-
Notifications
You must be signed in to change notification settings - Fork 522
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[FeatureGate/KMSEncryptionProvider] APIServer config for AWS KMS
Signed-off-by: Swarup Ghosh <[email protected]>
- Loading branch information
Showing
3 changed files
with
166 additions
and
1 deletion.
There are no files selected for viewing
88 changes: 88 additions & 0 deletions
88
config/v1/tests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this | ||
| name: "APIServer" | ||
| crdName: apiservers.config.openshift.io | ||
| featureGate: KMSEncryptionProvider | ||
| tests: | ||
| onCreate: | ||
| - name: Should be able to create encrypt with KMS for AWS with valid values | ||
| initial: | | ||
| apiVersion: config.openshift.io/v1 | ||
| kind: APIServer | ||
| spec: | ||
| encryption: | ||
| type: KMS | ||
| kms: | ||
| type: AWS | ||
| aws: | ||
| keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a | ||
| region: us-east-1 | ||
| expected: | | ||
| apiVersion: config.openshift.io/v1 | ||
| kind: APIServer | ||
| spec: | ||
| audit: | ||
| profile: Default | ||
| encryption: | ||
| type: KMS | ||
| kms: | ||
| type: AWS | ||
| aws: | ||
| keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a | ||
| region: us-east-1 | ||
| - name: Should fail to create with an empty KMS config | ||
| initial: | | ||
| apiVersion: config.openshift.io/v1 | ||
| kind: APIServer | ||
| spec: | ||
| encryption: | ||
| type: KMS | ||
| kms: {} | ||
| expectedError: "Invalid value: \"null\": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation" | ||
| - name: Should fail to create with kms type AWS but without aws config | ||
| initial: | | ||
| apiVersion: config.openshift.io/v1 | ||
| kind: APIServer | ||
| spec: | ||
| encryption: | ||
| type: KMS | ||
| kms: | ||
| type: AWS | ||
| expectedError: "Invalid value: \"object\": aws config is required when kms provider type is AWS, and forbidden otherwise" | ||
| - name: Should fail to create AWS KMS without a keyARN | ||
| initial: | | ||
| apiVersion: config.openshift.io/v1 | ||
| kind: APIServer | ||
| spec: | ||
| encryption: | ||
| type: KMS | ||
| kms: | ||
| type: AWS | ||
| aws: | ||
| region: us-east-1 | ||
| expectedError: "Invalid value: \"null\": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation" | ||
| - name: Should fail to create AWS KMS with invalid keyARN format | ||
| initial: | | ||
| apiVersion: config.openshift.io/v1 | ||
| kind: APIServer | ||
| spec: | ||
| encryption: | ||
| type: KMS | ||
| kms: | ||
| type: AWS | ||
| aws: | ||
| keyARN: not-a-kms-arn | ||
| region: us-east-1 | ||
| expectedError: "Invalid value: \"string\": keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)." | ||
| - name: Should fail to create AWS KMS with empty region | ||
| initial: | | ||
| apiVersion: config.openshift.io/v1 | ||
| kind: APIServer | ||
| spec: | ||
| encryption: | ||
| type: KMS | ||
| kms: | ||
| type: AWS | ||
| aws: | ||
| keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a | ||
| region: "" | ||
| expectedError: "Invalid value: \"string\": AWS region cannot be empty" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| package v1 | ||
|
|
||
| // KMSConfig defines the configuration for the KMS instance | ||
| // that will be used with KMSEncryptionProvider encryption | ||
| // +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws config is required when kms provider type is AWS, and forbidden otherwise" | ||
| // +union | ||
| type KMSConfig struct { | ||
| // type defines the kind of platform for the KMS provider. | ||
| // Available provider types are AWS only. | ||
| // | ||
| // +unionDiscriminator | ||
| // +kubebuilder:validation:Required | ||
| Type KMSProviderType `json:"type"` | ||
|
|
||
| // aws defines the key config for using an AWS KMS instance | ||
| // for the encryption. The AWS KMS instance is managed | ||
| // by the user outside the purview of the control plane. | ||
| // | ||
| // +unionMember | ||
| // +optional | ||
| AWS *AWSKMSConfig `json:"aws,omitempty"` | ||
| } | ||
|
|
||
| // AWSKMSConfig defines the KMS config specific to AWS KMS provider | ||
| type AWSKMSConfig struct { | ||
| // keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption. | ||
| // The value must adhere to the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`, where: | ||
| // - `<region>` is the AWS region consisting of lowercase letters and hyphens followed by a number. | ||
| // - `<account_id>` is a 12-digit numeric identifier for the AWS account. | ||
| // - `<key_id>` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens. | ||
| // | ||
| // +kubebuilder:validation:Required | ||
| // +kubebuilder:validation:MaxLength=128 | ||
| // +kubebuilder:validation:XValidation:rule="self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')",message="keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)." | ||
| KeyARN string `json:"keyARN"` | ||
| // region specifies the AWS region where the KMS instance exists, and follows the format | ||
| // `<region-prefix>-<region-name>-<number>`, e.g.: `us-east-1`. | ||
| // Only lowercase letters and hyphens followed by numbers are allowed. | ||
| // | ||
| // +kubebuilder:validation:MaxLength=64 | ||
| // +kubebuilder:validation:XValidation:rule="self.size() > 0",message="AWS region cannot be empty" | ||
| Region string `json:"region"` | ||
| } | ||
|
|
||
| // KMSProviderType is a specific supported KMS provider | ||
| // +kubebuilder:validation:Enum=AWS | ||
| type KMSProviderType string | ||
|
|
||
| const ( | ||
| // AWSKMSProvider represents a supported KMS provider for use with AWS KMS | ||
| AWSKMSProvider KMSProviderType = "AWS" | ||
| ) |