lukasjarosch / lukasjarosch/skipper

Add asymmetric encryption secret driver

Open
#52 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

topic/secrets type/feature
Dominant language
Go
Stars
12
Forks
3
PR merge metrics
No merged PRs in 30d

Description

Problem
For the AES secret driver I still need to have somehow securely share the key between all people that want to reveal secrets. The other drivers require using a cloud provider.

Solution
I would like to be able to configure some public keys in the skipper config and then encrypt secrets using all those public keys.
Each one of the corresponding private keys can decrypt the secrets.

This way every participant only has to add their public key to the repository and no secret material needs to be exchanged.

Possible solutions could e.g. integrate gpg, age or sops.

Additional context
After changing the public keys, you should be able to reencrypt all the keys. Maybe even support to automatically rotate the secret if a public key was removed. Could be implemented in a separate PR/Issue.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue refers to the AES secret driver, other drivers, and skipper configuration, but names no files or tests. Start by inspecting those existing drivers and the configuration path, then compare the proposed gpg, age, and sops integrations. Done means secrets can be encrypted for configured public keys and decrypted by each corresponding private key.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.