feat: KMIP server certificate auto-renewal token refresh - #354
Merged
bernie-g merged 14 commits intoAug 17, 2026
Conversation
Bumps infisical-kmip to the auto-renewal version (pseudo-version off the feature branch; swap for the release tag once it lands). enrollKmipServer now also returns a refresh function passed to the server as RefreshAccessToken: AWS enrollment re-authenticates via STS and persists the new token, token enrollment has no refresh since enrollment tokens are single-use.
|
💬 Discussion in Slack: #pr-review-cli-354-feat-kmip-server-certificate-auto-renewal-token-refresh Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
1 task
Contributor
|
| Filename | Overview |
|---|---|
| packages/cmd/kmip.go | Wires the new refresh hook into the KMIP server and implements AWS re-authentication with best-effort token persistence; no actionable changed-code defect was established. |
| go.mod | Upgrades infisical-kmip to the pseudo-version containing certificate auto-renewal support. |
| go.sum | Updates checksums consistently for the infisical-kmip version bump. |
Reviews (1): Last reviewed commit: "feat: wire KMIP server certificate auto-..." | Re-trigger Greptile
carlosmonastyrski
requested changes
Aug 6, 2026
…starts The refresh closure's HTTP client and STS login now have deadlines so a hung API call cannot stall certificate renewal. A flagless restart of an AWS-enrolled server (stored-token path) now detects the persisted server ID and wires the same refresh function, so it can still recover from a rejected token.
LoadStoredServerID falls back to INFISICAL_KMIP_SERVER_ID, so a token-enrolled server whose environment carries that variable was wired for an STS refresh it cannot perform. A rejected token then surfaced as an AWS failure rather than telling the operator to re-enroll. Record the enroll method at enrollment and decide from that. Both reads behind the decision are conf-file only, since the environment says what this run was handed rather than how the server enrolled. Servers enrolled before the method was recorded have a conf-file server ID and no method, so that combination still counts as AWS-enrolled and keeps its refresh. Without that they would silently lose mid-run re-authentication.
Adds the cases the fix has to get right beyond the reported one: never enrolled, an aws method with no server id to refresh with, a stale server id left behind by re-enrolling from aws to token, an environment server id that differs from the recorded one, an unrecognised method, and re-enrollment replacing the recorded method.
…o-renewal-of-kmip-server-certificates
Drops narration that restated the code: the decision block at the call site, now covered by the named function, a duplicated note on the loader beside it, and test comments the subtest names already say.
bernie-g
force-pushed
the
bernie/kms-24-add-auto-renewal-of-kmip-server-certificates
branch
from
August 17, 2026 11:09
81cd82d to
a91c1a7
Compare
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
Contributor
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 1 · PR risk: 0/10 |
1 task
carlosmonastyrski
previously approved these changes
Aug 17, 2026
carlosmonastyrski
approved these changes
Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description 📣
Bumps infisical-kmip to the version that auto-renews KMIP server TLS certificates (Infisical/infisical-kmip#14) and wires the token refresh hook so AWS-enrolled servers re-authenticate via STS when their access token is rejected. Tested E2E locally against a dev stack with a 3m-TTL certificate.
Type ✨