Mukul Sharma
83f4aa0259
Only api gets the private half. The gateway is given the public half in plain Helm values, and that asymmetry is the point: the gateway terminates traffic for every deployed app, so holding only a verification key means compromising it cannot forge a session for anyone. The two halves must be installed together — a private key here that does not match the public key in the gateway's values means every session api issues is rejected and every app redirects to login forever.
41 lines
1.5 KiB
YAML
41 lines
1.5 KiB
YAML
# The Ed25519 private key api signs session tokens with.
|
|
#
|
|
# Only api gets this. The gateway is given the PUBLIC half instead, in plain
|
|
# Helm values, and that asymmetry is the point: the gateway terminates traffic
|
|
# for every deployed app, so it is the most exposed service in the system, and
|
|
# holding only a verification key means compromising it does not let anyone
|
|
# forge a session for anyone.
|
|
#
|
|
# Generate the pair with `make keygen` in the toolshed repo. It prints both
|
|
# halves. They must be installed together — a private key here that does not
|
|
# match the public key in the gateway's values means every session api issues
|
|
# is rejected by the gateway, and every app redirects to login forever:
|
|
#
|
|
# kubectl -n vault exec -i vault-0 -- sh -lc '
|
|
# vault login <root-token> >/dev/null &&
|
|
# vault kv put secret/toolshed/session private_key=<SESSION_PRIVATE_KEY>'
|
|
#
|
|
# then put the matching SESSION_PUBLIC_KEY into
|
|
# devops-helm-charts/values/toolshed/toolshed/values.yaml and sync toolshed.
|
|
#
|
|
# Rotating the key invalidates every live session at once, which is the
|
|
# intended behaviour for a key compromise and a rude surprise otherwise.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: toolshed-session-key
|
|
namespace: toolshed
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: toolshed-session-key
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: private_key
|
|
remoteRef:
|
|
key: toolshed/session
|
|
property: private_key
|