-
Notifications
You must be signed in to change notification settings - Fork 2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
core: add jwks rpc and http api (#18035)
Add JWKS endpoint to HTTP API for exposing the root public signing keys used for signing workload identity JWTs. Part 1 of N components as part of making workload identities consumable by third party services such as Consul and Vault. Identity attenuation (audience) and expiration (+renewal) are necessary to securely use workload identities with 3rd parties, so this merge does not yet document this endpoint. --------- Co-authored-by: Tim Gross <[email protected]>
- Loading branch information
1 parent
ee0b104
commit d14362e
Showing
11 changed files
with
363 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| // Copyright (c) HashiCorp, Inc. | ||
| // SPDX-License-Identifier: MPL-2.0 | ||
|
|
||
| package helper | ||
|
|
||
| import ( | ||
| "time" | ||
| ) | ||
|
|
||
| // ExpiryToRenewTime calculates how long until clients should try to renew | ||
| // credentials based on their expiration time and now. | ||
| // | ||
| // Renewals will begin halfway between now and the expiry plus some jitter. | ||
| // | ||
| // If the expiration is in the past or less than the min wait, then the min | ||
| // wait time will be used with jitter. | ||
| func ExpiryToRenewTime(exp time.Time, now func() time.Time, minWait time.Duration) time.Duration { | ||
| left := exp.Sub(now()) | ||
|
|
||
| renewAt := left / 2 | ||
|
|
||
| if renewAt < minWait { | ||
| return minWait + RandomStagger(minWait/10) | ||
| } | ||
|
|
||
| return renewAt + RandomStagger(renewAt/10) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| // Copyright (c) HashiCorp, Inc. | ||
| // SPDX-License-Identifier: MPL-2.0 | ||
|
|
||
| package helper | ||
|
|
||
| import ( | ||
| "testing" | ||
| "time" | ||
|
|
||
| "github.com/shoenig/test/must" | ||
| ) | ||
|
|
||
| // TestExpiryToRenewTime_0Min asserts that ExpiryToRenewTime with a 0 min wait | ||
| // will cause an immediate renewal | ||
| func TestExpiryToRenewTime_0Min(t *testing.T) { | ||
| exp := time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC) | ||
| now := func() time.Time { | ||
| return time.Date(2023, 1, 1, 0, 0, 1, 0, time.UTC) | ||
| } | ||
|
|
||
| renew := ExpiryToRenewTime(exp, now, 0) | ||
|
|
||
| must.Zero(t, renew) | ||
| } | ||
|
|
||
| // TestExpiryToRenewTime_14Days asserts that ExpiryToRenewTime begins trying to | ||
| // renew at or after 7 days of a 14 day expiration window. | ||
| func TestExpiryToRenewTime_30Days(t *testing.T) { | ||
| exp := time.Date(2023, 1, 15, 0, 0, 0, 0, time.UTC) | ||
| now := func() time.Time { | ||
| return time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC) | ||
| } | ||
| min := 20 * time.Minute | ||
|
|
||
| renew := ExpiryToRenewTime(exp, now, min) | ||
|
|
||
| // Renew should be much greater than min wait | ||
| must.Greater(t, min, renew) | ||
|
|
||
| // Renew should be >= 7 days | ||
| must.GreaterEq(t, 7*24*time.Hour, renew) | ||
| } | ||
|
|
||
| // TestExpiryToRenewTime_UnderMin asserts that ExpiryToRenewTime uses the min | ||
| // wait + jitter if it is greater than the time until expiry. | ||
| func TestExpiryToRenewTime_UnderMin(t *testing.T) { | ||
| exp := time.Date(2023, 1, 1, 0, 0, 10, 0, time.UTC) | ||
| now := func() time.Time { | ||
| return time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC) | ||
| } | ||
| min := 20 * time.Second | ||
|
|
||
| renew := ExpiryToRenewTime(exp, now, min) | ||
|
|
||
| // Renew should be >= min wait (jitter can be 0) | ||
| must.GreaterEq(t, min, renew) | ||
|
|
||
| // When we fallback to the min wait it means we miss the expiration, but this | ||
| // is necessary to prevent stampedes after outages and partitions. | ||
| must.GreaterEq(t, exp.Sub(now()), renew) | ||
| } | ||
|
|
||
| // TestExpiryToRenewTime_Expired asserts that ExpiryToRenewTime defaults to | ||
| // minWait (+jitter) if the renew time has already elapsed. | ||
| func TestExpiryToRenewTime_Expired(t *testing.T) { | ||
| exp := time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC) | ||
| now := func() time.Time { | ||
| return time.Date(2023, 2, 1, 0, 0, 0, 0, time.UTC) | ||
| } | ||
| min := time.Hour | ||
|
|
||
| renew := ExpiryToRenewTime(exp, now, min) | ||
|
|
||
| must.Greater(t, min, renew) | ||
| must.Less(t, min*2, renew) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.