Merge pull request #3079 from Infisical/feat/kmip-client-management

feat: kmip
2026-10-15 11:38:55 +00:00 · 2025-02-20 17:53:15 +08:00
parent d980d471e8 2c31ac0569
commit d80a104f7b
84 changed files with 5002 additions and 71 deletions
@@ -94,6 +94,15 @@ export const LogsFilter = ({
            {actor.metadata.name}
          </SelectItem>
        );
+      case ActorType.KMIP_CLIENT:
+        return (
+          <SelectItem
+            value={`${actor.type}-${actor.metadata.clientId}`}
+            key={`kmip-client-filter-${actor.metadata.clientId}`}
+          >
+            {actor.metadata.name}
+          </SelectItem>
+        );
      default:
        return (
          <SelectItem value="actor-none" key="actor-none">
@@ -46,6 +46,13 @@ export const LogsTableRow = ({ auditLog, isOrgAuditLogs, showActorColumn }: Prop
            <p>Platform</p>
          </Td>
        );
+      case ActorType.KMIP_CLIENT:
+        return (
+          <Td>
+            <p>{actor.metadata.name}</p>
+            <p>KMIP Client</p>
+          </Td>
+        );
      case ActorType.UNKNOWN_USER:
        return (
          <Td>
@@ -2,7 +2,10 @@
 import { z } from "zod";

 import { OrgPermissionSubjects } from "@app/context";
-import { OrgPermissionAppConnectionActions } from "@app/context/OrgPermissionContext/types";
+import {
+  OrgPermissionAppConnectionActions,
+  OrgPermissionKmipActions
+} from "@app/context/OrgPermissionContext/types";
 import { TPermission } from "@app/hooks/api/roles/types";

 const generalPermissionSchema = z
@@ -24,6 +27,13 @@ const appConnectionsPermissionSchema = z
  })
  .optional();

+const kmipPermissionSchema = z
+  .object({
+    [OrgPermissionKmipActions.Proxy]: z.boolean().optional(),
+    [OrgPermissionKmipActions.Setup]: z.boolean().optional()
+  })
+  .optional();
+
 const adminConsolePermissionSchmea = z
  .object({
    "access-all-projects": z.boolean().optional()
@@ -61,7 +71,8 @@ export const formSchema = z.object({
      "organization-admin-console": adminConsolePermissionSchmea,
      [OrgPermissionSubjects.Kms]: generalPermissionSchema,
      [OrgPermissionSubjects.ProjectTemplates]: generalPermissionSchema,
-      "app-connections": appConnectionsPermissionSchema
+      "app-connections": appConnectionsPermissionSchema,
+      kmip: kmipPermissionSchema
    })
    .optional()
 });
@@ -0,0 +1,133 @@
+import { useEffect, useMemo } from "react";
+import { Control, Controller, UseFormSetValue, useWatch } from "react-hook-form";
+import { faChevronDown, faChevronRight } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { createNotification } from "@app/components/notifications";
+import { Checkbox, Select, SelectItem, Td, Tr } from "@app/components/v2";
+import { useToggle } from "@app/hooks";
+
+import { TFormSchema } from "../OrgRoleModifySection.utils";
+
+type Props = {
+  isEditable: boolean;
+  setValue: UseFormSetValue<TFormSchema>;
+  control: Control<TFormSchema>;
+};
+
+enum Permission {
+  NoAccess = "no-access",
+  Custom = "custom"
+}
+
+const PERMISSION_ACTIONS = [
+  { action: "proxy", label: "Proxy KMIP requests" },
+  { action: "setup", label: "Setup KMIP" }
+] as const;
+
+export const OrgPermissionKmipRow = ({ isEditable, control, setValue }: Props) => {
+  const [isRowExpanded, setIsRowExpanded] = useToggle();
+  const [isCustom, setIsCustom] = useToggle();
+
+  const rule = useWatch({
+    control,
+    name: "permissions.kmip"
+  });
+
+  const selectedPermissionCategory = useMemo(() => {
+    if (rule?.proxy || rule?.setup) {
+      return Permission.Custom;
+    }
+    return Permission.NoAccess;
+  }, [rule, isCustom]);
+
+  useEffect(() => {
+    if (selectedPermissionCategory === Permission.Custom) setIsCustom.on();
+    else setIsCustom.off();
+  }, [selectedPermissionCategory]);
+
+  useEffect(() => {
+    const isRowCustom = selectedPermissionCategory === Permission.Custom;
+    if (isRowCustom) {
+      setIsRowExpanded.on();
+    }
+  }, []);
+
+  const handlePermissionChange = (val: Permission) => {
+    if (!val) return;
+    if (val === Permission.Custom) {
+      setIsRowExpanded.on();
+      setIsCustom.on();
+      return;
+    }
+    setIsCustom.off();
+
+    if (val === Permission.NoAccess) {
+      setValue("permissions.kmip", { proxy: false, setup: false }, { shouldDirty: true });
+    }
+  };
+
+  return (
+    <>
+      <Tr
+        className="h-10 cursor-pointer transition-colors duration-100 hover:bg-mineshaft-700"
+        onClick={() => setIsRowExpanded.toggle()}
+      >
+        <Td>
+          <FontAwesomeIcon icon={isRowExpanded ? faChevronDown : faChevronRight} />
+        </Td>
+        <Td>KMIP</Td>
+        <Td>
+          <Select
+            value={selectedPermissionCategory}
+            className="w-40 bg-mineshaft-600"
+            dropdownContainerClassName="border border-mineshaft-600 bg-mineshaft-800"
+            onValueChange={handlePermissionChange}
+            isDisabled={!isEditable}
+          >
+            <SelectItem value={Permission.NoAccess}>No Access</SelectItem>
+            <SelectItem value={Permission.Custom}>Custom</SelectItem>
+          </Select>
+        </Td>
+      </Tr>
+      {isRowExpanded && (
+        <Tr>
+          <Td
+            colSpan={3}
+            className={`bg-bunker-600 px-0 py-0 ${isRowExpanded && "border-mineshaft-500 p-8"}`}
+          >
+            <div className="grid grid-cols-3 gap-4">
+              {PERMISSION_ACTIONS.map(({ action, label }) => {
+                return (
+                  <Controller
+                    name={`permissions.kmip.${action}`}
+                    key={`permissions.kmip.${action}`}
+                    control={control}
+                    render={({ field }) => (
+                      <Checkbox
+                        isChecked={field.value}
+                        onCheckedChange={(e) => {
+                          if (!isEditable) {
+                            createNotification({
+                              type: "error",
+                              text: "Failed to update default role"
+                            });
+                            return;
+                          }
+                          field.onChange(e);
+                        }}
+                        id={`permissions.kmip.${action}`}
+                      >
+                        {label}
+                      </Checkbox>
+                    )}
+                  />
+                );
+              })}
+            </div>
+          </Td>
+        </Tr>
+      )}
+    </>
+  );
+};
@@ -74,7 +74,7 @@ type Props = {
  title: string;
  formName: keyof Omit<
    Exclude<TFormSchema["permissions"], undefined>,
-    "workspace" | "organization-admin-console"
+    "workspace" | "organization-admin-console" | "kmip"
  >;
  setValue: UseFormSetValue<TFormSchema>;
  control: Control<TFormSchema>;
@@ -14,6 +14,7 @@ import {
  TFormSchema
 } from "../OrgRoleModifySection.utils";
 import { OrgPermissionAdminConsoleRow } from "./OrgPermissionAdminConsoleRow";
+import { OrgPermissionKmipRow } from "./OrgPermissionKmipRow";
 import { OrgRoleWorkspaceRow } from "./OrgRoleWorkspaceRow";
 import { RolePermissionRow } from "./RolePermissionRow";

@@ -180,6 +181,11 @@ export const RolePermissionsSection = ({ roleId }: Props) => {
                setValue={setValue}
                isEditable={isCustomRole}
              />
+              <OrgPermissionKmipRow
+                control={control}
+                setValue={setValue}
+                isEditable={isCustomRole}
+              />
            </TBody>
          </Table>
        </TableContainer>
@@ -0,0 +1,268 @@
+import { Controller, useForm } from "react-hook-form";
+import { faCheck, faCopy, faDownload } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  FormControl,
+  IconButton,
+  Modal,
+  ModalContent,
+  Select,
+  SelectItem,
+  Spinner,
+  TextArea,
+  Tooltip
+} from "@app/components/v2";
+import { useOrganization, useSubscription } from "@app/context";
+import { downloadTxtFile } from "@app/helpers/download";
+import { usePopUp, useTimedReset } from "@app/hooks";
+import { certKeyAlgorithms } from "@app/hooks/api/certificates/constants";
+import { CertKeyAlgorithm } from "@app/hooks/api/certificates/enums";
+import { useGetOrgKmipConfig, useSetupOrgKmip } from "@app/hooks/api/kmip";
+import { OrgKmipConfig } from "@app/hooks/api/kmip/types";
+
+const orgConfigFormSchema = z.object({
+  caKeyAlgorithm: z.nativeEnum(CertKeyAlgorithm)
+});
+
+type TKmipOrgConfigForm = z.infer<typeof orgConfigFormSchema>;
+
+const OrgConfigSection = ({
+  kmipConfig,
+  isKmipConfigLoading
+}: {
+  kmipConfig?: OrgKmipConfig;
+  isKmipConfigLoading: boolean;
+}) => {
+  const { popUp, handlePopUpToggle, handlePopUpClose, handlePopUpOpen } = usePopUp([
+    "configureKmip",
+    "upgradePlan"
+  ] as const);
+  const { subscription } = useSubscription();
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting }
+  } = useForm<TKmipOrgConfigForm>({
+    resolver: zodResolver(orgConfigFormSchema)
+  });
+
+  const { currentOrg } = useOrganization();
+  const { mutateAsync: setupOrgKmip } = useSetupOrgKmip(currentOrg.id);
+
+  const onFormSubmit = async (formData: TKmipOrgConfigForm) => {
+    await setupOrgKmip(formData);
+
+    createNotification({
+      type: "success",
+      text: "Successfully configured KMIP"
+    });
+
+    handlePopUpClose("configureKmip");
+  };
+  const [copyTextClientCertificate, isCopyingClientCertificate, setCopyTextClientCertificate] =
+    useTimedReset<string>({
+      initialState: "Copy to clipboard"
+    });
+
+  const [copyTextServerCertificate, isCopyingServerCertificate, setCopyTextServerCertificate] =
+    useTimedReset<string>({
+      initialState: "Copy to clipboard"
+    });
+
+  return (
+    <>
+      <div className="flex flex-col justify-start">
+        <div className="mb-2 text-xl font-semibold text-mineshaft-100">KMIP configuration</div>
+        {isKmipConfigLoading && (
+          <div className="mt-8 flex justify-center">
+            <Spinner />
+          </div>
+        )}
+        {!isKmipConfigLoading && kmipConfig && (
+          <>
+            <div className="mt-2">
+              <div className="text-lg">Certificate Chain for KMIP Clients</div>
+              <div className="mt-2 max-w-lg text-sm text-mineshaft-400">
+                This certificate chain is used by KMIP clients to verify the identity of the KMIP
+                server. It should be presented by the server during TLS authentication to establish
+                a secure and encrypted connection.
+              </div>
+              <div className="flex max-w-2xl">
+                <div className="flex w-full justify-end">
+                  <Tooltip content={copyTextClientCertificate}>
+                    <IconButton
+                      ariaLabel="copy icon"
+                      colorSchema="secondary"
+                      className="group relative"
+                      onClick={() => {
+                        navigator.clipboard.writeText(kmipConfig.serverCertificateChain);
+                        setCopyTextClientCertificate("Copied");
+                      }}
+                    >
+                      <FontAwesomeIcon icon={isCopyingClientCertificate ? faCheck : faCopy} />
+                    </IconButton>
+                  </Tooltip>
+                  <Tooltip content="Download">
+                    <IconButton
+                      ariaLabel="copy icon"
+                      colorSchema="secondary"
+                      className="group relative ml-2"
+                      onClick={() => {
+                        downloadTxtFile("ca-chain.pem", kmipConfig.serverCertificateChain);
+                      }}
+                    >
+                      <FontAwesomeIcon icon={faDownload} />
+                    </IconButton>
+                  </Tooltip>
+                </div>
+              </div>
+              <TextArea
+                value={kmipConfig.serverCertificateChain}
+                reSize="none"
+                className="mt-2 h-48 max-w-2xl"
+              />
+            </div>
+            <div className="mt-8">
+              <div className="text-lg">Certificate Chain for KMIP Server</div>
+              <div className="mt-2 max-w-lg text-sm text-mineshaft-400">
+                This certificate chain is used by the KMIP server to verify the identity of KMIP
+                clients. It should be configured on the server to establish trust in client
+                certificates during mutual TLS authentication.
+              </div>
+              <div className="flex max-w-2xl">
+                <div className="flex w-full justify-end">
+                  <Tooltip content={copyTextServerCertificate}>
+                    <IconButton
+                      ariaLabel="copy icon"
+                      colorSchema="secondary"
+                      className="group relative"
+                      onClick={() => {
+                        navigator.clipboard.writeText(kmipConfig.clientCertificateChain);
+                        setCopyTextServerCertificate("Copied");
+                      }}
+                    >
+                      <FontAwesomeIcon icon={isCopyingServerCertificate ? faCheck : faCopy} />
+                    </IconButton>
+                  </Tooltip>
+                  <Tooltip content="Download">
+                    <IconButton
+                      ariaLabel="copy icon"
+                      colorSchema="secondary"
+                      className="group relative ml-2"
+                      onClick={() => {
+                        downloadTxtFile("ca-chain.pem", kmipConfig.clientCertificateChain);
+                      }}
+                    >
+                      <FontAwesomeIcon icon={faDownload} />
+                    </IconButton>
+                  </Tooltip>
+                </div>
+              </div>
+              <TextArea
+                value={kmipConfig.clientCertificateChain}
+                reSize="none"
+                className="mt-2 h-48 max-w-2xl"
+              />
+            </div>
+          </>
+        )}
+        {!isKmipConfigLoading && !kmipConfig && (
+          <div className="mt-2">
+            <div>KMIP has not yet been configured for the organization.</div>
+            <Button
+              className="mt-2"
+              onClick={() => {
+                if (subscription && !subscription.kmip) {
+                  handlePopUpOpen("upgradePlan");
+                  return;
+                }
+
+                handlePopUpOpen("configureKmip");
+              }}
+            >
+              Setup KMIP
+            </Button>
+          </div>
+        )}
+      </div>
+      <Modal
+        isOpen={popUp.configureKmip.isOpen}
+        onOpenChange={(state) => handlePopUpToggle("configureKmip", state)}
+      >
+        <ModalContent title="Configure KMIP for the organization">
+          <form onSubmit={handleSubmit(onFormSubmit)}>
+            <Controller
+              control={control}
+              name="caKeyAlgorithm"
+              defaultValue={CertKeyAlgorithm.RSA_2048}
+              render={({ field: { onChange, ...field }, fieldState: { error } }) => (
+                <FormControl
+                  label="CA Key Algorithm"
+                  errorText={error?.message}
+                  isError={Boolean(error)}
+                  helperText="This defines the key algorithm used for generating the KMIP Root CA and Intermediate CAs, which sign all KMIP server and client certificates."
+                >
+                  <Select
+                    defaultValue={field.value}
+                    {...field}
+                    onValueChange={(e) => onChange(e)}
+                    className="w-full"
+                  >
+                    {certKeyAlgorithms.map(({ label, value }) => (
+                      <SelectItem value={String(value || "")} key={label}>
+                        {label}
+                      </SelectItem>
+                    ))}
+                  </Select>
+                </FormControl>
+              )}
+            />
+            <div className="mt-6 flex w-full gap-4">
+              <Button
+                className=""
+                size="sm"
+                type="submit"
+                isLoading={isSubmitting}
+                isDisabled={isSubmitting}
+              >
+                Continue
+              </Button>
+              <Button
+                className=""
+                size="sm"
+                variant="outline_bg"
+                type="button"
+                onClick={() => handlePopUpClose("configureKmip")}
+              >
+                Cancel
+              </Button>
+            </div>
+          </form>
+        </ModalContent>
+      </Modal>
+      <UpgradePlanModal
+        isOpen={popUp.upgradePlan.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}
+        text="KMIP requires an enterprise plan."
+      />
+    </>
+  );
+};
+
+export const KmipTab = () => {
+  const { currentOrg } = useOrganization();
+  const { data: kmipConfig, isPending } = useGetOrgKmipConfig(currentOrg.id);
+
+  return (
+    <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
+      <OrgConfigSection kmipConfig={kmipConfig} isKmipConfigLoading={isPending} />
+    </div>
+  );
+};
@@ -6,6 +6,7 @@ import { ROUTE_PATHS } from "@app/const/routes";

 import { AuditLogStreamsTab } from "../AuditLogStreamTab";
 import { ImportTab } from "../ImportTab";
+import { KmipTab } from "../KmipTab/OrgKmipTab";
 import { OrgAuthTab } from "../OrgAuthTab";
 import { OrgEncryptionTab } from "../OrgEncryptionTab";
 import { OrgGeneralTab } from "../OrgGeneralTab";
@@ -27,7 +28,8 @@ export const OrgTabGroup = () => {
    },
    { name: "Audit Log Streams", key: "tag-audit-log-streams", component: AuditLogStreamsTab },
    { name: "Import", key: "tab-import", component: ImportTab },
-    { name: "Project Templates", key: "project-templates", component: ProjectTemplatesTab }
+    { name: "Project Templates", key: "project-templates", component: ProjectTemplatesTab },
+    { name: "KMIP", key: "kmip", component: KmipTab }
  ];

  const [selectedTab, setSelectedTab] = useState(search.selectedTab || tabs[0].key);