypto solution eventually, either through direct support, or having a mechanism to offload crypto to an external service.

Crypto could be offloaded to a plugin mechanism so that sealed-secrets doesn't need to directly support KMS and various different HSM solutions, but 3rd party solutions could implement their own crypto offloading. This possibility was mentioned in the vault ticket https://github.com/bitnami-labs/sealed-secrets/pull/293#issuecomment-544848392

Contributor guide

Research direction
Investigate existing plugin mechanisms in Go projects, e.g., using Go plugins or gRPC, to offload cryptographic operations. Review closed issues #64 and #293 for context. Consider how to design an interface for HSM and KMS providers.
Tech stack
go
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
KubernetesGo
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30