github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
k3s/staging
History
Kubernetes Submit Queue f893cddfba Merge pull request #46460 from sakshamsharma/location_transformer 
Automatic merge from submit-queue (batch tested with PRs 46550, 46663, 46816, 46820, 46460)

Add configuration for encryption providers

## Additions

Allows providing a configuration file (using flag `--experimental-encryption-provider-config`) to use the existing AEAD transformer (with multiple keys) by composing mutable transformer, prefix transformer (for parsing providerId), another prefix transformer (for parsing keyId), and AES-GCM transformers (one for each key). Multiple providers can be configured using the configuration file.

Example configuration:
```
kind: EncryptionConfig
apiVersion: v1
resources:
  - resources:
    - namespaces
    providers:
    - aes:
        keys:
        - name: key1
          secret: c2vjcmv0iglzihnly3vyzq==
        - name: key2
          secret: dghpcybpcybwyxnzd29yza==
    - identity: {}
```

Need for configuration discussed in:
#41939
[Encryption](3418b4e4c6/contributors/design-proposals/encryption.md)

**Pathway of a read/write request**:
1. MutableTransformer
2. PrefixTransformer reads the provider-id, and passes the request further if that matches.
3. PrefixTransformer reads the key-id, and passes the request further if that matches.
4. GCMTransformer tries decrypting and authenticating the cipher text in case of reads. Similarly for writes.

## Caveats
1. To keep the command line parameter parsing independent of the individual transformer's configuration, we need to convert the configuration to an `interface{}` and manually parse it in the transformer. Suggestions on better ways to do this are welcome.

2. Flags `--encryption-provider` and `--encrypt-resource` (both mentioned in [this document](3418b4e4c6/contributors/design-proposals/encryption.md) ) are not supported in this because they do not allow more than one provider, and the current format for the configuration file possibly supersedes their functionality.

3. Currently, it can be tested by adding `--experimental-encryption-provider-config=config.yml` to `hack/local-up-cluster.sh` on line 511, and placing the above configuration in `config.yml` in the root project directory.

Previous discussion on these changes:
https://github.com/sakshamsharma/kubernetes/pull/1

@jcbsmpsn @destijl @smarterclayton

## TODO
1. Investigate if we need to store keys on disk (per [encryption.md](3418b4e4c6/contributors/design-proposals/encryption.md (option-1-simple-list-of-keys-on-disk)))
2. Look at [alpha flag conventions](https://github.com/kubernetes/kubernetes/blob/master/pkg/features/kube_features.go)
3. Need to reserve `k8s:enc` prefix formally for encrypted data. Else find a better way to detect transformed data.
 		2017-06-05 16:43:48 -07:00
..
src/k8s.io Merge pull request #46460 from sakshamsharma/location_transformer 2017-06-05 16:43:48 -07:00
OWNERS Add OWNERS for staging and api 2017-04-19 15:58:09 -04:00
README.md Update staging README to reflect multiple repos 2017-05-12 13:19:50 -07:00
copy.sh [update-staging] convert package name in IDL 2017-05-26 19:59:06 -04:00
godeps-json-updater.go Clean up staging/godeps-json-updater.go 2017-04-06 09:32:57 +02:00
prime-apimachinery.sh k8s.io/apimachinery scripts 2017-01-11 08:15:34 -05:00

README.md

This directory is the staging area for packages that have been split to their own repository. The content here will be periodically published to respective top-level k8s.io repositories.

Most code in the staging/ directory is authoritative, i.e. the only copy of the code. You can directly modify such code. However the packages in staging/src/k8s.io/client-go/pkg are copied from pkg/. If you modify the original code in pkg/, you need to run hack/godep-restore.sh from the k8s root directory, followed by hack/update-staging-client-go.sh. We are working towards making all code in staging/ authoritative.

The vendor/k8s.io directory contains symlinks pointing to this staging area, so to use a package in the staging area, you can import it as k8s.io/<package-name>, as if the package were vendored. Packages will be vendored from k8s.io/<package-name> for real after the test matrix is converted to vendor k8s components.