Supported KMS providers

Trusted Artifact Signer components support multiple KMS providers including AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, and OpenBao, each with specific URI formats and authentication requirements.

All three Trusted Artifact Signer components (Rekor, Fulcio, and Timestamp Authority) support the same set of KMS providers using consistent URI formats and authentication mechanisms.

Table 1. Supported KMS providers and authentication requirements
Provider URI Format Auth Variables Notes

AWS KMS

awskms:///KEY_ID or awskms://ENDPOINT/KEY_ID
  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • AWS_REGION

AWS credentials for KMS access. The IAM user or role must have kms:Sign and kms:GetPublicKey permissions on the specified key. Supports both AWS-managed and customer-managed keys.

GCP KMS

gcpkms://projects/P/locations/L/keyRings/R/cryptoKeys/K/cryptoKeyVersions/V

  • GOOGLE_APPLICATION_CREDENTIALS

Path to a GCP service account JSON key file. The service account must have the Cloud KMS Signer role. Mount the credentials file using spec.<component>.auth.secretMount and set the variable to the mounted path (for example, /var/run/secrets/tas/auth/credentials.json).

Azure Key Vault

azurekms://VAULT_NAME.vault.azure.net/KEY_NAME or azurekms://VAULT_NAME.vault.azure.net/KEY_NAME/KEY_VERSION
  • AZURE_TENANT_ID
  • AZURE_CLIENT_ID
  • AZURE_CLIENT_SECRET

Azure service principal credentials. The service principal must have Sign permission on the key vault. The identity must have key signing permissions.

HashiCorp Vault

hashivault://KEY_NAME

  • VAULT_ADDR
  • VAULT_TOKEN
  • TRANSIT_SECRET_ENGINE_PATH (optional)

Vault server address and authentication token. The Transit secrets engine must be enabled. The token must have permissions to use the Transit secrets engine for signing operations. Set TRANSIT_SECRET_ENGINE_PATH only if using a non-default mount path.

OpenBao

openbao://KEY_NAME

  • VAULT_ADDR or BAO_ADDR
  • VAULT_TOKEN or BAO_TOKEN
  • TRANSIT_SECRET_ENGINE_PATH (optional)

OpenBao is a fork of HashiCorp Vault and uses the native openbao:// scheme. OpenBao server address and authentication token. The Transit secrets engine must be enabled. OpenBao checks VAULT_ADDR first, then falls back to BAO_ADDR (same for token). Set TRANSIT_SECRET_ENGINE_PATH only if using a non-default mount path.
Important

Configure authentication variables in the auth.env section of your component configuration. Store all authentication credentials as Kubernetes Secrets and reference them by using secretKeyRef in the component auth.env configuration. Never embed credentials directly in the custom resource YAML.

GCP KMS configuration pattern
Copy link

GCP KMS differs from other providers because it requires a service account JSON file rather than environment variables with credential values. This requires using the auth.secretMount field to mount the file into the pod, then setting GOOGLE_APPLICATION_CREDENTIALS to point to the mounted path.

The following example shows the GCP KMS configuration pattern that applies to all three components (Rekor, Fulcio, and Timestamp Authority):

spec:
  COMPONENT:
    signer:
      type: kms
      kms:
        keyResource: "gcpkms://projects/PROJECT_ID/locations/LOCATION/keyRings/KEYRING/cryptoKeys/KEY/cryptoKeyVersions/VERSION"
    auth:
      secretMount:
        - name: gcp-credentials
          key: gcp-sa.json
      env:
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: "/var/run/secrets/tas/auth/gcp-sa.json"

where:

COMPONENT
The component you are configuring: rekor, fulcio, or tsa.
PROJECT_ID
Your GCP project ID.
LOCATION
The GCP region or location where your key ring is located. For example: us-east1.
KEYRING
The name of your key ring.
KEY
The name of your crypto key.
VERSION
The version of your crypto key.
auth.secretMount
Mounts the service account JSON file into the pod at /var/run/secrets/tas/auth/. The key field must match the key used when creating the Secret.
GOOGLE_APPLICATION_CREDENTIALS
Points to the mounted service account JSON file path. Unlike other providers, GCP requires a file path, not credential values in environment variables.
Note

For Fulcio and Timestamp Authority, you must also configure the certificateChain.certificateChainRef field within the signer configuration (alongside kms) in addition to the auth configuration shown earlier in this topic.