The plugin is deployed as a self-contained container image with the approved Luna PKCS#11 runtime libraries and OpenSSL configuration bundled. The plugin dynamically constructs its runtime configuration and certificates in an isolated temporary runtime directory using the job parameters provided by the Discovery UI / Runner, requiring no host volume mounts. The plugin performs read-only enumeration of certificates, keys, and secrets from Luna HSM partitions without extraction or cryptographic operations.

Deployment

Container Image

Build from the go-modules directory because the Dockerfile imports the shared common module:

cd discovery-plugins/go-modules
docker build \
  --platform=linux/amd64 \
  --build-arg GOPROXY=https://<approved-artifactory>/api/go/<approved-proxy> \
  --build-arg DOCKER_VERSION=1.3.0.dev \
  -f luna-hsm-plugin/Dockerfile \
  -t luna-hsm-plugin:1.3.0.dev \
  .

The image includes the checked-in Luna client runtime files and verifies their SHA-256 digests against luna-client.sha256. Client certificates and the private key are supplied as protected job parameters and are written to the temporary runtime directory for the scan. GOPROXY is optional when dependencies are already cached; do not replace the reviewed Luna client files or checksum manifest.