mirror of https://github.com/k3s-io/k3s
f893cddfba
Automatic merge from submit-queue (batch tested with PRs 46550, 46663, 46816, 46820, 46460)
Add configuration for encryption providers
## Additions
Allows providing a configuration file (using flag `--experimental-encryption-provider-config`) to use the existing AEAD transformer (with multiple keys) by composing mutable transformer, prefix transformer (for parsing providerId), another prefix transformer (for parsing keyId), and AES-GCM transformers (one for each key). Multiple providers can be configured using the configuration file.
Example configuration:
```
kind: EncryptionConfig
apiVersion: v1
resources:
- resources:
- namespaces
providers:
- aes:
keys:
- name: key1
secret: c2vjcmv0iglzihnly3vyzq==
- name: key2
secret: dghpcybpcybwyxnzd29yza==
- identity: {}
```
Need for configuration discussed in:
#41939
[Encryption](
|
||
|---|---|---|
| .. | ||
| clicheck | ||
| cloud-controller-manager | ||
| gendocs | ||
| genkubedocs | ||
| genman | ||
| genslateyaml | ||
| genswaggertypedocs | ||
| genutils | ||
| genyaml | ||
| gke-certificates-controller | ||
| hyperkube | ||
| kube-apiserver | ||
| kube-controller-manager | ||
| kube-proxy | ||
| kubeadm | ||
| kubectl | ||
| kubelet | ||
| kubemark | ||
| libs/go2idl | ||
| linkcheck | ||
| mungedocs | ||
| BUILD | ||
| OWNERS | ||