nuts-foundation / nuts-foundation/nuts-node

Reconsider support for secret key storage

Open
#2,846 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
28
Forks
23
Avg merge
1d 10h
Merged PRs (30d)
76

Description

We decided to move away from native support for various secret stores. The arguments were:

  • When we support X, people will ask for Y. And then for Z.
  • We don't want the (big) SDK/client libraries inside the Nuts node for the various secret stores (Azure seemed to be a big, big dependency to include).

However:

  • Having to deploy a secret store adapter (e.g. Hashicorp Vault, MS Azure Key Vault, Amazon AWS Key Manager) adds another container to the microservice hell.
  • When (enough) people use Y, why shouldn't it be supported out of the box? After all, the tool exists because it brings value (the question of who'll maintain it, is a different question)
  • The Azure Golang SDK is now modularized, so including the key vault client doesn't mean pulling the entire Azure SDK inside Nuts.
    • I noticed IRMA now includes the MS SQL Server Golang driver, which in turn includes (amongst others) the Azure Key Vault SDK. So we might already include to SDKs/client libraries transitively, even if we didn't want to.

Suggestion:

  • Allow native support for other key storage (than fs and external) again, but only if it's going to be maintained
  • If there's no-one maintaining an implementation (meaning there is nobody using it, or at least not willing to put effort into it), it can be removed
  • Un-deprecate the vault (Hashicorp) key storage implementation again
  • We could keep the external option for customizability, for future use or deprecate it

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the current key-storage options mentioned in the issue: fs, external, and the deprecated vault implementation. Determine which implementations are still present and what maintenance or dependency work would be required to restore native support. Done means reaching a clear decision on supported stores and maintaining or removing the relevant implementations.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.