Skip to content

Add HuaweiCloud KMS support for auto unseal #31630

@enbiyagoral

Description

@enbiyagoral

Is your feature request related to a problem? Please describe.
Yes. Vault currently supports multiple KMS providers for auto unseal (AWS KMS, Azure Key Vault, GCP CKMS, AliCloud KMS, OCI KMS), but lacks support for HuaweiCloud KMS.
Organizations using HuaweiCloud infrastructure cannot take advantage of Vault’s auto unseal feature.

Describe the solution you'd like
I would like Vault to add HuaweiCloud KMS wrapper support.
This support should include:

  1. HuaweiCloud KMS wrapper implementation – Add a GetHuaweiCloudKMSFunc function, similar to other KMS wrappers (AWS, Azure, GCP, etc.)
  2. Environment variable support – Read HuaweiCloud KMS configuration from environment variables (e.g., HUAWEICLOUD_REGION, HUAWEICLOUD_ACCESS_KEY, HUAWEICLOUD_SECRET_KEY, VAULT_HUAWEICLOUDKMS_SEAL_KEY_ID, etc.)
  3. Config file support – Allow reading HuaweiCloud KMS configuration from the HCL config file
  4. IPv6 address normalization – Support IPv6 address normalization as implemented in other wrappers

This implementation should follow the same design patterns and conventions as existing KMS wrapper implementations.

Describe alternatives you've considered

  1. Manual unseal – This does not provide the operational benefits of auto unseal (e.g., automatic key rotation, high availability, etc.)
  2. Switching to another KMS provider – This would require changing the existing infrastructure, which may be costly and complex
  3. Writing a custom wrapper – This is not ideal since it wouldn’t be part of Vault’s core codebase, leading to potential maintainability and security issues

The best solution is to include HuaweiCloud KMS support in Vault’s core codebase.

Explain any additional use-cases

  1. Integration with existing infrastructure – Companies already using HuaweiCloud can integrate Vault without changing their current setup.
  2. Hybrid cloud scenarios – Some organizations operate in multi-cloud environments (e.g., AWS/Azure + HuaweiCloud). Supporting HuaweiCloud KMS improves Vault’s multi-cloud capabilities.
  3. Compliance requirements – Certain regions or industries may mandate the use of specific KMS providers. HuaweiCloud KMS support helps meet these compliance requirements.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions