feat: KMIP server certificate auto-renewal token refresh - #354
Open
bernie-g wants to merge 6 commits into
Open
Conversation
Bumps infisical-kmip to the auto-renewal version (pseudo-version off the feature branch; swap for the release tag once it lands). enrollKmipServer now also returns a refresh function passed to the server as RefreshAccessToken: AWS enrollment re-authenticates via STS and persists the new token, token enrollment has no refresh since enrollment tokens are single-use.
|
💬 Discussion in Slack: #pr-review-cli-354-feat-kmip-server-certificate-auto-renewal-token-refresh Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
1 task
Contributor
|
| Filename | Overview |
|---|---|
| packages/cmd/kmip.go | Wires the new refresh hook into the KMIP server and implements AWS re-authentication with best-effort token persistence; no actionable changed-code defect was established. |
| go.mod | Upgrades infisical-kmip to the pseudo-version containing certificate auto-renewal support. |
| go.sum | Updates checksums consistently for the infisical-kmip version bump. |
Reviews (1): Last reviewed commit: "feat: wire KMIP server certificate auto-..." | Re-trigger Greptile
carlosmonastyrski
requested changes
Aug 6, 2026
…starts The refresh closure's HTTP client and STS login now have deadlines so a hung API call cannot stall certificate renewal. A flagless restart of an AWS-enrolled server (stored-token path) now detects the persisted server ID and wires the same refresh function, so it can still recover from a rejected token.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description 📣
Bumps infisical-kmip to the version that auto-renews KMIP server TLS certificates (Infisical/infisical-kmip#14) and wires the token refresh hook so AWS-enrolled servers re-authenticate via STS when their access token is rejected. Tested E2E locally against a dev stack with a 3m-TTL certificate.
Type ✨