Skip to content

Commit 34d2349

Browse files
deblasisdeblasis
committed
feat: OCI KMS provider
Signed-off-by: Alessandro De Blasis <[email protected]>
1 parent 659b7a5 commit 34d2349

File tree

14 files changed

+602
-110
lines changed

14 files changed

+602
-110
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
bin/
22
dist/
33
functional-tests/sops
4+
functional-tests/target
45
vendor/
56
profile.out

‎README.rst

Lines changed: 63 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ It is also possible to use ``updatekeys``, when adding or removing age recipient
255255
+++ age1qe5lxzzeppw5k79vxn3872272sgy224g2nzqlzy3uljs84say3yqgvd0sw
256256
Is this okay? (y/n):y
257257
2022/02/09 16:32:04 File /iac/solution1/secret.enc.yaml synced with new keys
258-
258+
259259
Encrypting using GCP KMS
260260
~~~~~~~~~~~~~~~~~~~~~~~~
261261
GCP KMS uses `Application Default Credentials
@@ -418,7 +418,7 @@ Encrypting using Hashicorp Vault
418418
419419
We assume you have an instance (or more) of Vault running and you have privileged access to it. For instructions on how to deploy a secure instance of Vault, refer to Hashicorp's official documentation.
420420
421-
To easily deploy Vault locally: (DO NOT DO THIS FOR PRODUCTION!!!)
421+
To easily deploy Vault locally: (DO NOT DO THIS FOR PRODUCTION!!!)
422422

423423
.. code:: sh
424424
@@ -428,11 +428,11 @@ To easily deploy Vault locally: (DO NOT DO THIS FOR PRODUCTION!!!)
428428
.. code:: sh
429429
430430
$ # Substitute this with the address Vault is running on
431-
$ export VAULT_ADDR=http://127.0.0.1:8200
431+
$ export VAULT_ADDR=http://127.0.0.1:8200
432432
433433
$ # this may not be necessary in case you previously used `vault login` for production use
434-
$ export VAULT_TOKEN=toor
435-
434+
$ export VAULT_TOKEN=toor
435+
436436
$ # to check if Vault started and is configured correctly
437437
$ vault status
438438
Key Value
@@ -471,7 +471,62 @@ To easily deploy Vault locally: (DO NOT DO THIS FOR PRODUCTION!!!)
471471
hc_vault_transit_uri: "$VAULT_ADDR/v1/sops/keys/thirdkey"
472472
EOF
473473
474-
$ sops encrypt --verbose prod/raw.yaml > prod/encrypted.yaml
474+
$ sops --verbose -e prod/raw.yaml > prod/encrypted.yaml
475+
476+
Encrypting using OCI KMS
477+
~~~~~~~~~~~~~~~~~~~~~~~~
478+
479+
OCI KMS uses the `DefaultConfigProvider <https://github.com/oracle/oci-go-sdk/blob/master/README.md#configuring>`_.
480+
It will look for the `DEFAULT` profile in the `~/.oci/config` file.
481+
482+
Make sure to authenticate and to have a valid session via:
483+
484+
.. code:: bash
485+
486+
$ oci session authenticate
487+
488+
Encrypting/decrypting with OCI KMS requires a KMS OCID. You can use the
489+
cloud console the get the OCID of an existing key or you can create one using the `oci`
490+
CLI:
491+
492+
.. code:: bash
493+
494+
$ export compartment_id=<substitute-value-of-compartment_id>
495+
$ export display_name=<substitute-value-of-display_name>
496+
$ export vault_type=<substitute-value-of-vault_type>
497+
$ OCI_CLI_AUTH=security_token oci kms management vault create --compartment-id $compartment_id --display-name $display_name --vault-type $vault_type
498+
# you should see a JSON summarizing the created resource
499+
# for help: https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/kms/management/vault/create.html
500+
501+
Now we need to create a key. First of all we need to define a shape for it with:
502+
503+
.. code:: bash
504+
505+
$ cat << EOF > key-shape.json
506+
{
507+
"algorithm": "AES",
508+
"length": 32
509+
}
510+
EOF
511+
512+
Now we can create the key with
513+
514+
.. code:: bash
515+
516+
$ export compartment_id=<substitute-value-of-compartment_id>
517+
$ export display_name=<substitute-value-of-display_name>
518+
# you can grab the endpoint from the vault page on the portal, it should be something like: https://asdadsasdagz5aacmg-management.kms.<region>.oraclecloud.com
519+
$ OCI_CLI_AUTH=security_token oci kms management key create --compartment-id $compartment_id --display-name $display_name --endpoint <endpoint> --key-shape file://key-shape.json
520+
# you should see a JSON summarizing the created resource, we need to grab the OCID of the key from it
521+
# for help: https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/kms/management/key/create.html
522+
523+
Now you can encrypt a file using::
524+
525+
$ sops --encrypt --oci-kms ocid1.key.oc1.<region>.asdadsasdagz5aacmg.abwgiljtjasdasdasdagugpfe7wrtngukihgkybqxcoozz7sbh6lq test.yaml > test.enc.yaml
526+
527+
And decrypt it using::
528+
529+
$ sops --decrypt test.enc.yaml
475530
476531
Adding and removing keys
477532
~~~~~~~~~~~~~~~~~~~~~~~~
@@ -1596,8 +1651,8 @@ will encrypt the values under the ``data`` and ``stringData`` keys in a YAML fil
15961651
containing kubernetes secrets. It will not encrypt other values that help you to
15971652
navigate the file, like ``metadata`` which contains the secrets' names.
15981653
1599-
Conversely, you can opt in to only leave certain keys without encrypting by using the
1600-
``--unencrypted-regex`` option, which will leave the values unencrypted of those keys
1654+
Conversely, you can opt in to only leave certain keys without encrypting by using the
1655+
``--unencrypted-regex`` option, which will leave the values unencrypted of those keys
16011656
that match the supplied regular expression. For example, this command:
16021657
16031658
.. code:: sh

‎cmd/sops/main.go

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ import (
3838
"github.com/getsops/sops/v3/keyservice"
3939
"github.com/getsops/sops/v3/kms"
4040
"github.com/getsops/sops/v3/logging"
41+
"github.com/getsops/sops/v3/ocikms"
4142
"github.com/getsops/sops/v3/pgp"
4243
"github.com/getsops/sops/v3/stores/dotenv"
4344
"github.com/getsops/sops/v3/stores/json"
@@ -1092,8 +1093,8 @@ func main() {
10921093
return toExitError(err)
10931094
}
10941095
if _, err := os.Stat(fileName); os.IsNotExist(err) {
1095-
if c.String("add-kms") != "" || c.String("add-pgp") != "" || c.String("add-gcp-kms") != "" || c.String("add-hc-vault-transit") != "" || c.String("add-azure-kv") != "" || c.String("add-age") != "" ||
1096-
c.String("rm-kms") != "" || c.String("rm-pgp") != "" || c.String("rm-gcp-kms") != "" || c.String("rm-hc-vault-transit") != "" || c.String("rm-azure-kv") != "" || c.String("rm-age") != "" {
1096+
if c.String("add-kms") != "" || c.String("add-pgp") != "" || c.String("add-gcp-kms") != "" || c.String("add-hc-vault-transit") != "" || c.String("add-azure-kv") != "" || c.String("add-age") != "" || c.String("add-oci-kms") != "" ||
1097+
c.String("rm-kms") != "" || c.String("rm-pgp") != "" || c.String("rm-gcp-kms") != "" || c.String("rm-hc-vault-transit") != "" || c.String("rm-azure-kv") != "" || c.String("rm-age") != "" || c.String("rm-oci-kms") != "" {
10971098
return common.NewExitError(fmt.Sprintf("Error: cannot add or remove keys on non-existent file %q, use the `edit` subcommand instead.", fileName), codes.CannotChangeKeysFromNonExistentFile)
10981099
}
10991100
}
@@ -1554,6 +1555,11 @@ func main() {
15541555
Usage: "comma separated list of age recipients",
15551556
EnvVar: "SOPS_AGE_RECIPIENTS",
15561557
},
1558+
cli.StringFlag{
1559+
Name: "oci-kms",
1560+
Usage: "comma separated list of OCI KMS OCIDs",
1561+
EnvVar: "SOPS_OCI_KMS_OCIDS",
1562+
},
15571563
cli.BoolFlag{
15581564
Name: "in-place, i",
15591565
Usage: "write output back to the same file instead of stdout",
@@ -1614,6 +1620,14 @@ func main() {
16141620
Name: "rm-age",
16151621
Usage: "remove the provided comma-separated list of age recipients from the list of master keys on the given file",
16161622
},
1623+
cli.StringFlag{
1624+
Name: "add-oci-kms",
1625+
Usage: "add the provided comma-separated list of OCI KMS keys OCIDs to the list of master keys on the given file",
1626+
},
1627+
cli.StringFlag{
1628+
Name: "rm-oci-kms",
1629+
Usage: "remove the provided comma-separated list of OCI KMS keys OCIDs from the list of master keys on the given file",
1630+
},
16171631
cli.StringFlag{
16181632
Name: "add-pgp",
16191633
Usage: "add the provided comma-separated list of PGP fingerprints to the list of master keys on the given file",
@@ -2004,7 +2018,7 @@ func getEncryptConfig(c *cli.Context, fileName string) (encryptConfig, error) {
20042018
}, nil
20052019
}
20062020

2007-
func getMasterKeys(c *cli.Context, kmsEncryptionContext map[string]*string, kmsOptionName string, pgpOptionName string, gcpKmsOptionName string, azureKvOptionName string, hcVaultTransitOptionName string, ageOptionName string) ([]keys.MasterKey, error) {
2021+
func getMasterKeys(c *cli.Context, kmsEncryptionContext map[string]*string, kmsOptionName string, pgpOptionName string, gcpKmsOptionName string, azureKvOptionName string, hcVaultTransitOptionName string, ageOptionName string, ociOptionName string) ([]keys.MasterKey, error) {
20082022
var masterKeys []keys.MasterKey
20092023
for _, k := range kms.MasterKeysFromArnString(c.String(kmsOptionName), kmsEncryptionContext, c.String("aws-profile")) {
20102024
masterKeys = append(masterKeys, k)
@@ -2041,11 +2055,11 @@ func getMasterKeys(c *cli.Context, kmsEncryptionContext map[string]*string, kmsO
20412055

20422056
func getRotateOpts(c *cli.Context, fileName string, inputStore common.Store, outputStore common.Store, svcs []keyservice.KeyServiceClient, decryptionOrder []string) (rotateOpts, error) {
20432057
kmsEncryptionContext := kms.ParseKMSContext(c.String("encryption-context"))
2044-
addMasterKeys, err := getMasterKeys(c, kmsEncryptionContext, "add-kms", "add-pgp", "add-gcp-kms", "add-azure-kv", "add-hc-vault-transit", "add-age")
2058+
addMasterKeys, err := getMasterKeys(c, kmsEncryptionContext, "add-kms", "add-pgp", "add-gcp-kms", "add-azure-kv", "add-hc-vault-transit", "add-age", "add-oci-kms")
20452059
if err != nil {
20462060
return rotateOpts{}, err
20472061
}
2048-
rmMasterKeys, err := getMasterKeys(c, kmsEncryptionContext, "rm-kms", "rm-pgp", "rm-gcp-kms", "rm-azure-kv", "rm-hc-vault-transit", "rm-age")
2062+
rmMasterKeys, err := getMasterKeys(c, kmsEncryptionContext, "rm-kms", "rm-pgp", "rm-gcp-kms", "rm-azure-kv", "rm-hc-vault-transit", "rm-age", "rm-oci-kms")
20492063
if err != nil {
20502064
return rotateOpts{}, err
20512065
}
@@ -2180,6 +2194,7 @@ func keyGroups(c *cli.Context, file string) ([]sops.KeyGroup, error) {
21802194
var azkvKeys []keys.MasterKey
21812195
var hcVaultMkKeys []keys.MasterKey
21822196
var ageMasterKeys []keys.MasterKey
2197+
var ociMasterKeys []keys.MasterKey
21832198
kmsEncryptionContext := kms.ParseKMSContext(c.String("encryption-context"))
21842199
if c.String("encryption-context") != "" && kmsEncryptionContext == nil {
21852200
return nil, common.NewExitError("Invalid KMS encryption context format", codes.ErrorInvalidKMSEncryptionContextFormat)
@@ -2226,7 +2241,12 @@ func keyGroups(c *cli.Context, file string) ([]sops.KeyGroup, error) {
22262241
ageMasterKeys = append(ageMasterKeys, k)
22272242
}
22282243
}
2229-
if c.String("kms") == "" && c.String("pgp") == "" && c.String("gcp-kms") == "" && c.String("azure-kv") == "" && c.String("hc-vault-transit") == "" && c.String("age") == "" {
2244+
if c.String("oci-kms") != "" {
2245+
for _, k := range ocikms.MasterKeysFromOCIDString(c.String("oci-kms")) {
2246+
ociMasterKeys = append(ociMasterKeys, k)
2247+
}
2248+
}
2249+
if c.String("kms") == "" && c.String("pgp") == "" && c.String("gcp-kms") == "" && c.String("azure-kv") == "" && c.String("hc-vault-transit") == "" && c.String("age") == "" && c.String("oci-kms") == "" {
22302250
conf, err := loadConfig(c, file, kmsEncryptionContext)
22312251
// config file might just not be supplied, without any error
22322252
if conf == nil {
@@ -2245,6 +2265,7 @@ func keyGroups(c *cli.Context, file string) ([]sops.KeyGroup, error) {
22452265
group = append(group, pgpKeys...)
22462266
group = append(group, hcVaultMkKeys...)
22472267
group = append(group, ageMasterKeys...)
2268+
group = append(group, ociMasterKeys...)
22482269
log.Debugf("Master keys available: %+v", group)
22492270
return []sops.KeyGroup{group}, nil
22502271
}

‎config/config.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717
"github.com/getsops/sops/v3/gcpkms"
1818
"github.com/getsops/sops/v3/hcvault"
1919
"github.com/getsops/sops/v3/kms"
20+
"github.com/getsops/sops/v3/ocikms"
2021
"github.com/getsops/sops/v3/pgp"
2122
"github.com/getsops/sops/v3/publish"
2223
"gopkg.in/yaml.v3"
@@ -92,6 +93,7 @@ type keyGroup struct {
9293
AzureKV []azureKVKey `yaml:"azure_keyvault"`
9394
Vault []string `yaml:"hc_vault"`
9495
Age []string `yaml:"age"`
96+
OCIKMS []string `yaml:"oci_kms"`
9597
PGP []string
9698
}
9799

@@ -131,6 +133,7 @@ type creationRule struct {
131133
KMS string
132134
AwsProfile string `yaml:"aws_profile"`
133135
Age string `yaml:"age"`
136+
OCIKMS string `yaml:"oci_kms"`
134137
PGP string
135138
GCPKMS string `yaml:"gcp_kms"`
136139
AzureKeyVault string `yaml:"azure_keyvault"`
@@ -214,6 +217,9 @@ func extractMasterKeys(group keyGroup) (sops.KeyGroup, error) {
214217
keyGroup = append(keyGroup, key)
215218
}
216219
}
220+
for _, k := range group.OCIKMS {
221+
keyGroup = append(keyGroup, ocikms.NewMasterKeyFromOCID(k))
222+
}
217223
for _, k := range group.PGP {
218224
keyGroup = append(keyGroup, pgp.NewMasterKeyFromFingerprint(k))
219225
}
@@ -244,6 +250,9 @@ func getKeyGroupsFromCreationRule(cRule *creationRule, kmsEncryptionContext map[
244250
if err != nil {
245251
return nil, err
246252
}
253+
for _, k := range group.OCIKMS {
254+
keyGroup = append(keyGroup, ocikms.NewMasterKeyFromOCID(k))
255+
}
247256
groups = append(groups, keyGroup)
248257
}
249258
} else {
@@ -267,6 +276,9 @@ func getKeyGroupsFromCreationRule(cRule *creationRule, kmsEncryptionContext map[
267276
for _, k := range gcpkms.MasterKeysFromResourceIDString(cRule.GCPKMS) {
268277
keyGroup = append(keyGroup, k)
269278
}
279+
for _, k := range ocikms.MasterKeysFromOCIDString(cRule.OCIKMS) {
280+
keyGroup = append(keyGroup, k)
281+
}
270282
azureKeys, err := azkv.MasterKeysFromURLs(cRule.AzureKeyVault)
271283
if err != nil {
272284
return nil, err

‎go.mod

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ require (
3030
github.com/lib/pq v1.10.9
3131
github.com/mitchellh/go-homedir v1.1.0
3232
github.com/mitchellh/go-wordwrap v1.0.1
33+
github.com/oracle/oci-go-sdk/v65 v65.81.1
3334
github.com/ory/dockertest/v3 v3.11.0
3435
github.com/pkg/errors v0.9.1
3536
github.com/sirupsen/logrus v1.9.3
@@ -97,6 +98,7 @@ require (
9798
github.com/go-logr/logr v1.4.2 // indirect
9899
github.com/go-logr/stdr v1.2.2 // indirect
99100
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
101+
github.com/gofrs/flock v0.8.1 // indirect
100102
github.com/gogo/protobuf v1.3.2 // indirect
101103
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
102104
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
@@ -127,6 +129,7 @@ require (
127129
github.com/pmezard/go-difflib v1.0.0 // indirect
128130
github.com/russross/blackfriday/v2 v2.1.0 // indirect
129131
github.com/ryanuber/go-glob v1.0.0 // indirect
132+
github.com/sony/gobreaker v0.5.0 // indirect
130133
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
131134
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
132135
github.com/xeipuuv/gojsonschema v1.2.0 // indirect

‎go.sum

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,8 @@ github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
158158
github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
159159
github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
160160
github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
161+
github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
162+
github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
161163
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
162164
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
163165
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
@@ -240,6 +242,8 @@ github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQ
240242
github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
241243
github.com/opencontainers/runc v1.2.3 h1:fxE7amCzfZflJO2lHXf4y/y8M1BoAqp+FVmG19oYB80=
242244
github.com/opencontainers/runc v1.2.3/go.mod h1:nSxcWUydXrsBZVYNSkTjoQ/N6rcyTtn+1SD5D4+kRIM=
245+
github.com/oracle/oci-go-sdk/v65 v65.81.1 h1:JYc47bk8n/MUchA2KHu1ggsCQzlJZQLJ+tTKfOho00E=
246+
github.com/oracle/oci-go-sdk/v65 v65.81.1/go.mod h1:IBEV9l1qBzUpo7zgGaRUhbB05BVfcDGYRFBCPlTcPp0=
243247
github.com/ory/dockertest/v3 v3.11.0 h1:OiHcxKAvSDUwsEVh2BjxQQc/5EHz9n0va9awCtNGuyA=
244248
github.com/ory/dockertest/v3 v3.11.0/go.mod h1:VIPxS1gwT9NpPOrfD3rACs8Y9Z7yhzO4SB194iUDnUI=
245249
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
@@ -260,9 +264,12 @@ github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkB
260264
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
261265
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
262266
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
267+
github.com/sony/gobreaker v0.5.0 h1:dRCvqm0P490vZPmy7ppEk2qCnCieBooFJ+YoXGYB+yg=
268+
github.com/sony/gobreaker v0.5.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
263269
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
264270
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
265271
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
272+
github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
266273
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
267274
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
268275
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -333,6 +340,7 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
333340
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
334341
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
335342
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
343+
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
336344
golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
337345
golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
338346
golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=

‎keyservice/keyservice.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"github.com/getsops/sops/v3/hcvault"
1414
"github.com/getsops/sops/v3/keys"
1515
"github.com/getsops/sops/v3/kms"
16+
"github.com/getsops/sops/v3/ocikms"
1617
"github.com/getsops/sops/v3/pgp"
1718
)
1819

@@ -78,6 +79,15 @@ func KeyFromMasterKey(mk keys.MasterKey) Key {
7879
},
7980
},
8081
}
82+
case *ocikms.MasterKey:
83+
return Key{
84+
KeyType: &Key_OciKey{
85+
OciKey: &OciKey{
86+
Ocid: mk.Ocid,
87+
},
88+
},
89+
}
90+
8191
default:
8292
panic(fmt.Sprintf("Tried to convert unknown MasterKey type %T to keyservice.Key", mk))
8393
}

0 commit comments

Comments
 (0)