feat: SPIRE sds coverage - #14
Merged
Merged
Conversation
M-01d / PKI-06: replace always-passing openssl s_client mTLS test with a real trust-bundle assertion. Compare the SHA-256 fingerprint of the unauthorized self-signed cert against the KMS-issued trust anchor and assert they differ. The old test always passed because the KMS PKI endpoint does not require client certificates; the new test has a meaningful fail condition. M-09 / PKI-03: replace two sign-intermediate calls (issuing two CA certs with different EKU, which was incorrect) with ONE ckms certificates certify call that issues a single leaf certificate carrying BOTH clientAuth AND serverAuth EKU. This correctly reflects the SPIFFE model: one identity, one certificate, both TLS roles on the same automated lifecycle. The certificate is inspected for both EKU and the SPIFFE URI SAN. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add configuration files for the native SPIRE eviden_kms plugins that
speak KMIP 2.1 directly to Eviden KMS — no Vault-compatible layer,
no auth-verifier.
New files:
certs/spire-client.crt / spire-client.key
mTLS client certificate for SPIRE → KMS authentication.
Issued by the test CA (ca.crt), extendedKeyUsage=clientAuth.
config/kms-kmip.toml
KMS server config with mTLS enabled:
[tls] tls_cert_file, tls_key_file, clients_ca_cert_file
Used by the kms-mtls docker-compose service in kmip-go.
config/spire-server-kmip-a.conf
config/spire-server-kmip-b.conf
SPIRE server configs using eviden_kms KeyManager +
UpstreamAuthority with cert_auth (mTLS to KMS).
Counterparts to spire-server-a.conf / spire-server-b.conf
(vault+auth-verifier stack).
Updated:
certs/generate-test-certs.sh
Generates spire-client.crt/key in addition to existing certs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
All test certs regenerated to include the new spire-client cert in the CA SRL. Existing certs (ca.crt, kms.crt, auth.crt, jwt.key.pem) are unchanged in purpose but have fresh timestamps. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Manuthor
added a commit
that referenced
this pull request
Sep 1, 2026
* fix(spire/pki): correct M-01d and M-09/PKI-03 test scenarios
M-01d / PKI-06: replace always-passing openssl s_client mTLS test with a
real trust-bundle assertion. Compare the SHA-256 fingerprint of the
unauthorized self-signed cert against the KMS-issued trust anchor and
assert they differ. The old test always passed because the KMS PKI
endpoint does not require client certificates; the new test has a
meaningful fail condition.
M-09 / PKI-03: replace two sign-intermediate calls (issuing two CA certs
with different EKU, which was incorrect) with ONE ckms certificates certify
call that issues a single leaf certificate carrying BOTH clientAuth AND
serverAuth EKU. This correctly reflects the SPIFFE model: one identity,
one certificate, both TLS roles on the same automated lifecycle.
The certificate is inspected for both EKU and the SPIFFE URI SAN.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* test: add SPIRE Discovery SDS
* feat(spire): add eviden_kms KMIP 2.1 plugin configs with mTLS
Add configuration files for the native SPIRE eviden_kms plugins that
speak KMIP 2.1 directly to Eviden KMS — no Vault-compatible layer,
no auth-verifier.
New files:
certs/spire-client.crt / spire-client.key
mTLS client certificate for SPIRE → KMS authentication.
Issued by the test CA (ca.crt), extendedKeyUsage=clientAuth.
config/kms-kmip.toml
KMS server config with mTLS enabled:
[tls] tls_cert_file, tls_key_file, clients_ca_cert_file
Used by the kms-mtls docker-compose service in kmip-go.
config/spire-server-kmip-a.conf
config/spire-server-kmip-b.conf
SPIRE server configs using eviden_kms KeyManager +
UpstreamAuthority with cert_auth (mTLS to KMS).
Counterparts to spire-server-a.conf / spire-server-b.conf
(vault+auth-verifier stack).
Updated:
certs/generate-test-certs.sh
Generates spire-client.crt/key in addition to existing certs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chore(certs): regenerate test TLS certificates
All test certs regenerated to include the new spire-client cert in the CA SRL.
Existing certs (ca.crt, kms.crt, auth.crt, jwt.key.pem) are unchanged in purpose
but have fresh timestamps.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.