Container-based cryptography hardware security module management

1. A computer-implemented method comprising:

providing, by a processor, a cryptography work daemon container in a computer system, wherein the cryptography work daemon container in the computer system has privileged access to a cryptography hardware security module (HSM) of the computer system;

receiving, by the cryptography work daemon container, a request for a cryptography function of the cryptography HSM from an application container in the computer system;

causing, by the cryptography work daemon container, the cryptography HSM to perform the cryptography function based on receiving the request;

running, by the cryptography work daemon container, an HSM diagnostic tool that gathers diagnostic information from the cryptography HSM;

storing the diagnostic information in shared storage in the computer system;

collecting, by a cryptography administrator container, the diagnostic information from the shared storage; and

providing the collected diagnostic information to a user.

2. The method of claim 1 , wherein the request comprises a decryption request;

wherein causing the cryptography HSM to perform the cryptography function comprises causing the cryptography HSM to decrypt data that belongs to the application container; and

wherein the method further comprises providing the decrypted data from the cryptography work daemon container to the application container.

3. The method of claim 2 , wherein the application container sends the request based on a startup of the application container, and wherein the application container performs operations using the decrypted data.

4. The method of claim 1 , further comprising performing a master key roll in the cryptography HSM, wherein performing the master key roll comprises:

based on a new master key being committed:

sending from a cryptography administrator container to the cryptography work daemon container a re-encryption request;

based on receiving the re-encryption request, running a migrate tool by the cryptography work daemon container, wherein the migrate tool re-encrypts a token object using the new master key; and

storing the re-encrypted token object in shared storage in the computer system.

5. The method of claim 4 , wherein the re-encryption request is sent by a security administrator of the computer system.

6. The method of claim 1 , wherein the collected diagnostic information is provided to the user based on receiving a dump request from the user by a first failure data capture (FFDC) container.

7. A system comprising:

a memory having computer readable instructions; and

one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations comprising:

providing a cryptography work daemon container in a computer system, wherein the cryptography work daemon container in the computer system has privileged access to a cryptography hardware security module (HSM) of the computer system;

receiving, by the cryptography work daemon container, a request for a cryptography function of the cryptography HSM from an application container in the computer system;

causing, by the cryptography work daemon container, the cryptography HSM to perform the cryptography function based on receiving the request;

running, by the cryptography work daemon container, an HSM diagnostic tool that gathers diagnostic information from the cryptography HSM;

storing the diagnostic information in shared storage in the computer system;

collecting, by a cryptography administrator container, the diagnostic information from the shared storage; and

providing the collected diagnostic information to a user.

8. The system of claim 7 , wherein the request comprises a decryption request;

wherein causing the cryptography HSM to perform the cryptography function comprises causing the cryptography HSM to decrypt data that belongs to the application container; and

wherein the operations further comprise providing the decrypted data from the cryptography work daemon container to the application container.

9. The system of claim 8 , wherein the application container sends the request based on a startup of the application container, and wherein the application container performs operations using the decrypted data.

10. The system of claim 7 , the operations further comprising performing a master key roll in the cryptography HSM, wherein performing the master key roll comprises:

based on a new master key being committed:

sending from a cryptography administrator container to the cryptography work daemon container a re-encryption request;

based on receiving the re-encryption request, running a migrate tool by the cryptography work daemon container, wherein the migrate tool re-encrypts a token object using the new master key; and

storing the re-encrypted token object in shared storage in the computer system.

11. The system of claim 10 , wherein the re-encryption request is sent by a security administrator of the computer system.

12. The system of claim 7 , wherein the collected diagnostic information is provided to the user based on receiving a dump request from the user by a first failure data capture (FFDC) container.

13. A non-transitory computer readable storage medium executable by one or more processors to cause the one or more processors to perform operations comprising:

providing a cryptography work daemon container in a computer system, wherein the cryptography work daemon container in the computer system has privileged access to a cryptography hardware security module (HSM) of the computer system;

receiving, by the cryptography work daemon container, a request for a cryptography function of the cryptography HSM from an application container in the computer system;

causing, by the cryptography work daemon container, the cryptography HSM to perform the cryptography function based on receiving the request;

running, by the cryptography work daemon container, an HSM diagnostic tool that gathers diagnostic information from the cryptography HSM;

storing the diagnostic information in shared storage in the computer system;

collecting, by a cryptography administrator container, the diagnostic information from the shared storage; and

providing the collected diagnostic information to a user.

14. The non-transitory computer readable storage medium of claim 13 , wherein the request comprises a decryption request;

wherein causing the cryptography HSM to perform the cryptography function comprises causing the cryptography HSM to decrypt data that belongs to the application container; and

wherein the operations further comprise providing the decrypted data from the cryptography work daemon container to the application container.

15. The non-transitory computer readable storage medium of claim 14 , wherein the application container sends the request based on a startup of the application container, and wherein the application container performs operations using the decrypted data.

16. The non-transitory computer readable storage medium of claim 13 , wherein the operations further comprise performing a master key roll in the cryptography HSM, wherein performing the master key roll comprises:

based on a new master key being committed:

sending from a cryptography administrator container to the cryptography work daemon container a re-encryption request;

based on receiving the re-encryption request, running a migrate tool by the cryptography work daemon container, wherein the migrate tool re-encrypts a token object using the new master key; and

storing the re-encrypted token object in shared storage in the computer system.

17. The non-transitory computer readable storage medium of claim 16 , wherein the re-encryption request is sent by a security administrator of the computer system.