Skip to content

Commit 79a94ce

Browse files
saad-alisaad-ali
committed
Add support for Customer Managed Encryption Keys
1 parent c703754 commit 79a94ce

File tree

5 files changed

+60
-16
lines changed

5 files changed

+60
-16
lines changed

‎pkg/common/constants.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,11 @@ package common
1818

1919
const (
2020
// Keys for Storage Class Parameters
21-
ParameterKeyType = "type"
22-
ParameterKeyReplicationType = "replication-type"
21+
ParameterKeyType = "type"
22+
ParameterKeyReplicationType = "replication-type"
23+
ParameterKeyDiskEncryptionKmsKey = "disk-encryption-kms-key"
2324

24-
// Keys for Topology. This key will be shared amonst drivers from GCP
25+
// Keys for Topology. This key will be shared amongst drivers from GCP
2526
TopologyKeyZone = "topology.gke.io/zone"
2627

2728
// VolumeAttributes for Partition

‎pkg/gce-cloud-provider/compute/fake-gce.go

+11-1
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ func (cloud *FakeCloudProvider) ValidateExistingDisk(ctx context.Context, resp *
188188
return nil
189189
}
190190

191-
func (cloud *FakeCloudProvider) InsertDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, replicaZones []string, snapshotId string) error {
191+
func (cloud *FakeCloudProvider) InsertDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, replicaZones []string, snapshotId, diskEncryptionKmsKey string) error {
192192
if disk, ok := cloud.disks[volKey.Name]; ok {
193193
err := cloud.ValidateExistingDisk(ctx, disk, diskType,
194194
int64(capacityRange.GetRequiredBytes()),
@@ -209,6 +209,11 @@ func (cloud *FakeCloudProvider) InsertDisk(ctx context.Context, volKey *meta.Key
209209
SelfLink: fmt.Sprintf("projects/%s/zones/%s/disks/%s", cloud.project, volKey.Zone, volKey.Name),
210210
SourceSnapshotId: snapshotId,
211211
}
212+
if diskEncryptionKmsKey != "" {
213+
diskToCreateGA.DiskEncryptionKey = &compute.CustomerEncryptionKey{
214+
KmsKeyName: diskEncryptionKmsKey,
215+
}
216+
}
212217
diskToCreate = ZonalCloudDisk(diskToCreateGA)
213218
case meta.Regional:
214219
diskToCreateBeta := &computebeta.Disk{
@@ -219,6 +224,11 @@ func (cloud *FakeCloudProvider) InsertDisk(ctx context.Context, volKey *meta.Key
219224
SelfLink: fmt.Sprintf("projects/%s/regions/%s/disks/%s", cloud.project, volKey.Region, volKey.Name),
220225
SourceSnapshotId: snapshotId,
221226
}
227+
if diskEncryptionKmsKey != "" {
228+
diskToCreateBeta.DiskEncryptionKey = &computebeta.CustomerEncryptionKey{
229+
KmsKeyName: diskEncryptionKmsKey,
230+
}
231+
}
222232
diskToCreate = RegionalCloudDisk(diskToCreateBeta)
223233
default:
224234
return fmt.Errorf("could not create disk, key was neither zonal nor regional, instead got: %v", volKey.String())

‎pkg/gce-cloud-provider/compute/gce-compute.go

+18-6
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ type GCECompute interface {
4242
GetDisk(ctx context.Context, volumeKey *meta.Key) (*CloudDisk, error)
4343
RepairUnderspecifiedVolumeKey(ctx context.Context, volumeKey *meta.Key) (*meta.Key, error)
4444
ValidateExistingDisk(ctx context.Context, disk *CloudDisk, diskType string, reqBytes, limBytes int64) error
45-
InsertDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, replicaZones []string, snapshotId string) error
45+
InsertDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, replicaZones []string, snapshotId, diskEncryptionKmsKey string) error
4646
DeleteDisk(ctx context.Context, volumeKey *meta.Key) error
4747
AttachDisk(ctx context.Context, volKey *meta.Key, readWrite, diskType, instanceZone, instanceName string) error
4848
DetachDisk(ctx context.Context, deviceName string, instanceZone, instanceName string) error
@@ -202,18 +202,18 @@ func (cloud *CloudProvider) ValidateExistingDisk(ctx context.Context, resp *Clou
202202
return nil
203203
}
204204

205-
func (cloud *CloudProvider) InsertDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, replicaZones []string, snapshotId string) error {
205+
func (cloud *CloudProvider) InsertDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, replicaZones []string, snapshotId, diskEncryptionKmsKey string) error {
206206
switch volKey.Type() {
207207
case meta.Zonal:
208-
return cloud.insertZonalDisk(ctx, volKey, diskType, capBytes, capacityRange, snapshotId)
208+
return cloud.insertZonalDisk(ctx, volKey, diskType, capBytes, capacityRange, snapshotId, diskEncryptionKmsKey)
209209
case meta.Regional:
210-
return cloud.insertRegionalDisk(ctx, volKey, diskType, capBytes, capacityRange, replicaZones, snapshotId)
210+
return cloud.insertRegionalDisk(ctx, volKey, diskType, capBytes, capacityRange, replicaZones, snapshotId, diskEncryptionKmsKey)
211211
default:
212212
return fmt.Errorf("could not insert disk, key was neither zonal nor regional, instead got: %v", volKey.String())
213213
}
214214
}
215215

216-
func (cloud *CloudProvider) insertRegionalDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, replicaZones []string, snapshotId string) error {
216+
func (cloud *CloudProvider) insertRegionalDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, replicaZones []string, snapshotId, diskEncryptionKmsKey string) error {
217217
diskToCreateBeta := &computebeta.Disk{
218218
Name: volKey.Name,
219219
SizeGb: common.BytesToGb(capBytes),
@@ -226,6 +226,11 @@ func (cloud *CloudProvider) insertRegionalDisk(ctx context.Context, volKey *meta
226226
if len(replicaZones) != 0 {
227227
diskToCreateBeta.ReplicaZones = replicaZones
228228
}
229+
if diskEncryptionKmsKey != "" {
230+
diskToCreateBeta.DiskEncryptionKey = &computebeta.CustomerEncryptionKey{
231+
KmsKeyName: diskEncryptionKmsKey,
232+
}
233+
}
229234

230235
insertOp, err := cloud.betaService.RegionDisks.Insert(cloud.project, volKey.Region, diskToCreateBeta).Context(ctx).Do()
231236
if err != nil {
@@ -267,17 +272,24 @@ func (cloud *CloudProvider) insertRegionalDisk(ctx context.Context, volKey *meta
267272
return nil
268273
}
269274

270-
func (cloud *CloudProvider) insertZonalDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, snapshotId string) error {
275+
func (cloud *CloudProvider) insertZonalDisk(ctx context.Context, volKey *meta.Key, diskType string, capBytes int64, capacityRange *csi.CapacityRange, snapshotId, diskEncryptionKmsKey string) error {
271276
diskToCreate := &compute.Disk{
272277
Name: volKey.Name,
273278
SizeGb: common.BytesToGb(capBytes),
274279
Description: "Disk created by GCE-PD CSI Driver",
275280
Type: cloud.GetDiskTypeURI(volKey, diskType),
276281
}
282+
277283
if snapshotId != "" {
278284
diskToCreate.SourceSnapshot = snapshotId
279285
}
280286

287+
if diskEncryptionKmsKey != "" {
288+
diskToCreate.DiskEncryptionKey = &compute.CustomerEncryptionKey{
289+
KmsKeyName: diskEncryptionKmsKey,
290+
}
291+
}
292+
281293
op, err := cloud.service.Disks.Insert(cloud.project, volKey.Zone, diskToCreate).Context(ctx).Do()
282294

283295
if err != nil {

‎pkg/gce-pd-csi-driver/controller.go

+10-6
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ func (gceCS *GCEControllerServer) CreateVolume(ctx context.Context, req *csi.Cre
9494
diskType := "pd-standard"
9595
// Start process for creating a new disk
9696
replicationType := replicationTypeNone
97+
diskEncryptionKmsKey := ""
9798
for k, v := range req.GetParameters() {
9899
if k == "csiProvisionerSecretName" || k == "csiProvisionerSecretNamespace" {
99100
// These are hardcoded secrets keys required to function but not needed by GCE PD
@@ -105,6 +106,9 @@ func (gceCS *GCEControllerServer) CreateVolume(ctx context.Context, req *csi.Cre
105106
diskType = v
106107
case common.ParameterKeyReplicationType:
107108
replicationType = strings.ToLower(v)
109+
case common.ParameterKeyDiskEncryptionKmsKey:
110+
// Resource names (e.g. "keyRings", "cryptoKeys", etc.) are case sensitive, so do not change case
111+
diskEncryptionKmsKey = v
108112
default:
109113
return nil, status.Error(codes.InvalidArgument, fmt.Sprintf("CreateVolume invalid option %q", k))
110114
}
@@ -172,15 +176,15 @@ func (gceCS *GCEControllerServer) CreateVolume(ctx context.Context, req *csi.Cre
172176
if len(zones) != 1 {
173177
return nil, status.Errorf(codes.Internal, fmt.Sprintf("CreateVolume failed to get a single zone for creating zonal disk, instead got: %v", zones))
174178
}
175-
disk, err = createSingleZoneDisk(ctx, gceCS.CloudProvider, name, zones, diskType, capacityRange, capBytes, snapshotId)
179+
disk, err = createSingleZoneDisk(ctx, gceCS.CloudProvider, name, zones, diskType, capacityRange, capBytes, snapshotId, diskEncryptionKmsKey)
176180
if err != nil {
177181
return nil, status.Error(codes.Internal, fmt.Sprintf("CreateVolume failed to create single zonal disk %#v: %v", name, err))
178182
}
179183
case replicationTypeRegionalPD:
180184
if len(zones) != 2 {
181185
return nil, status.Errorf(codes.Internal, fmt.Sprintf("CreateVolume failed to get a 2 zones for creating regional disk, instead got: %v", zones))
182186
}
183-
disk, err = createRegionalDisk(ctx, gceCS.CloudProvider, name, zones, diskType, capacityRange, capBytes, snapshotId)
187+
disk, err = createRegionalDisk(ctx, gceCS.CloudProvider, name, zones, diskType, capacityRange, capBytes, snapshotId, diskEncryptionKmsKey)
184188
if err != nil {
185189
return nil, status.Error(codes.Internal, fmt.Sprintf("CreateVolume failed to create regional disk %#v: %v", name, err))
186190
}
@@ -888,7 +892,7 @@ func cleanSelfLink(selfLink string) string {
888892
return strings.TrimPrefix(temp, gce.GCEComputeBetaAPIEndpoint)
889893
}
890894

891-
func createRegionalDisk(ctx context.Context, cloudProvider gce.GCECompute, name string, zones []string, diskType string, capacityRange *csi.CapacityRange, capBytes int64, snapshotId string) (*gce.CloudDisk, error) {
895+
func createRegionalDisk(ctx context.Context, cloudProvider gce.GCECompute, name string, zones []string, diskType string, capacityRange *csi.CapacityRange, capBytes int64, snapshotId, diskEncryptionKmsKey string) (*gce.CloudDisk, error) {
892896
region, err := common.GetRegionFromZones(zones)
893897
if err != nil {
894898
return nil, fmt.Errorf("failed to get region from zones: %v", err)
@@ -900,7 +904,7 @@ func createRegionalDisk(ctx context.Context, cloudProvider gce.GCECompute, name
900904
fullyQualifiedReplicaZones, cloudProvider.GetReplicaZoneURI(replicaZone))
901905
}
902906

903-
err = cloudProvider.InsertDisk(ctx, meta.RegionalKey(name, region), diskType, capBytes, capacityRange, fullyQualifiedReplicaZones, snapshotId)
907+
err = cloudProvider.InsertDisk(ctx, meta.RegionalKey(name, region), diskType, capBytes, capacityRange, fullyQualifiedReplicaZones, snapshotId, diskEncryptionKmsKey)
904908
if err != nil {
905909
return nil, fmt.Errorf("failed to insert regional disk: %v", err)
906910
}
@@ -914,12 +918,12 @@ func createRegionalDisk(ctx context.Context, cloudProvider gce.GCECompute, name
914918
return disk, nil
915919
}
916920

917-
func createSingleZoneDisk(ctx context.Context, cloudProvider gce.GCECompute, name string, zones []string, diskType string, capacityRange *csi.CapacityRange, capBytes int64, snapshotId string) (*gce.CloudDisk, error) {
921+
func createSingleZoneDisk(ctx context.Context, cloudProvider gce.GCECompute, name string, zones []string, diskType string, capacityRange *csi.CapacityRange, capBytes int64, snapshotId, diskEncryptionKmsKey string) (*gce.CloudDisk, error) {
918922
if len(zones) != 1 {
919923
return nil, fmt.Errorf("got wrong number of zones for zonal create volume: %v", len(zones))
920924
}
921925
diskZone := zones[0]
922-
err := cloudProvider.InsertDisk(ctx, meta.ZonalKey(name, diskZone), diskType, capBytes, capacityRange, nil, snapshotId)
926+
err := cloudProvider.InsertDisk(ctx, meta.ZonalKey(name, diskZone), diskType, capBytes, capacityRange, nil, snapshotId, diskEncryptionKmsKey)
923927
if err != nil {
924928
return nil, fmt.Errorf("failed to insert zonal disk: %v", err)
925929
}

‎pkg/gce-pd-csi-driver/controller_test.go

+17
Original file line numberDiff line numberDiff line change
@@ -646,6 +646,23 @@ func TestCreateVolumeArguments(t *testing.T) {
646646
},
647647
expErrCode: codes.Unimplemented, // once block support is implemented, this error should be InvalidArgument
648648
},
649+
{
650+
name: "success with disk encryption kms key",
651+
req: &csi.CreateVolumeRequest{
652+
Name: name,
653+
CapacityRange: stdCapRange,
654+
VolumeCapabilities: stdVolCap,
655+
Parameters: map[string]string{
656+
common.ParameterKeyDiskEncryptionKmsKey: "projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY",
657+
},
658+
},
659+
expVol: &csi.Volume{
660+
CapacityBytes: common.GbToBytes(20),
661+
VolumeId: testVolumeId,
662+
VolumeContext: nil,
663+
AccessibleTopology: stdTopology,
664+
},
665+
},
649666
}
650667

651668
// Run test cases

0 commit comments

Comments
 (0)