Azure / Azure/azure-linux-extensions
KEK is not implemented. It makes no calls to unwrapKey
- Dominant language
- Python
- Stars
- 333
- Forks
- 278
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
I already opened https://github.com/Azure/azure-linux-extensions/issues/496 but it seems like it was misunderstood. I am opening another ticket with hopefully a clearer explanation.
KEK encryption does not do anything other than write the key to KeyVault. Please note that the key is never read from KeyVault. The code is apparently wholly unimplemented/non-existent.
There is a call to [wrapKey](https://docs.microsoft.com/en-us/rest/api/keyvault/wrapkey) but no call to [unwrapKey](https://docs.microsoft.com/en-us/rest/api/keyvault/unwrapkey).
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the existing KEK encryption flow and the call to Key Vault wrapKey, then compare it with the linked unwrapKey API documentation. Confirm where the key is written and whether any read or unwrap path exists. Done means KEK encryption also retrieves and unwraps the key from Key Vault rather than only writing it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, python
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100