Add AWS vault-utils: Secrets Manager, KMS bootstrap, and Raft health - #4
Open
amitslog wants to merge 1 commit into
Open
Add AWS vault-utils: Secrets Manager, KMS bootstrap, and Raft health#4amitslog wants to merge 1 commit into
amitslog wants to merge 1 commit into
Conversation
Give EC2 a fail-closed path to init with KMS auto-unseal, store tokens in Secrets Manager, expose voter health on 8210, and write Raft snapshots to S3.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This slice adds the AWS path in vault-utils so an EC2 node can init once with KMS auto-unseal, write init and platform tokens to Secrets Manager, and fail closed if SM or unseal does not work. Health serve listens on 8210 and returns 200 only when this node is a Raft voter and caught up. Snapshots go to the connected S3 prefix when SNAPSHOT_BUCKET is set. backup_schedule is a cron expression. Empty means off.
ASG, NLB, AMI, and user-data are not in this PR.
How I validated
go test -short ./...passed.go test ./internal/vaultclusterpassed (KeyStore, Raft health rule, S3 key/list, cron parse, plus existing isolation).go build ./cmd/vault-utilspassed. Live Secrets Manager, KMS, S3, and a 3-node NLB were not run.Review Note 1
Unit tests use in-memory fakes.
bootstrap awsis not exercised against a real Vault with an AWS KMS seal.TestLocalComposeRuntimewas not re-run (Docker Hub timeout). This branch does not change Compose.