kubernetes
/
apiserver
mirror of https://github.com/kubernetes/apiserver.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[KMSv2] Generate proto API and update feature gate for beta 

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: ad698cc0aeb6e9b5fb1a7913d5db9f65fb1a51ac
This commit is contained in:
Anish Ramasekar 2023-01-12 00:14:42 +00:00 committed by Kubernetes Publisher
parent 6fb7281a6b
commit ea9c745386
11 changed files with 46 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/features/kube_features.go
View File

@ -125,6 +125,7 @@ const (
// owner: @aramase
// kep: https://kep.k8s.io/3299
// alpha: v1.25
// beta: v1.27
//
// Enables KMS v2 API for encryption at rest.
KMSv2 featuregate.Feature = "KMSv2"
@ -244,7 +245,7 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS
EfficientWatchResumption: {Default: true, PreRelease: featuregate.GA, LockToDefault: true},
KMSv2: {Default: false, PreRelease: featuregate.Alpha},
KMSv2: {Default: true, PreRelease: featuregate.Beta},
OpenAPIEnums: {Default: true, PreRelease: featuregate.Beta},

12
pkg/server/options/encryptionconfig/config_test.go
View File

@ -108,7 +108,7 @@ func (t *testKMSv2EnvelopeService) Status(ctx context.Context) (*kmsservice.Stat
if t.err != nil {
return nil, t.err
}
return &kmsservice.StatusResponse{Healthz: "ok", KeyID: t.keyID, Version: "v2alpha1"}, nil
return &kmsservice.StatusResponse{Healthz: "ok", KeyID: t.keyID, Version: "v2beta1"}, nil
}
// The factory method to create mock envelope service.
@ -1565,7 +1565,7 @@ func TestIsKMSv2ProviderHealthyError(t *testing.T) {
statusResponse: &kmsservice.StatusResponse{
Healthz: "unhealthy",
},
expectedErr: "got unexpected healthz status: unhealthy, expected KMSv2 API version v2alpha1, got , got invalid KMSv2 KeyID ",
expectedErr: "got unexpected healthz status: unhealthy, expected KMSv2 API version v2beta1, got , got invalid KMSv2 KeyID ",
wantMetrics: `
# HELP apiserver_envelope_encryption_invalid_key_id_from_status_total [ALPHA] Number of times an invalid keyID is returned by the Status RPC call split by error.
# TYPE apiserver_envelope_encryption_invalid_key_id_from_status_total counter
@ -1573,11 +1573,11 @@ func TestIsKMSv2ProviderHealthyError(t *testing.T) {
`,
},
{
desc: "version is not v2alpha1",
desc: "version is not v2beta1",
statusResponse: &kmsservice.StatusResponse{
Version: "v1beta1",
},
expectedErr: "got unexpected healthz status: , expected KMSv2 API version v2alpha1, got v1beta1, got invalid KMSv2 KeyID ",
expectedErr: "got unexpected healthz status: , expected KMSv2 API version v2beta1, got v1beta1, got invalid KMSv2 KeyID ",
wantMetrics: `
# HELP apiserver_envelope_encryption_invalid_key_id_from_status_total [ALPHA] Number of times an invalid keyID is returned by the Status RPC call split by error.
# TYPE apiserver_envelope_encryption_invalid_key_id_from_status_total counter
@ -1588,7 +1588,7 @@ func TestIsKMSv2ProviderHealthyError(t *testing.T) {
desc: "missing keyID",
statusResponse: &kmsservice.StatusResponse{
Healthz: "ok",
Version: "v2alpha1",
Version: "v2beta1",
},
expectedErr: "got invalid KMSv2 KeyID ",
wantMetrics: `
@ -1601,7 +1601,7 @@ func TestIsKMSv2ProviderHealthyError(t *testing.T) {
desc: "invalid long keyID",
statusResponse: &kmsservice.StatusResponse{
Healthz: "ok",
Version: "v2alpha1",
Version: "v2beta1",
KeyID: sampleInvalidKeyID,
},
expectedErr: "got invalid KMSv2 KeyID ",

4
pkg/storage/value/encrypt/envelope/kmsv2/envelope.go
View File

@ -35,7 +35,7 @@ import (
genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
"k8s.io/apiserver/pkg/storage/value"
aestransformer "k8s.io/apiserver/pkg/storage/value/encrypt/aes"
kmstypes "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/v2alpha1"
kmstypes "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/v2"
"k8s.io/apiserver/pkg/storage/value/encrypt/envelope/metrics"
"k8s.io/klog/v2"
kmsservice "k8s.io/kms/pkg/service"
@ -49,7 +49,7 @@ func init() {
const (
// KMSAPIVersion is the version of the KMS API.
KMSAPIVersion = "v2alpha1"
KMSAPIVersion = "v2beta1"
// annotationsMaxSize is the maximum size of the annotations.
annotationsMaxSize = 32 * 1024 // 32 kB
// KeyIDMaxSize is the maximum size of the keyID.

2
pkg/storage/value/encrypt/envelope/kmsv2/envelope_test.go
View File

@ -35,7 +35,7 @@ import (
"k8s.io/apimachinery/pkg/util/uuid"
genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
"k8s.io/apiserver/pkg/storage/value"
kmstypes "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/v2alpha1"
kmstypes "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/v2"
"k8s.io/apiserver/pkg/storage/value/encrypt/envelope/metrics"
"k8s.io/component-base/metrics/legacyregistry"
"k8s.io/component-base/metrics/testutil"

2
pkg/storage/value/encrypt/envelope/kmsv2/grpc_service.go
View File

@ -29,7 +29,7 @@ import (
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
"k8s.io/apiserver/pkg/storage/value/encrypt/envelope/metrics"
"k8s.io/klog/v2"
kmsapi "k8s.io/kms/apis/v2alpha1"
kmsapi "k8s.io/kms/apis/v2"
kmsservice "k8s.io/kms/pkg/service"
"k8s.io/kms/pkg/util"
)

15
pkg/storage/value/encrypt/envelope/kmsv2/grpc_service_unix_test.go
View File

@ -25,11 +25,10 @@ import (
"testing"
"time"
"k8s.io/apiserver/pkg/storage/value/encrypt/envelope/metrics"
mock "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/testing/v2alpha1"
"k8s.io/component-base/metrics/testutil"
"k8s.io/apimachinery/pkg/util/uuid"
"k8s.io/apiserver/pkg/storage/value/encrypt/envelope/metrics"
mock "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/testing/v2"
"k8s.io/component-base/metrics/testutil"
kmsservice "k8s.io/kms/pkg/service"
)
@ -441,7 +440,7 @@ func TestKMSOperationsMetric(t *testing.T) {
t.Fatalf("failed when execute encrypt, error: %v", err)
}
},
labelValues: []string{testProviderName, "/v2alpha1.KeyManagementService/Encrypt", "OK"},
labelValues: []string{testProviderName, "/v2.KeyManagementService/Encrypt", "OK"},
wantCount: 1,
},
{
@ -451,7 +450,7 @@ func TestKMSOperationsMetric(t *testing.T) {
t.Fatalf("failed when execute decrypt, error: %v", err)
}
},
labelValues: []string{testProviderName, "/v2alpha1.KeyManagementService/Decrypt", "OK"},
labelValues: []string{testProviderName, "/v2.KeyManagementService/Decrypt", "OK"},
wantCount: 1,
},
{
@ -461,7 +460,7 @@ func TestKMSOperationsMetric(t *testing.T) {
t.Fatalf("failed when execute status, error: %v", err)
}
},
labelValues: []string{testProviderName, "/v2alpha1.KeyManagementService/Status", "OK"},
labelValues: []string{testProviderName, "/v2.KeyManagementService/Status", "OK"},
wantCount: 1,
},
{
@ -473,7 +472,7 @@ func TestKMSOperationsMetric(t *testing.T) {
}
}
},
labelValues: []string{testProviderName, "/v2alpha1.KeyManagementService/Status", "OK"},
labelValues: []string{testProviderName, "/v2.KeyManagementService/Status", "OK"},
wantCount: 10,
},
}

0
pkg/storage/value/encrypt/envelope/kmsv2/v2alpha1/OWNERS → pkg/storage/value/encrypt/envelope/kmsv2/v2/OWNERS
View File

40
pkg/storage/value/encrypt/envelope/kmsv2/v2alpha1/api.pb.go → pkg/storage/value/encrypt/envelope/kmsv2/v2/api.pb.go
View File

@ -17,7 +17,7 @@ limitations under the License.
// Code generated by protoc-gen-gogo. DO NOT EDIT.
// source: api.proto
package v2alpha1
package v2
import (
fmt "fmt"
@ -104,28 +104,28 @@ func (m *EncryptedObject) GetAnnotations() map[string][]byte {
}
func init() {
proto.RegisterType((*EncryptedObject)(nil), "v2alpha1.EncryptedObject")
proto.RegisterMapType((map[string][]byte)(nil), "v2alpha1.EncryptedObject.AnnotationsEntry")
proto.RegisterType((*EncryptedObject)(nil), "v2.EncryptedObject")
proto.RegisterMapType((map[string][]byte)(nil), "v2.EncryptedObject.AnnotationsEntry")
}
func init() { proto.RegisterFile("api.proto", fileDescriptor_00212fb1f9d3bf1c) }
var fileDescriptor_00212fb1f9d3bf1c = []byte{
// 252 bytes of a gzipped FileDescriptorProto
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x5c, 0x90, 0xc1, 0x4b, 0xf3, 0x30,
0x18, 0xc6, 0xe9, 0xfa, 0x7d, 0x62, 0xb3, 0x8a, 0x23, 0x78, 0x28, 0x9e, 0xca, 0xf0, 0x50, 0x3c,
0x24, 0x58, 0x2f, 0xc3, 0x83, 0xe0, 0x68, 0x0f, 0xa2, 0x20, 0xe4, 0xe8, 0xed, 0xdd, 0x7c, 0x99,
0x35, 0x35, 0x09, 0x49, 0x0c, 0xf4, 0xaf, 0x57, 0x96, 0x59, 0xe6, 0x76, 0xcb, 0xf3, 0xf0, 0x7b,
0xe0, 0x97, 0x97, 0x64, 0x60, 0x3a, 0x66, 0xac, 0xf6, 0x9a, 0x9e, 0x86, 0x1a, 0x7a, 0xf3, 0x0e,
0x37, 0xf3, 0xef, 0x84, 0x9c, 0xb7, 0x6a, 0x6d, 0x07, 0xe3, 0xf1, 0xed, 0x65, 0xf5, 0x81, 0x6b,
0x4f, 0xaf, 0xc8, 0x19, 0x8e, 0x55, 0x03, 0x1e, 0x8a, 0xa4, 0x4c, 0xaa, 0x5c, 0x1c, 0x96, 0xf4,
0x82, 0xfc, 0x97, 0x38, 0x3c, 0x36, 0xc5, 0xa4, 0x4c, 0xaa, 0x4c, 0xec, 0x02, 0x9d, 0x93, 0x7c,
0x8f, 0xb5, 0x4f, 0x45, 0x1a, 0xa7, 0x07, 0x1d, 0x7d, 0x26, 0x53, 0x50, 0x4a, 0x7b, 0xf0, 0x9d,
0x56, 0xae, 0xf8, 0x57, 0xa6, 0xd5, 0xb4, 0xbe, 0x66, 0xa3, 0x13, 0x3b, 0xf2, 0x61, 0x0f, 0x7b,
0xb8, 0x55, 0xde, 0x0e, 0xe2, 0xef, 0xfc, 0xf2, 0x9e, 0xcc, 0x8e, 0x01, 0x3a, 0x23, 0xa9, 0xc4,
0x21, 0x7a, 0x67, 0x62, 0xfb, 0xdc, 0xda, 0x06, 0xe8, 0xbf, 0x30, 0xda, 0xe6, 0x62, 0x17, 0xee,
0x26, 0x8b, 0x64, 0xd9, 0xbc, 0x2e, 0xe5, 0xc2, 0xb1, 0x4e, 0x73, 0x30, 0x9d, 0x43, 0x1b, 0xd0,
0x72, 0x23, 0x37, 0xdc, 0x79, 0x6d, 0x61, 0x83, 0x3c, 0x92, 0xfc, 0xf7, 0x03, 0x1c, 0x55, 0xc0,
0x5e, 0x1b, 0xe4, 0xf2, 0xd3, 0x85, 0x9a, 0x8f, 0xce, 0xab, 0x93, 0x78, 0xd8, 0xdb, 0x9f, 0x00,
0x00, 0x00, 0xff, 0xff, 0x37, 0xf9, 0x4d, 0xc2, 0x65, 0x01, 0x00, 0x00,
// 244 bytes of a gzipped FileDescriptorProto
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x5c, 0x90, 0xb1, 0x4b, 0x03, 0x31,
0x14, 0xc6, 0xc9, 0x9d, 0x0a, 0x97, 0x9e, 0x58, 0x82, 0xc3, 0xe1, 0x74, 0x94, 0x0e, 0x37, 0x25,
0x10, 0x97, 0x22, 0x52, 0x50, 0x7a, 0x82, 0x38, 0x08, 0x19, 0xdd, 0xd2, 0xfa, 0x28, 0x67, 0x6a,
0x12, 0x92, 0x18, 0xc8, 0x9f, 0xee, 0x26, 0x4d, 0x95, 0xda, 0xdb, 0xde, 0xf7, 0xf1, 0xfb, 0xe0,
0xc7, 0xc3, 0x95, 0xb4, 0x03, 0xb5, 0xce, 0x04, 0x43, 0x8a, 0xc8, 0x67, 0xdf, 0x08, 0x5f, 0xf5,
0x7a, 0xe3, 0x92, 0x0d, 0xf0, 0xfe, 0xba, 0xfe, 0x80, 0x4d, 0x20, 0x73, 0x7c, 0x09, 0x7f, 0xd5,
0x4a, 0x06, 0xd9, 0xa0, 0x16, 0x75, 0xb5, 0x38, 0x2d, 0xc9, 0x35, 0x3e, 0x57, 0x90, 0x9e, 0x57,
0x4d, 0xd1, 0xa2, 0xae, 0x12, 0x87, 0x40, 0x66, 0xb8, 0x3e, 0x62, 0xfd, 0x4b, 0x53, 0xe6, 0xe9,
0x49, 0x47, 0x9e, 0xf0, 0x44, 0x6a, 0x6d, 0x82, 0x0c, 0x83, 0xd1, 0xbe, 0x39, 0x6b, 0xcb, 0x6e,
0xc2, 0xe7, 0x34, 0x72, 0x3a, 0x32, 0xa1, 0x0f, 0x47, 0xac, 0xd7, 0xc1, 0x25, 0xf1, 0x7f, 0x78,
0xb3, 0xc4, 0xd3, 0x31, 0x40, 0xa6, 0xb8, 0x54, 0x90, 0xb2, 0x71, 0x25, 0xf6, 0xe7, 0xde, 0x33,
0xca, 0xdd, 0x17, 0x64, 0xcf, 0x5a, 0x1c, 0xc2, 0x5d, 0xb1, 0x40, 0x8f, 0xcb, 0xb7, 0x7b, 0xb5,
0xf0, 0x74, 0x30, 0x4c, 0xda, 0xc1, 0x83, 0x8b, 0xe0, 0x98, 0x55, 0x5b, 0xe6, 0x83, 0x71, 0x72,
0x0b, 0x2c, 0x93, 0xec, 0x57, 0x9d, 0x81, 0x8e, 0xb0, 0x33, 0x16, 0x98, 0xfa, 0xf4, 0x91, 0xb3,
0xc8, 0xd7, 0x17, 0xf9, 0x8d, 0xb7, 0x3f, 0x01, 0x00, 0x00, 0xff, 0xff, 0x00, 0x80, 0x43, 0x93,
0x53, 0x01, 0x00, 0x00,
}

4
pkg/storage/value/encrypt/envelope/kmsv2/v2alpha1/api.proto → pkg/storage/value/encrypt/envelope/kmsv2/v2/api.proto
View File

@ -17,8 +17,8 @@ limitations under the License.
// To regenerate api.pb.go run `hack/update-codegen.sh protobindings`
syntax = "proto3";
package v2alpha1;
option go_package = "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/v2alpha1";
package v2;
option go_package = "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/v2";
// EncryptedObject is the representation of data stored in etcd after envelope encryption.
message EncryptedObject {

4
pkg/storage/value/encrypt/envelope/kmsv2/v2alpha1/v2alpha1.go → pkg/storage/value/encrypt/envelope/kmsv2/v2/v2.go
View File

@ -14,5 +14,5 @@ See the License for the specific language governing permissions and
limitations under the License.
*/
// Package v2alpha1 contains definition of kms-plugin's serialized types.
package v2alpha1
// Package v2 contains definition of kms-plugin's serialized types.
package v2

6
pkg/storage/value/encrypt/envelope/testing/v2alpha1/kms_plugin_mock.go → pkg/storage/value/encrypt/envelope/testing/v2/kms_plugin_mock.go
View File

@ -17,7 +17,7 @@ See the License for the specific language governing permissions and
limitations under the License.
*/
package v2alpha1
package v2
import (
"context"
@ -36,7 +36,7 @@ import (
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/klog/v2"
kmsapi "k8s.io/kms/apis/v2alpha1"
kmsapi "k8s.io/kms/apis/v2"
)
const (
@ -44,7 +44,7 @@ const (
unixProtocol = "unix"
// Current version for the protocol interface definition.
kmsapiVersion = "v2alpha1"
kmsapiVersion = "v2beta1"
)
// Base64Plugin gRPC sever for a mock KMS provider.