Skip to content

Commit ab46a2a

Browse files
ardagucluardaguclu
committed
Update KMSConfig to support all external kms plugins
1 parent c2a41ea commit ab46a2a

13 files changed

+216
-539
lines changed

‎config/v1/tests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml‎

Lines changed: 51 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,16 @@ featureGates:
55
- KMSEncryptionProvider
66
tests:
77
onCreate:
8-
- name: Should be able to create encrypt with KMS for AWS with valid values
8+
- name: Should be able to create encrypt with KMS for External with valid endpoint
99
initial: |
1010
apiVersion: config.openshift.io/v1
1111
kind: APIServer
1212
spec:
1313
encryption:
1414
type: KMS
1515
kms:
16-
type: AWS
17-
aws:
18-
keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
19-
region: us-east-1
16+
managementModel: External
17+
endpoint: unix:///var/run/kmsplugin/socket.sock
2018
expected: |
2119
apiVersion: config.openshift.io/v1
2220
kind: APIServer
@@ -26,22 +24,19 @@ tests:
2624
encryption:
2725
type: KMS
2826
kms:
29-
type: AWS
30-
aws:
31-
keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
32-
region: us-east-1
33-
- name: Should fail to create encrypt with KMS for AWS without region
27+
managementModel: External
28+
endpoint: unix:///var/run/kmsplugin/socket.sock
29+
- name: Should fail to create KMS with endpoint not starting with unix:///
3430
initial: |
3531
apiVersion: config.openshift.io/v1
3632
kind: APIServer
3733
spec:
3834
encryption:
3935
type: KMS
4036
kms:
41-
type: AWS
42-
aws:
43-
keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
44-
expectedError: "spec.encryption.kms.aws.region: Required value"
37+
managementModel: External
38+
endpoint: /var/run/kmsplugin/socket.sock
39+
expectedError: "endpoint must follow the format 'unix:///path'"
4540
- name: Should not allow kms config with encrypt aescbc
4641
initial: |
4742
apiVersion: config.openshift.io/v1
@@ -50,10 +45,8 @@ tests:
5045
encryption:
5146
type: aescbc
5247
kms:
53-
type: AWS
54-
aws:
55-
keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
56-
region: us-east-1
48+
managementModel: External
49+
endpoint: unix:///var/run/kmsplugin/socket.sock
5750
expectedError: "kms config is required when encryption type is KMS, and forbidden otherwise"
5851
- name: Should fail to create with an empty KMS config
5952
initial: |
@@ -63,65 +56,78 @@ tests:
6356
encryption:
6457
type: KMS
6558
kms: {}
66-
expectedError: "spec.encryption.kms.type: Required value"
67-
- name: Should fail to create with kms type AWS but without aws config
59+
expectedError: "spec.encryption.kms.endpoint: Required value"
60+
- name: Should be able to create with default type when endpoint is provided
6861
initial: |
6962
apiVersion: config.openshift.io/v1
7063
kind: APIServer
7164
spec:
7265
encryption:
7366
type: KMS
7467
kms:
75-
type: AWS
76-
expectedError: "aws config is required when kms provider type is AWS, and forbidden otherwise"
77-
- name: Should fail to create AWS KMS without a keyARN
68+
endpoint: unix:///var/run/kmsplugin/socket.sock
69+
expected: |
70+
apiVersion: config.openshift.io/v1
71+
kind: APIServer
72+
spec:
73+
audit:
74+
profile: Default
75+
encryption:
76+
type: KMS
77+
kms:
78+
managementModel: External
79+
endpoint: unix:///var/run/kmsplugin/socket.sock
80+
- name: Should fail to create KMS without endpoint
81+
initial: |
82+
apiVersion: config.openshift.io/v1
83+
kind: APIServer
84+
spec:
85+
encryption:
86+
type: KMS
87+
kms:
88+
managementModel: External
89+
expectedError: "spec.encryption.kms.endpoint: Required value"
90+
- name: Should fail to create KMS with abstract socket endpoint
7891
initial: |
7992
apiVersion: config.openshift.io/v1
8093
kind: APIServer
8194
spec:
8295
encryption:
8396
type: KMS
8497
kms:
85-
type: AWS
86-
aws:
87-
region: us-east-1
88-
expectedError: "spec.encryption.kms.aws.keyARN: Required value"
89-
- name: Should fail to create AWS KMS with invalid keyARN format
98+
managementModel: External
99+
endpoint: unix:///@abstractsocket
100+
expectedError: "endpoint must follow the format 'unix:///path'"
101+
- name: Should fail to create KMS with empty endpoint
90102
initial: |
91103
apiVersion: config.openshift.io/v1
92104
kind: APIServer
93105
spec:
94106
encryption:
95107
type: KMS
96108
kms:
97-
type: AWS
98-
aws:
99-
keyARN: not-a-kms-arn
100-
region: us-east-1
101-
expectedError: "keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
102-
- name: Should fail to create AWS KMS with empty region
109+
managementModel: External
110+
endpoint: ""
111+
expectedError: "spec.encryption.kms.endpoint in body should be at least 9 chars long"
112+
- name: Should fail to create KMS with endpoint containing spaces
103113
initial: |
104114
apiVersion: config.openshift.io/v1
105115
kind: APIServer
106116
spec:
107117
encryption:
108118
type: KMS
109119
kms:
110-
type: AWS
111-
aws:
112-
keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
113-
region: ""
114-
expectedError: "spec.encryption.kms.aws.region in body should be at least 1 chars long"
115-
- name: Should fail to create AWS KMS with invalid region format
120+
managementModel: External
121+
endpoint: unix:///var/run/kms plugin/socket.sock
122+
expectedError: "endpoint must follow the format 'unix:///path'"
123+
- name: Should fail to create KMS with abstract socket containing slash
116124
initial: |
117125
apiVersion: config.openshift.io/v1
118126
kind: APIServer
119127
spec:
120128
encryption:
121129
type: KMS
122130
kms:
123-
type: AWS
124-
aws:
125-
keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
126-
region: "INVALID-REGION"
127-
expectedError: "region must be a valid AWS region, consisting of lowercase characters, digits and hyphens (-) only."
131+
managementModel: External
132+
endpoint: unix:///@abstract/socket
133+
expectedError: "endpoint must follow the format 'unix:///path'"

‎config/v1/types_kmsencryption.go‎

Lines changed: 19 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -2,54 +2,33 @@ package v1
22

33
// KMSConfig defines the configuration for the KMS instance
44
// that will be used with KMSEncryptionProvider encryption
5-
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws config is required when kms provider type is AWS, and forbidden otherwise"
6-
// +union
75
type KMSConfig struct {
8-
// type defines the kind of platform for the KMS provider.
9-
// Available provider types are AWS only.
6+
// managementModel defines how KMS plugins are managed.
7+
// Valid values are "External".
8+
// When set to External, encryption keys are managed by a user-deployed
9+
// KMS plugin that communicates via UNIX domain socket using KMS V2 API.
1010
//
11-
// +unionDiscriminator
12-
// +required
13-
Type KMSProviderType `json:"type"`
14-
15-
// aws defines the key config for using an AWS KMS instance
16-
// for the encryption. The AWS KMS instance is managed
17-
// by the user outside the purview of the control plane.
18-
//
19-
// +unionMember
11+
// +kubebuilder:validation:Enum=External
12+
// +kubebuilder:default=External
2013
// +optional
21-
AWS *AWSKMSConfig `json:"aws,omitempty"`
22-
}
14+
ManagementModel ManagementModel `json:"managementModel,omitempty"`
2315

24-
// AWSKMSConfig defines the KMS config specific to AWS KMS provider
25-
type AWSKMSConfig struct {
26-
// keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
27-
// The value must adhere to the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`, where:
28-
// - `<region>` is the AWS region consisting of lowercase letters and hyphens followed by a number.
29-
// - `<account_id>` is a 12-digit numeric identifier for the AWS account.
30-
// - `<key_id>` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
31-
//
32-
// +kubebuilder:validation:MaxLength=128
33-
// +kubebuilder:validation:MinLength=1
34-
// +kubebuilder:validation:XValidation:rule="self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')",message="keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
35-
// +required
36-
KeyARN string `json:"keyARN"`
37-
// region specifies the AWS region where the KMS instance exists, and follows the format
38-
// `<region-prefix>-<region-name>-<number>`, e.g.: `us-east-1`.
39-
// Only lowercase letters and hyphens followed by numbers are allowed.
16+
// endpoint specifies the UNIX domain socket endpoint for communicating with the external KMS plugin.
17+
// The endpoint must follow the format "unix:///path".
18+
// Abstract Linux sockets (i.e. "unix:///@abstractname") are not supported.
4019
//
41-
// +kubebuilder:validation:MaxLength=64
42-
// +kubebuilder:validation:MinLength=1
43-
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]+(-[a-z0-9]+)*$')",message="region must be a valid AWS region, consisting of lowercase characters, digits and hyphens (-) only."
20+
// +kubebuilder:validation:MaxLength=120
21+
// +kubebuilder:validation:MinLength=9
22+
// +kubebuilder:validation:XValidation:rule="self.matches('^unix:///[^@ ][^ ]*$')",message="endpoint must follow the format 'unix:///path'"
4423
// +required
45-
Region string `json:"region"`
24+
Endpoint string `json:"endpoint,omitempty"`
4625
}
4726

48-
// KMSProviderType is a specific supported KMS provider
49-
// +kubebuilder:validation:Enum=AWS
50-
type KMSProviderType string
27+
// ManagementModel describes how the KMS plugin is managed.
28+
// Valid values are "External".
29+
type ManagementModel string
5130

5231
const (
53-
// AWSKMSProvider represents a supported KMS provider for use with AWS KMS
54-
AWSKMSProvider KMSProviderType = "AWS"
32+
// External represents a KMS plugin that is managed externally and accessed via unix domain socket
33+
External ManagementModel = "External"
5534
)

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml‎

Lines changed: 18 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -168,59 +168,30 @@ spec:
168168
managing the lifecyle of the encryption keys outside of the control plane.
169169
This allows integration with an external provider to manage the data encryption keys securely.
170170
properties:
171-
aws:
171+
endpoint:
172172
description: |-
173-
aws defines the key config for using an AWS KMS instance
174-
for the encryption. The AWS KMS instance is managed
175-
by the user outside the purview of the control plane.
176-
properties:
177-
keyARN:
178-
description: |-
179-
keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
180-
The value must adhere to the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`, where:
181-
- `<region>` is the AWS region consisting of lowercase letters and hyphens followed by a number.
182-
- `<account_id>` is a 12-digit numeric identifier for the AWS account.
183-
- `<key_id>` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
184-
maxLength: 128
185-
minLength: 1
186-
type: string
187-
x-kubernetes-validations:
188-
- message: keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`.
189-
The account ID must be a 12 digit number and the region
190-
and key ID should consist only of lowercase hexadecimal
191-
characters and hyphens (-).
192-
rule: self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
193-
region:
194-
description: |-
195-
region specifies the AWS region where the KMS instance exists, and follows the format
196-
`<region-prefix>-<region-name>-<number>`, e.g.: `us-east-1`.
197-
Only lowercase letters and hyphens followed by numbers are allowed.
198-
maxLength: 64
199-
minLength: 1
200-
type: string
201-
x-kubernetes-validations:
202-
- message: region must be a valid AWS region, consisting
203-
of lowercase characters, digits and hyphens (-) only.
204-
rule: self.matches('^[a-z0-9]+(-[a-z0-9]+)*$')
205-
required:
206-
- keyARN
207-
- region
208-
type: object
209-
type:
173+
endpoint specifies the UNIX domain socket endpoint for communicating with the external KMS plugin.
174+
The endpoint must follow the format "unix:///path".
175+
Abstract Linux sockets (i.e. "unix:///@abstractname") are not supported.
176+
maxLength: 120
177+
minLength: 9
178+
type: string
179+
x-kubernetes-validations:
180+
- message: endpoint must follow the format 'unix:///path'
181+
rule: self.matches('^unix:///[^@ ][^ ]*$')
182+
managementModel:
183+
default: External
210184
description: |-
211-
type defines the kind of platform for the KMS provider.
212-
Available provider types are AWS only.
185+
managementModel defines how KMS plugins are managed.
186+
Valid values are "External".
187+
When set to External, encryption keys are managed by a user-deployed
188+
KMS plugin that communicates via UNIX domain socket using KMS V2 API.
213189
enum:
214-
- AWS
190+
- External
215191
type: string
216192
required:
217-
- type
193+
- endpoint
218194
type: object
219-
x-kubernetes-validations:
220-
- message: aws config is required when kms provider type is AWS,
221-
and forbidden otherwise
222-
rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws)
223-
: !has(self.aws)'
224195
type:
225196
description: |-
226197
type defines what encryption type should be used to encrypt resources at the datastore layer.

0 commit comments

Comments
 (0)