Method EncryptContext

hckms/keysource.go:142–172

EncryptContext takes a SOPS data key, encrypts it with HuaweiCloud KMS and stores the result in the EncryptedKey field.

(ctx context.Context, dataKey []byte)

// EncryptContext takes a SOPS data key, encrypts it with HuaweiCloud KMS and stores the result
// in the EncryptedKey field.
func (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {
	client, err := key.createKMSClient(ctx)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Encryption failed")
		return fmt.Errorf("failed to create HuaweiCloud KMS client: %w", err)
	}

	plaintext := base64.StdEncoding.EncodeToString(dataKey)
	encryptAlgorithm := model.GetEncryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT

	request := &model.EncryptDataRequest{
		Body: &model.EncryptDataRequestBody{
			KeyId:               key.KeyUUID,
			PlainText:           plaintext,
			EncryptionAlgorithm: &encryptAlgorithm,
		},
	}

	response, err := client.EncryptData(request)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Encryption failed")
		return fmt.Errorf("failed to encrypt sops data key with HuaweiCloud KMS: %w", err)
	}

	if response.CipherText == nil {
		return fmt.Errorf("encryption response missing ciphertext")
	}
	key.EncryptedKey = *response.CipherText
	log.WithField("keyID", key.KeyID).Info("Encryption succeeded")
	return nil
}

// EncryptIfNeeded encrypts the provided SOPS data key, if it has not been
// encrypted yet.