Skip to content

refactor(fdo): use openbao for key storage#1905

Draft
noaccOS wants to merge 36 commits intomasterfrom
bao
Draft

refactor(fdo): use openbao for key storage#1905
noaccOS wants to merge 36 commits intomasterfrom
bao

Conversation

@noaccOS
Copy link
Copy Markdown
Collaborator

@noaccOS noaccOS commented Apr 3, 2026

What this PR does / why we need it:

Currently we're storing plaintext private keys on db for FDO, which is a big no no
The chosen solution is openbao!

Additional documentation e.g. usage docs, diagrams, reviewer notes, etc.:


Thanks for sending a pull request! If this is your first time, here are some tips for you:
  1. You can take a look at our developer guide for an introduction on Astarte development!
  2. Make sure to read CONTRIBUTING.md and CODE_OF_CONDUCT.md
  3. If the PR is unfinished or you're actively working on it, mark it as draft

When fixing existing issues, use github's syntax to link your pull request to it

fixes #<issue number>

We also have a syntax to signal dependencies to other open pull requests

depends on #<pr number>
depends on https://github.com/...

In case of stacked PRs, you may add the PR number in the last commit's title instead:

gitGraph
    commit id: "Current master"
    branch feat1
    checkout feat1
    commit id: "feat: add something"
    commit id: "feat: add something else (#100)"
    branch feat2
    checkout feat2
    commit id: "refactor: do something"
    commit id: "fix: solve issue"
    commit id: "feat: add a feature (#101)"
    branch feat3
    checkout feat3
    commit id: "feat: feat without pr number"
Loading

noaccOS and others added 30 commits April 1, 2026 11:44
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: frossq <francesco.asquini@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Riccardo Nalgi <riccardo.nalgi@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Riccardo Nalgi <riccardo.nalgi@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
…tion (#1891)

Signed-off-by: frossq <francesco.asquini@secomind.com>
Signed-off-by: frossq <francesco.asquini@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: frossq <francesco.asquini@secomind.com>
Added Astarte.Secrets.decrypt/3 for asymmetric decryption.
Signed-off-by: frossq <francesco.asquini@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Riccardo Nalgi <riccardo.nalgi@secomind.com>
Co-authored-by: Francesco Noacco <francesco.noacco@secomind.com>
* chore: fix flakiness in OwnerOnboardingTest

Signed-off-by: frossq <francesco.asquini@secomind.com>

* test(fdo): restore async

Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>

---------

Signed-off-by: frossq <francesco.asquini@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Co-authored-by: Francesco Noacco <francesco.noacco@secomind.com>
noaccOS and others added 5 commits April 3, 2026 10:42
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
Signed-off-by: Riccardo Nalgi <riccardo.nalgi@secomind.com>
Signed-off-by: Francesco Noacco <francesco.noacco@secomind.com>
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 3, 2026

Codecov Report

❌ Patch coverage is 70.46980% with 44 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.68%. Comparing base (7234b63) to head (2c49d2a).

Files with missing lines Patch % Lines
.../astarte_fdo/lib/ownership_voucher/load_request.ex 82.66% 13 Missing ⚠️
...rte_secrets/lib/astarte_secrets/astarte_secrets.ex 0.00% 13 Missing ⚠️
...data_access/lib/astarte_data_access/fdo/queries.ex 8.33% 11 Missing ⚠️
libs/astarte_secrets/lib/astarte_secrets/core.ex 84.37% 5 Missing ⚠️
libs/astarte_fdo/lib/owner_onboarding.ex 50.00% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1905      +/-   ##
==========================================
+ Coverage   83.82%   84.68%   +0.85%     
==========================================
  Files         572      394     -178     
  Lines       10040     8331    -1709     
==========================================
- Hits         8416     7055    -1361     
+ Misses       1624     1276     -348     
Files with missing lines Coverage Δ
...keeping/lib/astarte_housekeeping/realms/queries.ex 91.18% <ø> (+0.33%) ⬆️
...s/lib/astarte_data_access/fdo/ownership_voucher.ex 100.00% <100.00%> (ø)
..._access/lib/astarte_data_access/fdo/to2_session.ex 100.00% <ø> (ø)
..._fdo/lib/owner_onboarding/key_exchange_strategy.ex 100.00% <100.00%> (ø)
libs/astarte_fdo/lib/owner_onboarding/session.ex 84.74% <100.00%> (+1.10%) ⬆️
...ibs/astarte_fdo_core/lib/ownership_voucher/core.ex 29.41% <ø> (ø)
...e_fdo_core/lib/ownership_voucher/create_request.ex 92.85% <ø> (ø)
...ts/lib/astarte_secrets/owner_key_initialization.ex 100.00% <100.00%> (+100.00%) ⬆️
libs/astarte_fdo/lib/owner_onboarding.ex 75.90% <50.00%> (+1.15%) ⬆️
libs/astarte_secrets/lib/astarte_secrets/core.ex 92.00% <84.37%> (+24.12%) ⬆️
... and 3 more

... and 181 files with indirect coverage changes

Flag Coverage Δ
astarte_appengine_api 85.68% <ø> (ø)
astarte_data_access 81.94% <15.38%> (-3.77%) ⬇️
astarte_data_updater_plant 87.13% <ø> (ø)
astarte_events 80.27% <ø> (ø)
astarte_fdo 80.87% <82.95%> (+5.54%) ⬆️
astarte_fdo_core 61.50% <ø> (+0.87%) ⬆️
astarte_generators 97.74% <ø> (ø)
astarte_housekeeping 85.67% <ø> (+0.14%) ⬆️
astarte_housekeeping_api ?
astarte_pairing ?
astarte_pairing_api ?
astarte_realm_management 87.66% <ø> (+0.07%) ⬆️
astarte_realm_management_api ?
astarte_rpc 88.23% <ø> (ø)
astarte_secrets 85.16% <62.50%> (+14.63%) ⬆️
astarte_trigger_engine 82.52% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Signed-off-by: Riccardo Nalgi <riccardo.nalgi@secomind.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants