Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Azure support (for v3.10.0) #42

Open
wants to merge 1 commit into
base: upstream-3e92e75-3.10.0
Choose a base branch
from

Conversation

takuro-sato
Copy link
Collaborator

@takuro-sato takuro-sato commented Sep 9, 2024

This is a updated version of the previous PR because the latest commit at the time (v3.4.0) is now outdated.
It is created based on our current codebase which is based on 3e92e75 (This is the revision that is used by v3.10.0 release. https://github.com/privacysandbox/bidding-auction-servers/blob/v3.10.0/WORKSPACE), so we set the our copy of 3e92e75
as the target.
It targets our fork because we can't create a PR against commits without branch name or tag in https://github.com/privacysandbox/data-plane-shared-libraries.

The first PR is left as it is because the branch is still used by our demo. The previous PR is also still available here, but please review this PR because this is based on a newer commit.


Adding Azure support

This PR is adding support for deployment of Google's Bidding and Auction Services on Azure.

Azure Privacy Sandbox architecture: https://1drv.ms/w/s!AmI-86sms1pYqJ5Uqgo5Qv2Ynmrcmw?e=BDC8BH
(We'll make a PR for the document in https://github.com/privacysandbox/protected-auction-services-docs/tree/main in future)

Now B&A services can fetch private and public HPKE keys from an Azure KMS, specifically designed to support the B&A services, and handle test requests.
To try this changes locally, please visit here.

The PR for bidding-auction-servers repository: KenGordon/bidding-auction-servers#32
azure-privacy-sandbox-kms branch that works with this PR: https://github.com/microsoft/azure-privacy-sandbox-kms/tree/add-azure-support-v3.10.0

Changes

  • Add Azure support
    • Add Azure configurations. e.g. --platform=azure (for Bazel), kAzure (C++ enum value).
    • Add Azure implementation for selected interfaces under cpio/client_providers/
  • Add attestation library to fetch attestation in Azure Confidential ACI. We implemented the core functionality of:
  • kms_client_provider
  • parameter_client_provider
  • private_key_fetcher_provider
  • private_key_fetcher_provider.
  • auth_token_provider
  • role_credentials_provider

Also we return dummy values for instance_client_provider and blob_storage_client_provider for now. Please see "TODOs for future PRs" section for the details.

TODOs for future PRs

  • instance_client_provider currently returns dummy values. It will be implemented properly after Azure auth_token_provider is ready.
  • URL to decrypt the wrapped HPKE key is hard coded as kKMSUnwrapPath. We will either put the URL in KeyData::key_encryption_key_uri or use an environment variable
  • auth_token_provider is using an environment variable to configure IDP path. We will try to find a better option.
  • Implement telemetry's init_azure
  • Handle private_key_cache_ttl_seconds option.
  • Allow to specify key_id for private key API PrivateKeyFetchingRequest.
  • Separate azure_cpio_lib_inside_tee and azure_cpio_lib_outside_tee implementation. Current azure_cpio_lib_inside_tee uses fake attestation report silently when it's outside TEE.
  • Improve implementation for Azure blob_storage_client_provider. It just returns empty responses. We added it just to build errors when we run build_and_test_all_in_docker.
  • Add azure_platform for test_lib_cpio_provider

Co-authored-by: Dominic Ayre <[email protected]>
Co-authored-by: Joe Powell <[email protected]>
Co-authored-by: Kapil Vaswani <[email protected]>
Co-authored-by: Ken Gordon <[email protected]>
Co-authored-by: Mahati Chamarthy <[email protected]>
Co-authored-by: Ronny Bjones <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant