Customer-Managed-Keys (CMK) is the key management service layer of Open Key Chain Manager, an open-source project that lets customers keep control over the master key protecting every subordinate key in their encryption hierarchy.
CMK gives customers Bring Your Own Key (BYOK) control over the master key in a cryptographic key hierarchy, and the ability to revoke data access outright by revoking that master key — the same problem space as the HYOK/BYOK enterprise encryption work at SAP, applied here as a standalone open-source service. It's a multi-tenant, API-first Go service, deployed as containers on Kubernetes, with a CLI toolset for operating tenants and background jobs.
A Go service backed by PostgreSQL with per-tenant schema and data isolation. Asynchronous work — key
rotation, background jobs, notifications — flows through the Orbital message broker over AMQP. The API
surface is OpenAPI-first: endpoints are specified up front and Go clients are generated from the spec with
oapi-codegen. Clients authenticate over mTLS. Locally and in CI, the whole stack runs on a K3d
Kubernetes cluster provisioned via Helm charts, with Docker as the container runtime.
Destructive schema changes ship in two steps across releases instead of one, so a rolling deployment is never running old code against a schema that has already dropped what it expects. Schema migrations run as blocking Kubernetes Jobs; data migrations are separated out and run in parallel, since they don't need to gate the schema change.
Internal errors are mapped centrally to structured API responses with the correct HTTP status codes, rather than each handler deciding its own error shape — keeping the API surface consistent as the service grows.
System-information and event-processing implementations are pluggable, so integrations can be swapped without changes to the core service logic.
Logging goes through slogctx, which injects request context automatically — tenant, request ID, and similar fields land in every log line for a request without each call site having to thread them through by hand.