Skip to content

NO-JIRA: add a generic kmsv2 integration #3013

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
tjungblu wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

NO-JIRA: add a generic kmsv2 integration #3013

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 102 additions & 0 deletions config/v1/tests/apiservers.config.openshift.io/GenericKMSv2.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
name: "APIServer GenericKMSv2 Validation"
crdName: apiservers.config.openshift.io
featureGates:
- KMSEncryption
tests:
onCreate:
- name: Should be able to create with valid GenericKMSv2 config
initial: |
apiVersion: config.openshift.io/v1
kind: APIServer
spec:
encryption:
type: KMS
kms:
type: GenericKMSv2
genericKMSv2:
operatorNamespace: vault-kms-operator
expected: |
apiVersion: config.openshift.io/v1
kind: APIServer
spec:
audit:
profile: Default
encryption:
type: KMS
kms:
type: GenericKMSv2
genericKMSv2:
operatorNamespace: vault-kms-operator

- name: Should reject GenericKMSv2 type without genericKMSv2 config
initial: |
apiVersion: config.openshift.io/v1
kind: APIServer
spec:
encryption:
type: KMS
kms:
type: GenericKMSv2
expectedError: "genericKMSv2 config is required when kms provider type is GenericKMSv2"

- name: Should reject genericKMSv2 config when type is Vault
initial: |
apiVersion: config.openshift.io/v1
kind: APIServer
spec:
encryption:
type: KMS
kms:
type: Vault
genericKMSv2:
operatorNamespace: vault-kms-operator
vault:
kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
vaultAddress: https://vault.example.com:8200
authentication:
type: AppRole
appRole:
secret:
name: vault-approle
vaultKeyPath: transit/keys/my-key
expectedError: "genericKMSv2 config is required when kms provider type is GenericKMSv2, and forbidden otherwise"

- name: Should reject openshift-* operator namespace
initial: |
apiVersion: config.openshift.io/v1
kind: APIServer
spec:
encryption:
type: KMS
kms:
type: GenericKMSv2
genericKMSv2:
operatorNamespace: openshift-config
expectedError: "operatorNamespace must not be an openshift-* or kube-* system namespace"

- name: Should reject kube-* operator namespace
initial: |
apiVersion: config.openshift.io/v1
kind: APIServer
spec:
encryption:
type: KMS
kms:
type: GenericKMSv2
genericKMSv2:
operatorNamespace: kube-system
expectedError: "operatorNamespace must not be an openshift-* or kube-* system namespace"

- name: Should reject invalid operator namespace
initial: |
apiVersion: config.openshift.io/v1
kind: APIServer
spec:
encryption:
type: KMS
kms:
type: GenericKMSv2
genericKMSv2:
operatorNamespace: invalid_namespace!
expectedError: "operatorNamespace must be a valid DNS-1123 label"
43 changes: 41 additions & 2 deletions config/v1/types_kmsencryption.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,14 @@ package v1
// KMSPluginConfig defines the configuration for the KMS instance
// that will be used with KMS encryption
// +kubebuilder:validation:XValidation:rule="self.type == 'Vault' ? has(self.vault) : !has(self.vault)",message="vault config is required when kms provider type is Vault, and forbidden otherwise"
// +kubebuilder:validation:XValidation:rule="self.type == 'GenericKMSv2' ? has(self.genericKMSv2) : !has(self.genericKMSv2)",message="genericKMSv2 config is required when kms provider type is GenericKMSv2, and forbidden otherwise"
// +union
type KMSPluginConfig struct {
// type defines the kind of platform for the KMS provider.
// Allowed values are Vault.
// Allowed values are Vault and GenericKMSv2.
// When set to Vault, the plugin connects to a HashiCorp Vault server for key management.
// When set to GenericKMSv2, the platform reads runtime configuration from a KMS provider
// operator installed in the referenced namespace.
//
// +unionDiscriminator
// +required
Expand All @@ -22,6 +25,17 @@ type KMSPluginConfig struct {
// +optional
Vault VaultKMSPluginConfig `json:"vault,omitempty,omitzero"`

// genericKMSv2 references an OLM-managed KMS provider operator.
// The operator publishes how to run the KMS plugin sidecar (container image and arguments).
// The platform handles deployment, lifecycle, and mounting credentials from Secrets and
// ConfigMaps in the operator namespace at well-known injection points referenced by the
// plugin arguments.
// This field must be set when type is GenericKMSv2, and must be unset otherwise.
//
// +unionMember
// +optional
GenericKMSv2 GenericKMSv2PluginConfig `json:"genericKMSv2,omitempty,omitzero"`

// --- TOMBSTONE ---
// aws was a field that allowed configuring AWS KMS.
// It was never implemented and has been removed.
Expand All @@ -41,20 +55,45 @@ type KMSPluginConfig struct {
// }

// KMSProviderType is a specific supported KMS provider
// +kubebuilder:validation:Enum=Vault
// +kubebuilder:validation:Enum=Vault;GenericKMSv2
type KMSProviderType string

const (
// VaultKMSProvider represents a supported KMS provider for use with HashiCorp Vault
VaultKMSProvider KMSProviderType = "Vault"

// GenericKMSv2KMSProvider represents a KMS provider whose runtime configuration
// is supplied by an OLM-managed operator.
GenericKMSv2KMSProvider KMSProviderType = "GenericKMSv2"

// --- TOMBSTONE ---
// AWSKMSProvider was a constant for AWS KMS support that was never implemented.
// The constant name is reserved to prevent reuse.
//
// AWSKMSProvider KMSProviderType = "AWS"
)

// GenericKMSv2PluginConfig references a KMS provider operator installed via OLM.
type GenericKMSv2PluginConfig struct {
// operatorNamespace is the namespace where the KMS provider operator is installed.
// The platform reads the KMSPlugin resource named "cluster" from this namespace
// to determine the container image and arguments for the KMS plugin sidecar.
//
// Secrets and ConfigMaps referenced by the plugin arguments are expected to exist
// in this namespace. The platform mounts them at well-known injection points
// during sidecar lifecycle management.
//
// The namespace must be a valid DNS-1123 label and must not be an openshift-* or
// kube-* system namespace.
//
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=63
// +kubebuilder:validation:XValidation:rule="!format.dns1123Label().validate(self).hasValue()",message="operatorNamespace must be a valid DNS-1123 label"
// +kubebuilder:validation:XValidation:rule="!self.startsWith('openshift-') && !self.startsWith('kube-')",message="operatorNamespace must not be an openshift-* or kube-* system namespace"
// +required
OperatorNamespace string `json:"operatorNamespace,omitempty"`
}

// VaultSecretReference references a secret in the openshift-config namespace.
type VaultSecretReference struct {
// name is the metadata.name of the referenced secret in the openshift-config namespace.
Expand Down
43 changes: 42 additions & 1 deletion ...zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,13 +168,50 @@ spec:
managing the lifecyle of the encryption keys outside of the control plane.
This allows integration with an external provider to manage the data encryption keys securely.
properties:
genericKMSv2:
description: |-
genericKMSv2 references an OLM-managed KMS provider operator.
The operator publishes how to run the KMS plugin sidecar (container image and arguments).
The platform handles deployment, lifecycle, and mounting credentials from Secrets and
ConfigMaps in the operator namespace at well-known injection points referenced by the
plugin arguments.
This field must be set when type is GenericKMSv2, and must be unset otherwise.
properties:
operatorNamespace:
description: |-
operatorNamespace is the namespace where the KMS provider operator is installed.
The platform reads the KMSPlugin resource named "cluster" from this namespace
to determine the container image and arguments for the KMS plugin sidecar.

Secrets and ConfigMaps referenced by the plugin arguments are expected to exist
in this namespace. The platform mounts them at well-known injection points
during sidecar lifecycle management.

The namespace must be a valid DNS-1123 label and must not be an openshift-* or
kube-* system namespace.
maxLength: 63
minLength: 1
type: string
x-kubernetes-validations:
- message: operatorNamespace must be a valid DNS-1123
label
rule: '!format.dns1123Label().validate(self).hasValue()'
- message: operatorNamespace must not be an openshift-*
or kube-* system namespace
rule: '!self.startsWith(''openshift-'') && !self.startsWith(''kube-'')'
required:
- operatorNamespace
type: object
type:
description: |-
type defines the kind of platform for the KMS provider.
Allowed values are Vault.
Allowed values are Vault and GenericKMSv2.
When set to Vault, the plugin connects to a HashiCorp Vault server for key management.
When set to GenericKMSv2, the platform reads runtime configuration from a KMS provider
operator installed in the referenced namespace.
enum:
- Vault
- GenericKMSv2
type: string
vault:
description: |-
Expand Down Expand Up @@ -448,6 +485,10 @@ spec:
- message: vault config is required when kms provider type is
Vault, and forbidden otherwise
rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)'
- message: genericKMSv2 config is required when kms provider type
is GenericKMSv2, and forbidden otherwise
rule: 'self.type == ''GenericKMSv2'' ? has(self.genericKMSv2)
: !has(self.genericKMSv2)'
type:
description: |-
type defines what encryption type should be used to encrypt resources at the datastore layer.
Expand Down
43 changes: 42 additions & 1 deletion ...enerated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,13 +168,50 @@ spec:
managing the lifecyle of the encryption keys outside of the control plane.
This allows integration with an external provider to manage the data encryption keys securely.
properties:
genericKMSv2:
description: |-
genericKMSv2 references an OLM-managed KMS provider operator.
The operator publishes how to run the KMS plugin sidecar (container image and arguments).
The platform handles deployment, lifecycle, and mounting credentials from Secrets and
ConfigMaps in the operator namespace at well-known injection points referenced by the
plugin arguments.
This field must be set when type is GenericKMSv2, and must be unset otherwise.
properties:
operatorNamespace:
description: |-
operatorNamespace is the namespace where the KMS provider operator is installed.
The platform reads the KMSPlugin resource named "cluster" from this namespace
to determine the container image and arguments for the KMS plugin sidecar.

Secrets and ConfigMaps referenced by the plugin arguments are expected to exist
in this namespace. The platform mounts them at well-known injection points
during sidecar lifecycle management.

The namespace must be a valid DNS-1123 label and must not be an openshift-* or
kube-* system namespace.
maxLength: 63
minLength: 1
type: string
x-kubernetes-validations:
- message: operatorNamespace must be a valid DNS-1123
label
rule: '!format.dns1123Label().validate(self).hasValue()'
- message: operatorNamespace must not be an openshift-*
or kube-* system namespace
rule: '!self.startsWith(''openshift-'') && !self.startsWith(''kube-'')'
required:
- operatorNamespace
type: object
type:
description: |-
type defines the kind of platform for the KMS provider.
Allowed values are Vault.
Allowed values are Vault and GenericKMSv2.
When set to Vault, the plugin connects to a HashiCorp Vault server for key management.
When set to GenericKMSv2, the platform reads runtime configuration from a KMS provider
operator installed in the referenced namespace.
enum:
- Vault
- GenericKMSv2
type: string
vault:
description: |-
Expand Down Expand Up @@ -448,6 +485,10 @@ spec:
- message: vault config is required when kms provider type is
Vault, and forbidden otherwise
rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)'
- message: genericKMSv2 config is required when kms provider type
is GenericKMSv2, and forbidden otherwise
rule: 'self.type == ''GenericKMSv2'' ? has(self.genericKMSv2)
: !has(self.genericKMSv2)'
type:
description: |-
type defines what encryption type should be used to encrypt resources at the datastore layer.
Expand Down
43 changes: 42 additions & 1 deletion ...nerated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,13 +168,50 @@ spec:
managing the lifecyle of the encryption keys outside of the control plane.
This allows integration with an external provider to manage the data encryption keys securely.
properties:
genericKMSv2:
description: |-
genericKMSv2 references an OLM-managed KMS provider operator.
The operator publishes how to run the KMS plugin sidecar (container image and arguments).
The platform handles deployment, lifecycle, and mounting credentials from Secrets and
ConfigMaps in the operator namespace at well-known injection points referenced by the
plugin arguments.
This field must be set when type is GenericKMSv2, and must be unset otherwise.
properties:
operatorNamespace:
description: |-
operatorNamespace is the namespace where the KMS provider operator is installed.
The platform reads the KMSPlugin resource named "cluster" from this namespace
to determine the container image and arguments for the KMS plugin sidecar.

Secrets and ConfigMaps referenced by the plugin arguments are expected to exist
in this namespace. The platform mounts them at well-known injection points
during sidecar lifecycle management.

The namespace must be a valid DNS-1123 label and must not be an openshift-* or
kube-* system namespace.
maxLength: 63
minLength: 1
type: string
x-kubernetes-validations:
- message: operatorNamespace must be a valid DNS-1123
label
rule: '!format.dns1123Label().validate(self).hasValue()'
- message: operatorNamespace must not be an openshift-*
or kube-* system namespace
rule: '!self.startsWith(''openshift-'') && !self.startsWith(''kube-'')'
required:
- operatorNamespace
type: object
type:
description: |-
type defines the kind of platform for the KMS provider.
Allowed values are Vault.
Allowed values are Vault and GenericKMSv2.
When set to Vault, the plugin connects to a HashiCorp Vault server for key management.
When set to GenericKMSv2, the platform reads runtime configuration from a KMS provider
operator installed in the referenced namespace.
enum:
- Vault
- GenericKMSv2
type: string
vault:
description: |-
Expand Down Expand Up @@ -448,6 +485,10 @@ spec:
- message: vault config is required when kms provider type is
Vault, and forbidden otherwise
rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)'
- message: genericKMSv2 config is required when kms provider type
is GenericKMSv2, and forbidden otherwise
rule: 'self.type == ''GenericKMSv2'' ? has(self.genericKMSv2)
: !has(self.genericKMSv2)'
type:
description: |-
type defines what encryption type should be used to encrypt resources at the datastore layer.
Expand Down
Loading