Skip to content

Commit fda3450

Browse files
supershalsupershal
committed
fix: use array type for encryption providers
1 parent 890502d commit fda3450

9 files changed

+153
-142
lines changed

‎api/v1alpha1/clusterconfig_types.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@ type GenericClusterConfigSpec struct {
202202
Users []User `json:"users,omitempty"`
203203

204204
// +optional
205-
Encryption *Encryption `json:"encryption,omitempty"`
205+
EncryptionAtRest *EncryptionAtRest `json:"encryptionAtRest,omitempty"`
206206
}
207207

208208
type Image struct {
@@ -282,14 +282,15 @@ type User struct {
282282
Sudo string `json:"sudo,omitempty"`
283283
}
284284

285-
// Encryption defines the configuration to enable encryption at REST
285+
// EncryptionAtRest defines the configuration to enable encryption at REST
286286
// This configuration is used by API server to encrypt data before storing it in ETCD.
287287
// Currently the encryption only enabled for secrets and configmaps.
288-
type Encryption struct {
288+
type EncryptionAtRest struct {
289289
// Encryption providers
290-
// +kubebuilder:default={aescbc:{}}
290+
// +kubebuilder:default={{aescbc:{}}}
291+
// +kubebuilder:validation:MaxItems=1
291292
// +kubebuilder:validation:Optional
292-
Providers *EncryptionProviders `json:"providers"`
293+
Providers []EncryptionProviders `json:"providers"`
293294
}
294295

295296
type EncryptionProviders struct {

‎api/v1alpha1/crds/caren.nutanix.com_awsclusterconfigs.yaml

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -322,22 +322,25 @@ spec:
322322
type: string
323323
type: object
324324
type: object
325-
encryption:
325+
encryptionAtRest:
326326
description: |-
327-
Encryption defines the configuration to enable encryption at REST
327+
EncryptionAtRest defines the configuration to enable encryption at REST
328328
This configuration is used by API server to encrypt data before storing it in ETCD.
329329
Currently the encryption only enabled for secrets and configmaps.
330330
properties:
331331
providers:
332332
default:
333-
aescbc: {}
333+
- aescbc: {}
334334
description: Encryption providers
335-
properties:
336-
aescbc:
337-
type: object
338-
secretbox:
339-
type: object
340-
type: object
335+
items:
336+
properties:
337+
aescbc:
338+
type: object
339+
secretbox:
340+
type: object
341+
type: object
342+
maxItems: 1
343+
type: array
341344
type: object
342345
etcd:
343346
properties:

‎api/v1alpha1/crds/caren.nutanix.com_dockerclusterconfigs.yaml

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -239,22 +239,25 @@ spec:
239239
type: object
240240
docker:
241241
type: object
242-
encryption:
242+
encryptionAtRest:
243243
description: |-
244-
Encryption defines the configuration to enable encryption at REST
244+
EncryptionAtRest defines the configuration to enable encryption at REST
245245
This configuration is used by API server to encrypt data before storing it in ETCD.
246246
Currently the encryption only enabled for secrets and configmaps.
247247
properties:
248248
providers:
249249
default:
250-
aescbc: {}
250+
- aescbc: {}
251251
description: Encryption providers
252-
properties:
253-
aescbc:
254-
type: object
255-
secretbox:
256-
type: object
257-
type: object
252+
items:
253+
properties:
254+
aescbc:
255+
type: object
256+
secretbox:
257+
type: object
258+
type: object
259+
maxItems: 1
260+
type: array
258261
type: object
259262
etcd:
260263
properties:

‎api/v1alpha1/crds/caren.nutanix.com_genericclusterconfigs.yaml

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -233,22 +233,25 @@ spec:
233233
- provider
234234
type: object
235235
type: object
236-
encryption:
236+
encryptionAtRest:
237237
description: |-
238-
Encryption defines the configuration to enable encryption at REST
238+
EncryptionAtRest defines the configuration to enable encryption at REST
239239
This configuration is used by API server to encrypt data before storing it in ETCD.
240240
Currently the encryption only enabled for secrets and configmaps.
241241
properties:
242242
providers:
243243
default:
244-
aescbc: {}
244+
- aescbc: {}
245245
description: Encryption providers
246-
properties:
247-
aescbc:
248-
type: object
249-
secretbox:
250-
type: object
251-
type: object
246+
items:
247+
properties:
248+
aescbc:
249+
type: object
250+
secretbox:
251+
type: object
252+
type: object
253+
maxItems: 1
254+
type: array
252255
type: object
253256
etcd:
254257
properties:

‎api/v1alpha1/crds/caren.nutanix.com_nutanixclusterconfigs.yaml

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -410,22 +410,25 @@ spec:
410410
- machineDetails
411411
type: object
412412
type: object
413-
encryption:
413+
encryptionAtRest:
414414
description: |-
415-
Encryption defines the configuration to enable encryption at REST
415+
EncryptionAtRest defines the configuration to enable encryption at REST
416416
This configuration is used by API server to encrypt data before storing it in ETCD.
417417
Currently the encryption only enabled for secrets and configmaps.
418418
properties:
419419
providers:
420420
default:
421-
aescbc: {}
421+
- aescbc: {}
422422
description: Encryption providers
423-
properties:
424-
aescbc:
425-
type: object
426-
secretbox:
427-
type: object
428-
type: object
423+
items:
424+
properties:
425+
aescbc:
426+
type: object
427+
secretbox:
428+
type: object
429+
type: object
430+
maxItems: 1
431+
type: array
429432
type: object
430433
etcd:
431434
properties:

‎api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 11 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/handlers/generic/mutation/encryption/encryptionprovider_test.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,9 @@ func Test_encryptionConfigForSecretsAndConfigMaps(t *testing.T) {
7777

7878
for _, tt := range testcases {
7979
t.Run(tt.name, func(t *testing.T) {
80-
got, gErr := encryptionConfigForSecretsAndConfigMaps(tt.providers, testTokenGenerator)
80+
got, gErr := encryptionConfigForSecretsAndConfigMaps(
81+
tt.providers,
82+
testTokenGenerator)
8183
assert.Equal(t, tt.wantErr, gErr)
8284
assert.Equal(t, tt.want, got)
8385
})

‎pkg/handlers/generic/mutation/encryption/inject.go

Lines changed: 42 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,10 @@ import (
3636

3737
const (
3838
// VariableName is the external patch variable name.
39-
VariableName = "encryption"
39+
VariableName = "encryptionAtRest"
4040
SecretKeyForEtcdEncryption = "config"
4141
defaultEncryptionSecretNameTemplate = "%s-encryption-config" //nolint:gosec // Does not contain hard coded credentials.
42-
encryptionConfigurationOnRemote = "/etc/kubernetes/encryptionconfig.yaml"
42+
encryptionConfigurationOnRemote = "/etc/kubernetes/pki/encryptionconfig.yaml"
4343
apiServerEncryptionConfigArg = "encryption-provider-config"
4444
)
4545

@@ -69,7 +69,7 @@ func (h *encryptionPatchHandler) Mutate(
6969
) error {
7070
log := ctrl.LoggerFrom(ctx, "holderRef", holderRef)
7171

72-
encryptionVariable, err := variables.Get[carenv1.Encryption](
72+
encryptionVariable, err := variables.Get[carenv1.EncryptionAtRest](
7373
vars,
7474
h.variableName,
7575
h.variableFieldPath...,
@@ -91,45 +91,39 @@ func (h *encryptionPatchHandler) Mutate(
9191
encryptionVariable,
9292
)
9393

94-
cluster, err := clusterGetter(ctx)
95-
if err != nil {
96-
log.Error(err, "failed to get cluster from encryption mutation handler")
97-
return err
98-
}
99-
100-
found, err := h.DefaultEncryptionSecretExists(ctx, cluster)
101-
if err != nil {
102-
log.WithValues(
103-
"defaultEncryptionSecret", defaultEncryptionSecretName(cluster.Name),
104-
).Error(err, "failed to find default encryption configuration secret")
105-
return err
106-
}
107-
// we do not rotate or override the secret keys for encryption configuration
108-
if found {
109-
log.V(5).WithValues(
110-
"defaultEncryptionSecret", defaultEncryptionSecretName(cluster.Name),
111-
).Info(
112-
"skip generating encryption configuration. Default encryption configuration secret exists",
113-
defaultEncryptionSecretName(cluster.Name))
114-
return nil
115-
}
116-
11794
return patches.MutateIfApplicable(
11895
obj, vars, &holderRef, selectors.ControlPlane(), log,
11996
func(obj *controlplanev1.KubeadmControlPlaneTemplate) error {
120-
log.WithValues(
121-
"patchedObjectKind", obj.GetObjectKind().GroupVersionKind().String(),
122-
"patchedObjectName", ctrlclient.ObjectKeyFromObject(obj),
123-
).Info("adding encryption configuration files and API server extra args in control plane kubeadm config spec")
124-
encConfig, err := h.generateEncryptionConfiguration(encryptionVariable.Providers)
97+
cluster, err := clusterGetter(ctx)
12598
if err != nil {
99+
log.Error(err, "failed to get cluster from encryption mutation handler")
126100
return err
127101
}
128102

129-
if err := h.CreateEncryptionConfigurationSecret(ctx, encConfig, cluster); err != nil {
103+
found, err := h.DefaultEncryptionSecretExists(ctx, cluster)
104+
if err != nil {
105+
log.WithValues(
106+
"defaultEncryptionSecret", defaultEncryptionSecretName(cluster.Name),
107+
).Error(err, "failed to find default encryption configuration secret")
130108
return err
131109
}
132110

111+
// we do not rotate or override the secret keys for encryption configuration
112+
if !found {
113+
encConfig, err := h.generateEncryptionConfiguration(encryptionVariable.Providers)
114+
if err != nil {
115+
return err
116+
}
117+
if err := h.CreateEncryptionConfigurationSecret(ctx, encConfig, cluster); err != nil {
118+
return err
119+
}
120+
}
121+
122+
log.WithValues(
123+
"patchedObjectKind", obj.GetObjectKind().GroupVersionKind().String(),
124+
"patchedObjectName", ctrlclient.ObjectKeyFromObject(obj),
125+
).Info("adding encryption configuration files and API server extra args in control plane kubeadm config spec")
126+
133127
// Create kubadm config file for encryption config
134128
obj.Spec.Template.Spec.KubeadmConfigSpec.Files = append(
135129
obj.Spec.Template.Spec.KubeadmConfigSpec.Files,
@@ -159,29 +153,33 @@ func generateEncryptionCredentialsFile(cluster *clusterv1.Cluster) cabpkv1.File
159153
Key: SecretKeyForEtcdEncryption,
160154
},
161155
},
162-
Permissions: "0600",
156+
Permissions: "0640",
163157
}
164158
}
165159

166160
func (h *encryptionPatchHandler) generateEncryptionConfiguration(
167-
providers *carenv1.EncryptionProviders,
161+
providers []carenv1.EncryptionProviders,
168162
) (*apiserverv1.EncryptionConfiguration, error) {
169-
// We only support encryption for "secrets" and "configmaps" using "aescbc" provider.
170-
resourceConfig, err := encryptionConfigForSecretsAndConfigMaps(
171-
providers,
172-
h.keyGenerator,
173-
)
174-
if err != nil {
175-
return nil, err
163+
resourceConfigs := []apiserverv1.ResourceConfiguration{}
164+
for _, encProvider := range providers {
165+
provider := encProvider
166+
resourceConfig, err := encryptionConfigForSecretsAndConfigMaps(
167+
&provider,
168+
h.keyGenerator,
169+
)
170+
if err != nil {
171+
return nil, err
172+
}
173+
resourceConfigs = append(resourceConfigs, *resourceConfig)
176174
}
175+
// We only support encryption for "secrets" and "configmaps" using "aescbc" provider.
176+
177177
return &apiserverv1.EncryptionConfiguration{
178178
TypeMeta: metav1.TypeMeta{
179179
APIVersion: apiserverv1.SchemeGroupVersion.String(),
180180
Kind: "EncryptionConfiguration",
181181
},
182-
Resources: []apiserverv1.ResourceConfiguration{
183-
*resourceConfig,
184-
},
182+
Resources: resourceConfigs,
185183
}, nil
186184
}
187185

0 commit comments

Comments
 (0)