feat: KMIP server certificate auto-renewal token refresh - #354
Open
bernie-g wants to merge 12 commits into
Open
Conversation
Bumps infisical-kmip to the auto-renewal version (pseudo-version off the feature branch; swap for the release tag once it lands). enrollKmipServer now also returns a refresh function passed to the server as RefreshAccessToken: AWS enrollment re-authenticates via STS and persists the new token, token enrollment has no refresh since enrollment tokens are single-use.
|
💬 Discussion in Slack: #pr-review-cli-354-feat-kmip-server-certificate-auto-renewal-token-refresh Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
1 task
Contributor
|
| Filename | Overview |
|---|---|
| packages/cmd/kmip.go | Wires the new refresh hook into the KMIP server and implements AWS re-authentication with best-effort token persistence; no actionable changed-code defect was established. |
| go.mod | Upgrades infisical-kmip to the pseudo-version containing certificate auto-renewal support. |
| go.sum | Updates checksums consistently for the infisical-kmip version bump. |
Reviews (1): Last reviewed commit: "feat: wire KMIP server certificate auto-..." | Re-trigger Greptile
carlosmonastyrski
requested changes
Aug 6, 2026
…starts The refresh closure's HTTP client and STS login now have deadlines so a hung API call cannot stall certificate renewal. A flagless restart of an AWS-enrolled server (stored-token path) now detects the persisted server ID and wires the same refresh function, so it can still recover from a rejected token.
LoadStoredServerID falls back to INFISICAL_KMIP_SERVER_ID, so a token-enrolled server whose environment carries that variable was wired for an STS refresh it cannot perform. A rejected token then surfaced as an AWS failure rather than telling the operator to re-enroll. Record the enroll method at enrollment and decide from that. Both reads behind the decision are conf-file only, since the environment says what this run was handed rather than how the server enrolled. Servers enrolled before the method was recorded have a conf-file server ID and no method, so that combination still counts as AWS-enrolled and keeps its refresh. Without that they would silently lose mid-run re-authentication.
Adds the cases the fix has to get right beyond the reported one: never enrolled, an aws method with no server id to refresh with, a stale server id left behind by re-enrolling from aws to token, an environment server id that differs from the recorded one, an unrecognised method, and re-enrollment replacing the recorded method.
…o-renewal-of-kmip-server-certificates
Clears eight advisories against the 1.25.12 standard library. Seven were fixed in 1.25.13, but GO-2026-5942 (a panic parsing malformed SVCB/HTTPS records in the vendored dnsmessage) is only fixed in 1.26.6, and the govulncheck gate allowlists advisories only when no fix exists, so 1.25.13 would still fail it. GO-2026-5932 remains and is already allowlisted: x/crypto/openpgp has no fix and is not in the build graph, still verified by `go list -deps`. Bumped everywhere the version is pinned, not just go.mod, so the release and test workflows build with the same toolchain the scan gate runs against.
e2e is a separate module that replaces the parent, so leaving it on 1.25.12 while the root moved to 1.26.6 made every command there fail with "updates to go.mod needed". Missed it because the root module was already tidy and builds fine on its own.
Drops narration that restated the code: the decision block at the call site, now covered by the named function, a duplicated note on the loader beside it, and test comments the subtest names already say.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description 📣
Bumps infisical-kmip to the version that auto-renews KMIP server TLS certificates (Infisical/infisical-kmip#14) and wires the token refresh hook so AWS-enrolled servers re-authenticate via STS when their access token is rejected. Tested E2E locally against a dev stack with a 3m-TTL certificate.
Type ✨