kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8963 from rifelpet/automated-cherry-pick-of-#7900-origin-release-1.16 

Automated cherry pick of #7900: Add encryptionProviderConfig field
This commit is contained in:
Kubernetes Prow Robot 2020-04-23 05:53:46 -07:00 committed by GitHub
parent 4a41cdd10c 95aebaeaf4
commit b924da87dc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
11 changed files with 44 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
k8s/crds/kops.k8s.io_clusters.yaml
View File

@ -923,6 +923,10 @@ spec:
in the 'kube-system' namespace to be used for TLS bootstrapping
authentication
type: boolean
encryptionProviderConfig:
description: EncryptionProviderConfig enables encryption at rest
for secrets.
type: string
etcdCaFile:
description: EtcdCAFile is the path to a ca certificate
type: string

11
nodeup/pkg/model/kube_apiserver.go
View File

@ -59,13 +59,20 @@ func (b *KubeAPIServerBuilder) Build(c *fi.ModelBuilderContext) error {
if b.Cluster.Spec.EncryptionConfig != nil {
if *b.Cluster.Spec.EncryptionConfig && b.IsKubernetesGTE("1.7") {
b.Cluster.Spec.KubeAPIServer.ExperimentalEncryptionProviderConfig = fi.String(filepath.Join(b.PathSrvKubernetes(), "encryptionconfig.yaml"))
encryptionConfigPath := fi.String(filepath.Join(b.PathSrvKubernetes(), "encryptionconfig.yaml"))
if b.IsKubernetesGTE("1.13") {
b.Cluster.Spec.KubeAPIServer.EncryptionProviderConfig = encryptionConfigPath
} else {
b.Cluster.Spec.KubeAPIServer.ExperimentalEncryptionProviderConfig = encryptionConfigPath
}
key := "encryptionconfig"
encryptioncfg, _ := b.SecretStore.Secret(key)
if encryptioncfg != nil {
contents := string(encryptioncfg.Data)
t := &nodetasks.File{
Path: *b.Cluster.Spec.KubeAPIServer.ExperimentalEncryptionProviderConfig,
Path: *encryptionConfigPath,
Contents: fi.NewStringResource(contents),
Mode: fi.String("600"),
Type: nodetasks.FileType_File,

6
nodeup/pkg/model/kube_apiserver_test.go
View File

@ -128,6 +128,12 @@ func Test_KubeAPIServer_BuildFlags(t *testing.T) {
},
"--experimental-encryption-provider-config=/srv/kubernetes/encryptionconfig.yaml --insecure-port=0 --secure-port=0",
},
{
kops.KubeAPIServerConfig{
EncryptionProviderConfig: fi.String("/srv/kubernetes/encryptionconfig.yaml"),
},
"--encryption-provider-config=/srv/kubernetes/encryptionconfig.yaml --insecure-port=0 --secure-port=0",
},
{
kops.KubeAPIServerConfig{
TargetRamMb: 320,

2
pkg/apis/kops/componentconfig.go
View File

@ -396,6 +396,8 @@ type KubeAPIServerConfig struct {
AuthorizationWebhookCacheUnauthorizedTTL *metav1.Duration `json:"authorizationWebhookCacheUnauthorizedTtl,omitempty" flag:"authorization-webhook-cache-unauthorized-ttl"`
// AuthorizationRBACSuperUser is the name of the superuser for default rbac
AuthorizationRBACSuperUser *string `json:"authorizationRbacSuperUser,omitempty" flag:"authorization-rbac-super-user"`
// EncryptionProviderConfig enables encryption at rest for secrets.
EncryptionProviderConfig *string `json:"encryptionProviderConfig,omitempty" flag:"encryption-provider-config"`
// ExperimentalEncryptionProviderConfig enables encryption at rest for secrets.
ExperimentalEncryptionProviderConfig *string `json:"experimentalEncryptionProviderConfig,omitempty" flag:"experimental-encryption-provider-config"`

2
pkg/apis/kops/v1alpha1/componentconfig.go
View File

@ -396,6 +396,8 @@ type KubeAPIServerConfig struct {
AuthorizationWebhookCacheUnauthorizedTTL *metav1.Duration `json:"authorizationWebhookCacheUnauthorizedTtl,omitempty" flag:"authorization-webhook-cache-unauthorized-ttl"`
// AuthorizationRBACSuperUser is the name of the superuser for default rbac
AuthorizationRBACSuperUser *string `json:"authorizationRbacSuperUser,omitempty" flag:"authorization-rbac-super-user"`
// EncryptionProviderConfig enables encryption at rest for secrets.
EncryptionProviderConfig *string `json:"encryptionProviderConfig,omitempty" flag:"encryption-provider-config"`
// ExperimentalEncryptionProviderConfig enables encryption at rest for secrets.
ExperimentalEncryptionProviderConfig *string `json:"experimentalEncryptionProviderConfig,omitempty" flag:"experimental-encryption-provider-config"`

2
pkg/apis/kops/v1alpha1/zz_generated.conversion.go
View File

@ -3219,6 +3219,7 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.AuthorizationWebhookCacheAuthorizedTTL = in.AuthorizationWebhookCacheAuthorizedTTL
out.AuthorizationWebhookCacheUnauthorizedTTL = in.AuthorizationWebhookCacheUnauthorizedTTL
out.AuthorizationRBACSuperUser = in.AuthorizationRBACSuperUser
out.EncryptionProviderConfig = in.EncryptionProviderConfig
out.ExperimentalEncryptionProviderConfig = in.ExperimentalEncryptionProviderConfig
out.RequestheaderUsernameHeaders = in.RequestheaderUsernameHeaders
out.RequestheaderGroupHeaders = in.RequestheaderGroupHeaders
@ -3318,6 +3319,7 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko
out.AuthorizationWebhookCacheAuthorizedTTL = in.AuthorizationWebhookCacheAuthorizedTTL
out.AuthorizationWebhookCacheUnauthorizedTTL = in.AuthorizationWebhookCacheUnauthorizedTTL
out.AuthorizationRBACSuperUser = in.AuthorizationRBACSuperUser
out.EncryptionProviderConfig = in.EncryptionProviderConfig
out.ExperimentalEncryptionProviderConfig = in.ExperimentalEncryptionProviderConfig
out.RequestheaderUsernameHeaders = in.RequestheaderUsernameHeaders
out.RequestheaderGroupHeaders = in.RequestheaderGroupHeaders

5
pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go
View File

@ -1947,6 +1947,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
*out = new(string)
**out = **in
}
if in.EncryptionProviderConfig != nil {
in, out := &in.EncryptionProviderConfig, &out.EncryptionProviderConfig
*out = new(string)
**out = **in
}
if in.ExperimentalEncryptionProviderConfig != nil {
in, out := &in.ExperimentalEncryptionProviderConfig, &out.ExperimentalEncryptionProviderConfig
*out = new(string)

2
pkg/apis/kops/v1alpha2/componentconfig.go
View File

@ -396,6 +396,8 @@ type KubeAPIServerConfig struct {
AuthorizationWebhookCacheUnauthorizedTTL *metav1.Duration `json:"authorizationWebhookCacheUnauthorizedTtl,omitempty" flag:"authorization-webhook-cache-unauthorized-ttl"`
// AuthorizationRBACSuperUser is the name of the superuser for default rbac
AuthorizationRBACSuperUser *string `json:"authorizationRbacSuperUser,omitempty" flag:"authorization-rbac-super-user"`
// EncryptionProviderConfig enables encryption at rest for secrets.
EncryptionProviderConfig *string `json:"encryptionProviderConfig,omitempty" flag:"encryption-provider-config"`
// ExperimentalEncryptionProviderConfig enables encryption at rest for secrets.
ExperimentalEncryptionProviderConfig *string `json:"experimentalEncryptionProviderConfig,omitempty" flag:"experimental-encryption-provider-config"`

2
pkg/apis/kops/v1alpha2/zz_generated.conversion.go
View File

@ -3489,6 +3489,7 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.AuthorizationWebhookCacheAuthorizedTTL = in.AuthorizationWebhookCacheAuthorizedTTL
out.AuthorizationWebhookCacheUnauthorizedTTL = in.AuthorizationWebhookCacheUnauthorizedTTL
out.AuthorizationRBACSuperUser = in.AuthorizationRBACSuperUser
out.EncryptionProviderConfig = in.EncryptionProviderConfig
out.ExperimentalEncryptionProviderConfig = in.ExperimentalEncryptionProviderConfig
out.RequestheaderUsernameHeaders = in.RequestheaderUsernameHeaders
out.RequestheaderGroupHeaders = in.RequestheaderGroupHeaders
@ -3588,6 +3589,7 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko
out.AuthorizationWebhookCacheAuthorizedTTL = in.AuthorizationWebhookCacheAuthorizedTTL
out.AuthorizationWebhookCacheUnauthorizedTTL = in.AuthorizationWebhookCacheUnauthorizedTTL
out.AuthorizationRBACSuperUser = in.AuthorizationRBACSuperUser
out.EncryptionProviderConfig = in.EncryptionProviderConfig
out.ExperimentalEncryptionProviderConfig = in.ExperimentalEncryptionProviderConfig
out.RequestheaderUsernameHeaders = in.RequestheaderUsernameHeaders
out.RequestheaderGroupHeaders = in.RequestheaderGroupHeaders

5
pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
View File

@ -2018,6 +2018,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
*out = new(string)
**out = **in
}
if in.EncryptionProviderConfig != nil {
in, out := &in.EncryptionProviderConfig, &out.EncryptionProviderConfig
*out = new(string)
**out = **in
}
if in.ExperimentalEncryptionProviderConfig != nil {
in, out := &in.ExperimentalEncryptionProviderConfig, &out.ExperimentalEncryptionProviderConfig
*out = new(string)

5
pkg/apis/kops/zz_generated.deepcopy.go
View File

@ -2200,6 +2200,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
*out = new(string)
**out = **in
}
if in.EncryptionProviderConfig != nil {
in, out := &in.EncryptionProviderConfig, &out.EncryptionProviderConfig
*out = new(string)
**out = **in
}
if in.ExperimentalEncryptionProviderConfig != nil {
in, out := &in.ExperimentalEncryptionProviderConfig, &out.ExperimentalEncryptionProviderConfig
*out = new(string)