You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Jeff Mitchell 163ce184b8 KMS-PKI Workers (#3101) ... This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.		3 years ago
..
handlers	KMS-PKI Workers (#3101)	3 years ago
connstate.go	KMS-PKI Workers (#3101)	3 years ago
connstate_test.go	KMS-PKI Workers (#3101)	3 years ago
downstreammanager.go	AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility (#2957)	3 years ago
downstreammanager_test.go	AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility (#2957)	3 years ago
tracking_listener.go	Port over changes (#3061) (#3062)	3 years ago