mirror of
https://github.com/optim-enterprises-bv/vault.git
synced 2025-10-29 17:52:32 +00:00
63ccb60b9a
* Add WrapKey capabilities to keysutil This allows one keysutil to wrap another key, assuming that key has an type matching one of keysutil's allowed KeyTypes. This allows completing the BYOK import loop with Transit, allowing imported wrapping keys to export (wrap) other keys in transit, without having them leave in plaintext. Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add /byok-export/:dst/:src[/:version] to Transit Still respecting exportable, we allow encrypted-only export of transit keys to another cluster using the BYOK semantics. In particular, this allows an operator to securely establish key material between two separate Transit installations. This potentially allows one cluster to be used as a source cluster (encrypting a large amount of data) and a second cluster to decrypt this data later. This might be useful in hybrid or site-specific deployments of Vault for instance. Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add missing dependency to sdk/, vault/ Also updates to a newer version while we're here. Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add documentation on BYOK export Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add tests for BYOK export/import Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add changelog entry Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Update website/content/api-docs/secret/transit.mdx * Update builtin/logical/transit/path_byok.go Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com> --------- Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
4 lines
162 B
Plaintext
4 lines
162 B
Plaintext
```release-note:improvement
|
|
secrets/transit: Support BYOK-encrypted export of keys to securely allow synchronizing specific keys and version across clusters.
|
|
```
|