Support for hashi vault structure with prefixed keys, 1 secret per key #439
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds support for new Hashicorp Vault secret structure. Additionally to be able to load secrets from a single
location in Vault, with public keys as keys and secret keys as values, we need to load secrets from multiple
locations in Vault, under single common prefix, with single public/secret key per location.
The reasons for switching to new structure are not directly tied to Stakewise Operator, but we found that single key with dozens
of validators makes other software harder to function. For example, Web3signer can load 200 validators from a single
key, with 200 public keys and 200 secret key values, but it will issue 200 calls to the backend instead of single call. Because there is no partial secret fetching in Hashicorp Vault, this will result to 200x network traffic, which
makes loading several times longer, and could become a serious problem in case when many Web3signer instances are simultaneously restarting.
Old structure:
New structure:
The configuration parameter for new structure is called
--hashi-vault-key-prefix
, which in the case of example above will translate to/k/v/engine/path/
. Operator will list all the keys under it, and will use last segmentof secret path as public key, and the single value inside secret as private key.
Support for old structure, configured via
--hashi-vault-key-path
will remain in place, and v3-operator users utilizing it can still continue utilizing it.