EKM public facing endpoints #38258
EKM public facing endpoints #38258
Conversation
vasanthrajams
requested review from
a team,
cheathamb36,
chen-karen,
chlowell,
heaths and
vickm
as code owners
Next Steps to MergeNext steps that must be taken to merge this PR:
Comment generated by summarize-checks workflow run. |
API Change CheckAPIView identified API level changes in this PR and created the following API reviews
|
| /** | ||
| * The External Key Manager (EKM) Get operation returns EKM connection. This operation requires ekm/read permission. | ||
| */ | ||
| #suppress "@azure-tools/typespec-azure-core/use-standard-operations" "Foundations.Operation is necessary for Key Vault" |
There was a problem hiding this comment.
For older endpoints, yes. Why can't you use them for new endpoints? While it's important to maintain consistency within a service, you weren't far off from what standard operation bases provide in terms of endpoint construction. Did you even try?
| */ | ||
| model EkmProxyInfo { | ||
| /** | ||
| * The highest supported proxy interface api version supported by the EKM proxy. |
There was a problem hiding this comment.
duplicate word.. you can say "The highest version of proxy interface API supported by the EKM Proxy"
| */ | ||
| model EkmConnection { | ||
| /** | ||
| * EKM proxy FQDM (Fully Qualified Domain Name). Only allowed characters are a-z, A-Z, 0-9, hyphen (-), dot (.), and colon (:). |
| "host": "ekm-proxy.contoso.com", | ||
| "path_prefix": "/api/v1", | ||
| "server_ca_certificates": [ | ||
| "MIIDXTCCAkWgAwIBAgIJAKJ5cT5dQnCuMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA", |
There was a problem hiding this comment.
Are these valid DER format strings?
I tried wrapping them in a PEM headers (BEGIN/END CERTIFICATE), but couldn't open the resulting cer file.
| @@ -0,0 +1,19 @@ | |||
| { | |||
| "parameters": { | |||
| "vaultBaseUrl": "https://myvault.vault.azure.net/", | |||
There was a problem hiding this comment.
Use managed hsm base urls in these example files.
| "responses": { | ||
| "200": { | ||
| "body": { | ||
| "host": "ekm-proxy.contoso.com:8443", |
There was a problem hiding this comment.
remove the port.. just to be consistent with the createekmconnection example.
3 participants
Introducing External Key manager functionality