@@ -42,6 +42,7 @@ import (
4242 grpcmw "github.com/grpc-ecosystem/go-grpc-middleware"
4343 grpc_zap "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap"
4444 grpc_recovery "github.com/grpc-ecosystem/go-grpc-middleware/recovery"
45+ grpc_retry "github.com/grpc-ecosystem/go-grpc-middleware/retry"
4546 grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
4647 "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
4748 "github.com/prometheus/client_golang/prometheus"
@@ -60,11 +61,13 @@ import (
6061 "github.com/sigstore/fulcio/pkg/log"
6162 "github.com/sigstore/fulcio/pkg/server"
6263 "github.com/sigstore/sigstore/pkg/cryptoutils"
64+ "github.com/sigstore/sigstore/pkg/signature/kms/gcp"
6365 "github.com/spf13/cobra"
6466 "github.com/spf13/pflag"
6567 "github.com/spf13/viper"
6668 "go.uber.org/zap"
6769 "goa.design/goa/v3/grpc/middleware"
70+ "google.golang.org/api/option"
6871 "google.golang.org/grpc"
6972 "google.golang.org/grpc/credentials/insecure"
7073 health "google.golang.org/grpc/health/grpc_health_v1"
@@ -103,6 +106,8 @@ func newServeCmd() *cobra.Command {
103106 cmd .Flags ().Bool ("fileca-watch" , true , "Watch filesystem for updates" )
104107 cmd .Flags ().String ("kms-resource" , "" , "KMS key resource path. Must be prefixed with awskms://, azurekms://, gcpkms://, or hashivault://" )
105108 cmd .Flags ().String ("kms-cert-chain-path" , "" , "Path to PEM-encoded CA certificate chain for KMS-backed CA" )
109+ cmd .Flags ().Uint ("gcp-kms-retries" , 0 , "Number of retries for GCP KMS requests" )
110+ cmd .Flags ().Uint ("gcp-kms-timeout" , 0 , "sets the RPC timeout per call for GCP KMS requests in seconds, defaults to 0 (no timeout)" )
106111 cmd .Flags ().String ("tink-kms-resource" , "" , "KMS key resource path for encrypted Tink keyset. Must be prefixed with gcp-kms:// or aws-kms://" )
107112 cmd .Flags ().String ("tink-cert-chain-path" , "" , "Path to PEM-encoded CA certificate chain for Tink-backed CA" )
108113 cmd .Flags ().String ("tink-keyset-path" , "" , "Path to KMS-encrypted keyset for Tink-backed CA" )
@@ -287,7 +292,10 @@ func runServeCmd(cmd *cobra.Command, args []string) { //nolint: revive
287292 if err != nil {
288293 log .Logger .Fatalf ("error loading the PEM certificates from the kms certificate chain from '%s': %v" , viper .GetString ("kms-cert-chain-path" ), err )
289294 }
290- baseca , err = kmsca .NewKMSCA (cmd .Context (), viper .GetString ("kms-resource" ), certs )
295+ opts := make ([]signature.RPCOption , 0 )
296+ callOpts := []grpc_retry.CallOption {grpc_retry .WithMax (viper .GetUint ("gcp-kms-retries" )), grpc_retry .WithPerRetryTimeout (time .Duration (viper .GetUint ("gcp-kms-timeout" )) * time .Second )}
297+ opts = append (opts , gcp .WithGoogleAPIClientOption (option .WithGRPCDialOption (grpc .WithUnaryInterceptor (grpc_retry .UnaryClientInterceptor (callOpts ... )))))
298+ baseca , err = kmsca .NewKMSCA (cmd .Context (), viper .GetString ("kms-resource" ), certs , opts ... )
291299 case "tinkca" :
292300 baseca , err = tinkca .NewTinkCA (cmd .Context (),
293301 viper .GetString ("tink-kms-resource" ), viper .GetString ("tink-keyset-path" ), viper .GetString ("tink-cert-chain-path" ))
0 commit comments