feat: add openbao:// KMS URI support (SECURESIGN-5076) - #2186
Merged
Conversation
PR Summary by QodoAdd openbao:// KMS URI support and centralize shared KMS type
AI Description
Diagram
High-Level Assessment
Files changed (6)
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2186 +/- ##
==========================================
- Coverage 57.61% 57.60% -0.01%
==========================================
Files 288 288
Lines 16011 16044 +33
==========================================
+ Hits 9224 9242 +18
- Misses 5831 5847 +16
+ Partials 956 955 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Code Review by Qodo
1.
|
![qodo-for-securesign[bot]](https://avatars.githubusercontent.com/in/3596402?s=60&v=4){kind=small}
Member
Author
|
/retest |
1 similar comment
Member
Author
|
/retest |
bouskaJ
reviewed
Aug 11, 2026
Comment on lines
+236
to
+237
| // Used by TSA and Fulcio signer backends. | ||
| // XValidation is also present on RekorSigner.KMS (string field) in rekor_types.go. |
Member
There was a problem hiding this comment.
do not comment where it is used and where it is validated - the comment is propagated into API desc.
| // +kubebuilder:validation:XValidation:rule="self == 'secret' || self == 'memory' || self.matches('^awskms://.+$') || self.matches('^gcpkms://.+$') || self.matches('^azurekms://.+$') || self.matches('^hashivault://.+$')",message="KMS must be 'secret', 'memory', or a valid URI with a key path (e.g., awskms:///key-id)" | ||
| // - openbao://keyname | ||
| // +kubebuilder:validation:XValidation:rule="self == 'secret' || self == 'memory' || self.matches('^awskms://.+$') || self.matches('^gcpkms://.+$') || self.matches('^azurekms://.+$') || self.matches('^hashivault://.+$') || self.matches('^openbao://.+$')",message="KMS must be 'secret', 'memory', or a valid URI with a key path (e.g., awskms:///key-id)" | ||
| KMS string `json:"kms,omitempty"` |
Member
There was a problem hiding this comment.
can we reuse the KMS struct instead of the plain string?
Collaborator
There was a problem hiding this comment.
It will be good to migrate Rekor to use same structures like TSA, CTlog and Fulcio for signer config
bouskaJ
requested changes
Aug 11, 2026
kdacosta0
force-pushed
the
feat/openbao-kms-uri
branch
from
August 11, 2026 10:47
ae81d33 to
909966f
Compare
kdacosta0
force-pushed
the
feat/openbao-kms-uri
branch
from
August 11, 2026 10:53
909966f to
beac9f9
Compare
Member
Author
@bouskaJ Yes, tested on ocp - signing and verification was successful |
kdacosta0
force-pushed
the
feat/openbao-kms-uri
branch
from
August 11, 2026 11:02
beac9f9 to
9befd98
Compare
bouskaJ
requested changes
Aug 13, 2026
…ESIGN-5076) Add openbao:// as a valid KMS URI scheme alongside gcpkms://, azurekms://, hashivault://, and awskms:// in the shared KMS struct validation. Refactor Rekor signer from a flat KMS string to a struct-based pattern matching TSA/CTLog/Fulcio: Type enum (secret/memory/kms) + *KMS struct + *Auth, with CEL XValidation for mutual exclusion. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
bouskaJ
force-pushed
the
feat/openbao-kms-uri
branch
from
August 13, 2026 07:45
9befd98 to
a44c399
Compare
bouskaJ
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
openbao://as a valid KMS URI scheme for Rekor and TSA signer configurationKMSstruct fromtimestampauthority_types.gotocommon.go— it is used by both TSA and FulcioWhy
SECURESIGN-5076 — OpenBao (open-source Vault fork) is already supported by
sigstore/sigstoreas an alternative scheme for the hashivault KMS provider. The operator's CEL validation was rejecting validopenbao://URIs.KMSstruct lived in TSA types despite being shared across components — moved tocommon.goalongsideAuth,SecretKeySelector, and other shared types for discoverability.Note
PR #2184 (Fulcio KMS signer) uses the
KMSstruct — after this merges, #2184 needs a trivial rebase to pick up the new location incommon.go. Same package, no import changes.