modos-rs

This is modos's support repository with some core packages and services written in Rust and Go.

Authors:

• Almut Luetke
• Cyril Matthey-Doret
• Gabriel Nützi

Table of Contents

• modos-rs
  • Components
    • KMS
  • Installation
  • Usage
    • Dev. Services
    • KMS
      • Tests
        • Run Specific Tests
    • Nix Hashes
  • Development
  • Coverage
  • Acknowledgement
  • TODO
  • Copyright

Components

The repository is split into components. Each component lives in components/<name> and is built, linted and tested on its own.

KMS

The KMS (Key Management Service) is a Go gRPC service in components/kms. It hands out short-lived S3 credentials over the Secret Token Service (STS).

A client authenticates with a JWT. The KMS verifies that token against the identity provider, reads the bucket permissions from it, and asks the object store for temporary credentials that allow exactly these permissions and nothing more. The client therefore never holds a long-lived storage key.

Read docs/kms.md for the API, the token claims, the generated policy and the configuration.

Installation

direnv allow && direnv reload

or

just develop

Usage

Dev. Services

just services::start

KMS

just quitsh build -c "kms"
just quitsh lint -c "kms"
just quitsh test -c "kms"
just quitsh image -c "kms"

Tests

Run Specific Tests

To run specific tests use either for normal unit tests:

just quitsh exec-target \
  -K "test.showTestLog: true" \
  -K 'test.testArgs: [ "-test.run=TestBla.*" ]' \
  "kms::test-unittest"

or for the integration tests (ginkgo) to run test with label banana:

just quitsh exec-target \
  -K "test.showTestLog: true" \
  -K 'test.testArgs: [ "-ginkgo.label-filter=banana" ]' \
  "kms::test-integration"

Nix Hashes

To fix Nix fixed-output derivation hasesh run: just quitsh nix fix-hash

Development

Read first the Contribution Guidelines.

For technical documentation on setup and development, see the Development Guide

Coverage

Acknowledgement

Acknowledge all contributors and external collaborators here.

TODO

• Use a Nix-Derivation Build or a NixOS VM test to test kubernetes manifests.

Copyright

Copyright © 2025-2028 Swiss Data Science Center (SDSC), www.datascience.ch. All rights reserved. The SDSC is jointly established and legally represented by the École Polytechnique Fédérale de Lausanne (EPFL) and the Eidgenössische Technische Hochschule Zürich (ETH Zürich). This copyright encompasses all materials, software, documentation, and other content created and developed by the SDSC.