OpenZeppelin / OpenZeppelin/openzeppelin-relayer
using workload identity for kms signer
Open
Nobody has claimed this yet.
S-needs-triage
T-bug
- Dominant language
- Rust
- Stars
- 150
- Forks
- 72
- Avg merge
- 8d 9h
- Merged PRs (30d)
- 2
Description
Describe the bug
Is it possible to init the kms client using workload identity and not via service account?
Steps to reproduce
run the container on GKE with workload identity
Application logs
Platform(s)
No response
Deployment Type
Docker container
Version Information
v1.4.0
Monitor Configuration
Network Type
EVM
Build Command
No response
Code of Conduct
- I agree to follow the Code of Conduct
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the KMS client initialization used by the signer and review how the relayer currently obtains service-account credentials. Compare that flow with workload identity on GKE. Done means the KMS client can authenticate through workload identity in the stated Docker-on-GKE setup without requiring a service account key.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- google-cloud, kubernetes, rust
- Domain
- authentication, cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100