Library for writing a Kubernetes-style API server.

Go to file

Monis Khan 254de03ce9 kmsv2: re-use DEK while key ID is unchanged This change updates KMS v2 to not create a new DEK for every encryption. Instead, we re-use the DEK while the key ID is stable. Specifically: We no longer use a random 12 byte nonce per encryption. Instead, we use both a random 4 byte nonce and an 8 byte nonce set via an atomic counter. Since each DEK is randomly generated and never re-used, the combination of DEK and counter are always unique. Thus there can never be a nonce collision. AES GCM strongly encourages the use of a 12 byte nonce, hence the additional 4 byte random nonce. We could leave those 4 bytes set to all zeros, but there is no harm in setting them to random data (it may help in some edge cases such as live VM migration). If the plugin is not healthy, the last DEK will be used for encryption for up to three minutes (there is no difference on the behavior of reads which have always used the DEK cache). This will reduce the impact of a short plugin outage while making it easy to perform storage migration after a key ID change (i.e. simply wait ten minutes after the key ID change before starting the migration). The DEK rotation cycle is performed in sync with the KMS v2 status poll thus we always have the correct information to determine if a read is stale in regards to storage migration. Signed-off-by: Monis Khan <mok@microsoft.com> Kubernetes-commit: 832d6f0e19f13b9dd22b1fe9d705817e9e64f4f1		2023-02-24 16:51:08 -05:00
.github	delete all duplicate empty blanks	2019-02-22 09:43:51 +08:00
pkg	kmsv2: re-use DEK while key ID is unchanged	2023-02-24 16:51:08 -05:00
plugin/pkg	Close body when Report non-OK status code	2022-10-09 11:22:10 +08:00
.import-restrictions	convert .import-restrictions to yaml	2020-04-22 15:41:00 -07:00
CONTRIBUTING.md	Update deprecated links	2019-02-04 13:28:31 -05:00
LICENSE	Add README and LICENSE to staging repos	2017-10-23 16:39:02 +05:30
OWNERS	Cleanup OWNERS files (No Activity in the last year)	2021-12-10 15:18:50 -05:00
README.md	staging: add dummy commit to trigger gomod update (#106794 )	2021-12-03 09:33:42 +00:00
SECURITY_CONTACTS	update security contacts for apimachinery repos	2020-07-02 16:00:53 -04:00
code-of-conduct.md	Add code-of-conduct.md to staging repos	2017-12-20 15:21:56 -05:00
doc.go	Make package paths referenced by import boss valid	2021-09-28 13:06:39 -04:00
go.mod	apiserver: exclude APF queue wait time from SLO latency metrics (#116420 )	2023-03-15 07:35:21 +00:00
go.sum	apiserver: exclude APF queue wait time from SLO latency metrics (#116420 )	2023-03-15 07:35:21 +00:00

README.md

apiserver

Generic library for building a Kubernetes aggregated API server.

Purpose

This library contains code to create Kubernetes aggregation server complete with delegated authentication and authorization, kubectl compatible discovery information, optional admission chain, and versioned types. It's first consumers are k8s.io/kubernetes, k8s.io/kube-aggregator, and github.com/kubernetes-incubator/service-catalog.

Compatibility

There are NO compatibility guarantees for this repository, yet. It is in direct support of Kubernetes, so branches will track Kubernetes and be compatible with that repo. As we more cleanly separate the layers, we will review the compatibility guarantee. We have a goal to make this easier to use in the future.

Where does it come from?

apiserver is synced from https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver. Code changes are made in that location, merged into k8s.io/kubernetes and later synced here.

Things you should NOT do

Directly modify any files under pkg in this repo. Those are driven from k8s.io/kubernetes/staging/src/k8s.io/apiserver.
Expect compatibility. This repo is changing quickly in direct support of Kubernetes and the API isn't yet stable enough for API guarantees.