Upgrade Guardian services to Panda v7 - support key rotation #160
Comments
rtyley
added a commit
to guardian/frontend
that referenced
this issue
Sep 19, 2024
This upgrades Panda from v5 to v7, allowing us to use key rotation as introduced with guardian/pan-domain-authentication#150. See also guardian/pan-domain-authentication#160.
rtyley
added a commit
to guardian/frontend
that referenced
this issue
Sep 19, 2024
This upgrades Panda from v5 to v7, allowing us to use key rotation as introduced with guardian/pan-domain-authentication#150. See also guardian/pan-domain-authentication#160.
rtyley
added a commit
to guardian/frontend
that referenced
this issue
Sep 19, 2024
This upgrades Panda from v5 to v7, allowing us to use key rotation as introduced with guardian/pan-domain-authentication#150. See also guardian/pan-domain-authentication#160.
This was referenced Jan 8, 2025
|
Now that guardian/workflow-frontend#489 has been merged, workflow-frontend has been successfully upgraded to v7. (I can't edit this issue to check the item for it above.) |
I feel like 'workflow-and-collaboration' are the natural owners of Panda, but I know that isn't settled yet.. in the meantime, I've given 'workflow-and-collaboration' write access to this repo (with the 'maintain' role) and so hopefully you should be able to check the checkmark now...! |
|
I can indeed, thanks for the change :) |
|
Note that all the systems in the minimum subset have now been updated to panda v7. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Guardian services using Panda
ELK logs for Settings.Refresher
Migration pathway
Best to jump straight to Panda v7, without stopping off on v5/v6 on the way, as the location of the private/public key fields has changed and is eventually removed in favour of the
verification/signingAndVerificationfields - so avoid multiple changes and jump straight to using those.Necessary changes to code using Panda
java.securityclasses in preference to string-wrappers #147 removed the oldPublicKey&PrivateKeyclasses in ourcom.gu.pandomainauthpackage, in favour of using the existingjava.securityclasses. To create instances of those classes, we can use theSettingsReader.{privateKeyFor, publicKeyFor}methods.PanDomainAuthSettingsRefresherinstances, makepanDomainSettingsaval#155 requirespanDomainSettingsis aval, not adefS3BucketLoaderabstraction, which simplifies constructing aPanDomainAuthSettingsRefresherand means that Panda is no longer tied to AWS SDK v1. Examples: tagmanager, login.gutoolsCookieUtils.generateCookieData()method now communicates errors withCookieResultvalues containingCookieIntegrityFailure, rather than exceptions.settings.signingKeyPair). Instead, usesettings.signingAndVerificationorpublicSettings.verification. Note also thatpublicSettings.publicKeywas previously optional, andpublicSettings.verificationis not.Services using Panda
Content Production
Trello cards:
PRs:
Newsroom Resilience
WebX
MSS
Investigations & Reporting
Minimum subset of systems we'd want to have on Panda v7 before performing a rotation
& newswires(update: newswires is not in production use yet so it shouldn't block rotation work)The text was updated successfully, but these errors were encountered: