Skip to content

resource_storage_backend.md

Latest commit

 

History

History
80 lines (59 loc) · 3.89 KB

resource_storage_backend.md

File metadata and controls

80 lines (59 loc) · 3.89 KB
Raw

Resource Storage Backend

KBS stores confidential resources through a StorageBackend abstraction specified by a Rust trait. The StorageBackend interface can be implemented for different storage backends like e.g. databases or local file systems.

The KBS config file defines which resource backend KBS will use. The default is the local file system (LocalFs).

Local File System Backend

With the local file system backend default implementation, each resource file maps to a KBS resource URL. The file path to URL conversion scheme is defined below:

Resource File Path Resource URL
file://<$(KBS_REPOSITORY_DIR)>/<repository_name>/<type>/<tag> https://<kbs_address>/kbs/v0/resource/<repository_name>/<type>/<tag>

The KBS root file system resource path is specified in the KBS config file as well, and the default value is /opt/confidential-containers/kbs/repository.

Aliyun KMS

Alibaba Cloud KMS(a.k.a Aliyun KMS) can also work as the KBS resource storage backend. In this mode, resources will be stored with generic secrets in a KMS instance. One KBS can be configured with a specified KMS instance in repository_config field of KBS launch config. For config, see the document. These materials can be found in KMS instance's AAP. When being accessed, a resource URI of kbs:///repo/type/tag will be translated into the generic secret with name tag. Hinting that repo/type field will be ignored.

AWS Secrets Manager

AWS Secrets Manager can also work as the KBS resource storage backend. Build KBS with the aws feature flag enabled. Resources are stored as Secrets Manager secrets and fetched via GetSecretValue.

A resource URI of kbs:///repo/type/tag is translated into the Secrets Manager secret with SecretId = tag. The repo/type portion is ignored — match the behavior of the Aliyun KMS backend. tag may be either a secret name or a full secret ARN.

This backend is read-only. Writes and deletes return an error — provision and rotate secrets via AWS APIs.

Google Cloud Secret Manager

Google Cloud Secret Manager can also work as the KBS resource storage backend. Build KBS with the gcp feature flag enabled. Resources are stored as Secret Manager secrets and fetched via AccessSecretVersion.

A resource URI of kbs:///repo/type/tag is translated into the Secret Manager version projects/<project_id>/secrets/<tag>/versions/latest. The repo/type portion is ignored and the latest enabled version is served — matching the behavior of the AWS and Aliyun KMS backends.

Credentials are resolved via Application Default Credentials (ADC): the GOOGLE_APPLICATION_CREDENTIALS env var, gcloud auth application-default login, or the GCE/GKE/Cloud Run metadata server (workload identity).

This backend is read-only. Writes and deletes return an error — provision and rotate secrets via GCP APIs.

You can smoke-test it against a real project:

gcloud secrets create my-test --replication-policy=automatic
echo -n "hello" | gcloud secrets versions add my-test --data-file=-
# Configure KBS with storage_backend_type = "gcp" and project_id, then fetch
# the resource kbs:///default/default/my-test

Hashicorp Vault Backend

Vault KV secrets engine backend