-
Notifications
You must be signed in to change notification settings - Fork 4.5k
Open
Labels
Description
Is your feature request related to a problem? Please describe.
Yes. Vault currently supports multiple KMS providers for auto unseal (AWS KMS, Azure Key Vault, GCP CKMS, AliCloud KMS, OCI KMS), but lacks support for HuaweiCloud KMS.
Organizations using HuaweiCloud infrastructure cannot take advantage of Vault’s auto unseal feature.
Describe the solution you'd like
I would like Vault to add HuaweiCloud KMS wrapper support.
This support should include:
- HuaweiCloud KMS wrapper implementation – Add a GetHuaweiCloudKMSFunc function, similar to other KMS wrappers (AWS, Azure, GCP, etc.)
- Environment variable support – Read HuaweiCloud KMS configuration from environment variables (e.g., HUAWEICLOUD_REGION, HUAWEICLOUD_ACCESS_KEY, HUAWEICLOUD_SECRET_KEY, VAULT_HUAWEICLOUDKMS_SEAL_KEY_ID, etc.)
- Config file support – Allow reading HuaweiCloud KMS configuration from the HCL config file
- IPv6 address normalization – Support IPv6 address normalization as implemented in other wrappers
This implementation should follow the same design patterns and conventions as existing KMS wrapper implementations.
Describe alternatives you've considered
- Manual unseal – This does not provide the operational benefits of auto unseal (e.g., automatic key rotation, high availability, etc.)
- Switching to another KMS provider – This would require changing the existing infrastructure, which may be costly and complex
- Writing a custom wrapper – This is not ideal since it wouldn’t be part of Vault’s core codebase, leading to potential maintainability and security issues
The best solution is to include HuaweiCloud KMS support in Vault’s core codebase.
Explain any additional use-cases
- Integration with existing infrastructure – Companies already using HuaweiCloud can integrate Vault without changing their current setup.
- Hybrid cloud scenarios – Some organizations operate in multi-cloud environments (e.g., AWS/Azure + HuaweiCloud). Supporting HuaweiCloud KMS improves Vault’s multi-cloud capabilities.
- Compliance requirements – Certain regions or industries may mandate the use of specific KMS providers. HuaweiCloud KMS support helps meet these compliance requirements.