Feat/k8s kms plugin by p0wline · Pull Request #999 · Cosmian/kms

p0wline · 2026-06-12T09:50:01Z

No description provided.

p0wline · 2026-06-16T07:47:04Z

@copilot resolve the merge conflicts in this pull request

Copilot · 2026-06-16T07:48:57Z

@copilot resolve the merge conflicts in this pull request

Done — merged main (5.23.0) into this branch. The merge was clean with no conflicts. Merge commit: b634f5a.

Copilot

Pull request overview

Adds a new Kubernetes KMS v2 provider plugin binary (cosmian-kms-plugin) to let kube-apiserver delegate Encrypt/Decrypt operations to Cosmian KMS (via KMIP), along with documentation, test vectors, and Nix vendor-hash updates.

Changes:

Introduces cosmian_kms_k8s_plugin crate (gRPC service, YAML config, build-time proto generation).
Adds integration docs + MkDocs navigation entry for the Kubernetes plugin.
Adds a KMS test vector runner entry for the plugin flow and updates Nix expected vendor hashes / Cargo.lock.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`nix/expected-hashes/ui.vendor.non-fips.sha256`	Updates UI vendor hash for Nix builds.
`nix/expected-hashes/ui.vendor.fips.sha256`	Updates UI vendor hash for Nix builds.
`nix/expected-hashes/server.vendor.static.sha256`	Updates server vendor hash for Nix builds.
`nix/expected-hashes/cli.vendor.linux.sha256`	Updates CLI vendor hash for Nix builds.
`documentation/mkdocs.yml`	Adds the Kubernetes plugin page to site navigation.
`documentation/docs/integrations/kubernetes_kms_plugin.md`	New integration documentation for the Kubernetes KMS v2 plugin.
`crate/test_kms_server/src/vector_runner.rs`	Registers a new test vector for the plugin wrap/unwrap flow.
`crate/clients/k8s_plugin/src/service.rs`	Implements the KMS v2 gRPC service delegating to `KmsClient` KMIP Encrypt/Decrypt.
`crate/clients/k8s_plugin/src/main.rs`	Adds CLI entrypoint: loads config, binds Unix socket, serves tonic gRPC.
`crate/clients/k8s_plugin/src/kmsv2.proto`	Adds the Kubernetes KMS v2 proto definition (Apache 2.0 source).
`crate/clients/k8s_plugin/src/integration_tests.rs`	New end-to-end test: spins up test KMS + plugin and checks Status/Encrypt/Decrypt.
`crate/clients/k8s_plugin/src/error.rs`	Introduces plugin error type and maps it to `tonic::Status`.
`crate/clients/k8s_plugin/src/config.rs`	Adds YAML config schema + loader for the plugin.
`crate/clients/k8s_plugin/Cargo.toml`	New crate manifest (deps: tonic/prost/protox, serde_yaml, etc.).
`crate/clients/k8s_plugin/build.rs`	Generates tonic bindings from the proto at build time (protox-based).
`Cargo.toml`	Adds the new crate to the workspace members list.
`Cargo.lock`	Locks new dependencies pulled in by the plugin (tonic-build/protox/etc.).

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…HEL, macOS, Windows/WSL2, k3s, kind)

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 12 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…ng deps to operator, fix machete false positives

…r hashes

# Conflicts: # .github/workflows/packaging.yml # .github/workflows/test_all.yml # Cargo.lock # nix/expected-hashes/cli.vendor.linux.sha256 # test_data

Fixes WASM build failure on wasm32-unknown-unknown caused by tracing-appender 0.2.5 depending on the symlink crate (not available on wasm32). Resolves #1002.

Use cosmian_logger (already a workspace dependency) with features=["full"] in the k8s plugin and operator, reading standard OpenTelemetry env vars: - OTEL_EXPORTER_OTLP_ENDPOINT: enables OTLP export when set - OTEL_SERVICE_NAME: service name reported to the collector (operator only) - RUST_LOG / --log-level: log verbosity (plugin) Avoids introducing a git dependency with a rust-version constraint incompatible with the workspace toolchain (1.91.0 vs 1.94.1). A cosmian_logger 0.7.3 release adding init_tracing() is tracked in Cosmian/http_client_server#21. Closes #1002

# Conflicts: # nix/expected-hashes/server.vendor.static.sha256 # nix/expected-hashes/ui.vendor.non-fips.sha256

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 21 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

p0wline force-pushed the feat/k8s-kms-plugin branch 2 times, most recently from c5e3675 to 2317356 Compare June 15, 2026 13:03

Copilot started work on behalf of p0wline June 16, 2026 07:47 View session

Copilot finished work on behalf of p0wline June 16, 2026 07:49

p0wline force-pushed the feat/k8s-kms-plugin branch 2 times, most recently from 10eef1b to dc6f4ba Compare June 16, 2026 08:59

p0wline requested a review from Manuthor June 16, 2026 12:03

Copilot started work on behalf of p0wline June 16, 2026 12:41 View session

Copilot finished work on behalf of p0wline June 16, 2026 12:42

Cosmian deleted a comment from Copilot AI Jun 16, 2026

p0wline closed this Jun 16, 2026

Cosmian deleted a comment from Copilot AI Jun 16, 2026

p0wline reopened this Jun 16, 2026

p0wline requested a review from Copilot June 16, 2026 13:11

Copilot started reviewing on behalf of p0wline June 16, 2026 13:11 View session

Copilot AI reviewed Jun 16, 2026

View reviewed changes

p0wline and others added 6 commits June 19, 2026 10:20

add plugin

0850bb7

chore: update test_data submodule pointer (k8s plugin vectors)

ee3451d

fix: use protox in build.rs to avoid requiring protoc binary in CI

7d2fb6e

feat: add cosmian_kms_k8s_operator crate and fix k8s plugin

719f304

Potential fix for pull request finding

9c21074

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

docs: expand k8s KMS plugin doc for multi-platform (Ubuntu, Debian, R…

10119df

…HEL, macOS, Windows/WSL2, k3s, kind)

p0wline force-pushed the feat/k8s-kms-plugin branch from 2bbd24f to 10119df Compare June 19, 2026 08:21

p0wline requested a review from Copilot June 19, 2026 08:22

Copilot started reviewing on behalf of p0wline June 19, 2026 08:22 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

p0wline and others added 2 commits June 19, 2026 10:34

fix(ci): run actions/checkout before local install-mise action

f919694

Potential fix for pull request finding

8f941c9

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

p0wline and others added 14 commits June 19, 2026 10:37

Potential fix for pull request finding

6c96cb4

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

74fafef

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

a9f1abc

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

6b2ca15

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

27fc949

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

b6034ab

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

78e50db

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

fix: remove unused webhook_config_name from operator config

adeb15f

fix: resolve conflicts

23ff46a

fix: resolve conflicts

0090e56

fix(clippy,deps): fix items_after_statements in k8s plugin, add missi…

5eaea44

…ng deps to operator, fix machete false positives

fix(ci): restore checkout-before-install-mise order; update Nix vendo…

dd17d29

…r hashes

Merge remote-tracking branch 'origin/develop' into feat/k8s-kms-plugin

78566ec

# Conflicts: # .github/workflows/packaging.yml # .github/workflows/test_all.yml # Cargo.lock # nix/expected-hashes/cli.vendor.linux.sha256 # test_data

build(deps): bump cosmian_logger to 0.7.2 for WASM/k8s compatibility

c08f4bd

Fixes WASM build failure on wasm32-unknown-unknown caused by tracing-appender 0.2.5 depending on the symlink crate (not available on wasm32). Resolves #1002.

p0wline mentioned this pull request Jun 23, 2026

feat(logger): add init_tracing() for Kubernetes OTLP deployments (v0.7.3) Cosmian/http_client_server#21

Open

p0wline added 2 commits June 23, 2026 15:37

Merge remote-tracking branch 'origin/develop' into feat/k8s-kms-plugin

313c72d

# Conflicts: # nix/expected-hashes/server.vendor.static.sha256 # nix/expected-hashes/ui.vendor.non-fips.sha256

p0wline requested a review from Copilot June 23, 2026 14:26

Copilot started reviewing on behalf of p0wline June 23, 2026 14:26 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

p0wline and others added 3 commits June 23, 2026 16:46

Apply suggestions from code review

bcd1ccb

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

83e827a

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

00b8a6b

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Conversation

p0wline commented Jun 12, 2026

Uh oh!

p0wline commented Jun 16, 2026

Uh oh!

Copilot AI commented Jun 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants