tpm-based key manager

[amoore877]

It would be nice to have a TPM-based key manager that Agent and Server could use, as an alternative to in-memory and disk-based. Actual usage would obviously depend upon the deployment environment having access to TPMs or similar implementation

[zmt]

Some overlap server-side with HSM support: #525

[udf2457]

Honestly I'm surprised there's no PIV / PKCS#11 support in SPIRE, let alone TPM support. Would have thought it would be an obvious necessity to acheive hardware-backed node attestation and cert issuance ?

[evan2645]

SPIRE does have node attestor TPM support for hardware using DevID. There is also a popular community-supported TPM plugin used in cases where there is no DevID. The latter may one day be merged upstream as well.

This issue is specifically about support for sealing agent key material against a TPM.

[bnevis-i]

Also be aware that there is a DevID provisioning tool that probably needs a bit of work before it can be made production-worthy. https://github.com/HewlettPackard/devid-provisioning-tool

[github-actions[bot]]

This issue is stale because it has been open for 365 days with no activity.

[github-actions[bot]]

This issue was closed because it has been inactive for 30 days since being marked as stale.