feat(KMS): cli integration#835
Conversation
There was a problem hiding this comment.
I am not entirely convinced by the way the operations are defined here. The separation between operations on a "key" and operations on a "rotation" doesn't match the logic of our API. It essentially treats "rotation" as a resource in itself, when it is actually an operation on a key.
On one hand, we have key lifecycle operations, where you operate directly on a key to change its state: in that case, it makes sense to have a command like kms key . On the other hand, we have cryptographic operations that use these keys to perform tasks unrelated to the key's state. For those, I would expect something like kms <crypto-op> --key <id > <required-params>.
Additionally, in the current split, rotation commands are spread across two different categories, which is confusing (e.g., kms rotation <> and kms key rotate <>).
Lastly, you are using the keyword "delete" for the schedule-key-deletion operation. I think the command should clearly reflect that it is a schedule and not an immediate deletion. Users will surely be confused by this.
|
Also keep in mind that command organization should follow Portal design and vice versa. |
| func (c *cryptoReencryptCmd) CmdShort() string { | ||
| return "Re-encrypts data from a KMS key to another KMS key." | ||
| } | ||
|
|
||
| func (c *cryptoReencryptCmd) CmdLong() string { | ||
| return "Re-encrypts data from a KMS key to another KMS key." | ||
| } |
There was a problem hiding this comment.
Applicable for all commands (except when the command is augmented with increase filtering capabilities): please use the same description as the ones on our API spec.
https://community.exoscale.com/reference/api/kms/cryptographic-operations/
3 participants
Description
Commands added:
All commands have a
--zoneflag to easily target another zone.key:
kms key show IDkms key list --ignore-replica --status XXXkms key create NAME --usage encrypt-decrypt --description XXX --multizonekms key enable IDkms key disable IDkms key rotate IDkms key delete ID --delay-days XXXkms key cancel-delete IDkms key replicate ID ZONEkms key enable-rotation ID --rotation-period XXXkms key disable-rotation IDkms key list-rotation IDcrypto
kms crypto encrypt ID PLAINTEXT --encryption-context XXXkms crypto decrypt ID CIPHERTEXT --encryption-context XXXkms crypto generate-data-key ID <--bytes-count XXX | --key-spec XXX> --encryption-context XXXkms crypto reencrypt SRC_ID DEST_ID CIPHERTEXT --source-encryption-context XXX --dest-encryption-context XXXOutput
kms key listkms key show IDkms key list-rotation IDChecklist
(For exoscale contributors)
CHANGELOG.md)Testing
Tested in preprod with
go run main.go kms ...