Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for hashi vault structure with prefixed keys, 1 secret per key #439

Merged

Conversation

mksh
Copy link
Contributor

@mksh mksh commented Dec 12, 2024

This PR adds support for new Hashicorp Vault secret structure. Additionally to be able to load secrets from a single
location in Vault, with public keys as keys and secret keys as values, we need to load secrets from multiple
locations in Vault, under single common prefix, with single public/secret key per location.

The reasons for switching to new structure are not directly tied to Stakewise Operator, but we found that single key with dozens
of validators makes other software harder to function. For example, Web3signer can load 200 validators from a single
key, with 200 public keys and 200 secret key values, but it will issue 200 calls to the backend instead of single call. Because there is no partial secret fetching in Hashicorp Vault, this will result to 200x network traffic, which
makes loading several times longer, and could become a serious problem in case when many Web3signer instances are simultaneously restarting.

Old structure:

/k/v/engine/path` -> {"0x..96 chars public key1": "0x..64 chars secret key1", "0x..96 chars public key 1": "0x..64 chars secret key2"}

New structure:

/k/v/engine/path/..96 chars public key1  -> {"arbitrary key": "0x..64 chars secret key1"}
/k/v/engine/path/..96 chars public key2  -> {"arbitrary key": "0x..64 chars secret key2"} 

The configuration parameter for new structure is called --hashi-vault-key-prefix, which in the case of example above will translate to /k/v/engine/path/. Operator will list all the keys under it, and will use last segment
of secret path as public key, and the single value inside secret as private key.

Support for old structure, configured via --hashi-vault-key-path will remain in place, and v3-operator users utilizing it can still continue utilizing it.

@mksh mksh force-pushed the hashi-vault-prefix-loader branch from a759705 to 25b457b Compare December 12, 2024 11:07
@mksh mksh force-pushed the hashi-vault-prefix-loader branch from 25b457b to 98f166e Compare December 12, 2024 11:08
src/validators/keystores/hashi_vault.py Outdated Show resolved Hide resolved
src/validators/keystores/hashi_vault.py Show resolved Hide resolved
src/validators/keystores/hashi_vault.py Outdated Show resolved Hide resolved
src/validators/keystores/hashi_vault.py Outdated Show resolved Hide resolved
src/validators/keystores/hashi_vault.py Outdated Show resolved Hide resolved
src/validators/keystores/hashi_vault.py Outdated Show resolved Hide resolved
@evgeny-stakewise evgeny-stakewise merged commit 8a79226 into stakewise:master Dec 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants