Documentation
¶
Index ¶
- Constants
- func ExtractUniqueAndSortedKMSConfigurations(secretData *Config) ([]*apiserverconfigv1.KMSConfiguration, error)
- func FormatKMSConfigMapDataKey(rawKey, keyID string) string
- func FormatKMSSecretDataKey(rawKey, keyID string) string
- func ToEncryptionState(secretData *Config, keySecrets []*corev1.Secret) (map[schema.GroupResource]state.GroupResourceState, []state.KeyState)
- func ToSecret(ns, name string, secretData *Config) (*corev1.Secret, error)
- type Config
- type KMSPluginsReferenceData
Constants ¶
const ( // EncryptionConfSecretName is the name of the final encryption config secret that is revisioned per apiserver rollout. EncryptionConfSecretName = "encryption-config" // EncryptionConfSecretKey is the map data key used to store the raw bytes of the final encryption config. EncryptionConfSecretKey = "encryption-config" )
Variables ¶
This section is empty.
Functions ¶
func ExtractUniqueAndSortedKMSConfigurations ¶
func ExtractUniqueAndSortedKMSConfigurations(secretData *Config) ([]*apiserverconfigv1.KMSConfiguration, error)
ExtractUniqueAndSortedKMSConfigurations collects deduplicated KMS providers from the EncryptionConfiguration, strips the resource suffix from each Name, and returns them sorted by keyID descending. Duplicate keyIDs with mismatched config (ignoring Name) error out.
func FormatKMSConfigMapDataKey ¶
FormatKMSConfigMapDataKey returns the data key used in the encryption-config Secret for a KMS plugin configmap entry: "kms-plugin-configmap-{rawKey}-{keyID}", where rawKey is the combined "configMapName_dataKey" from KMSReferenceData.FlatEntry.
Note:
It does not validate inputs. The callers are expected to use KMSReferenceData.Set, which rejects empty values and underscores in referenceName.
func FormatKMSSecretDataKey ¶
FormatKMSSecretDataKey returns the data key used in the encryption-config Secret for a KMS plugin secret entry: "kms-plugin-secret-{rawKey}-{keyID}", where rawKey is the combined "secretName_dataKey" from KMSSecretData.FlatEntry.
Note:
It does not validate inputs. The callers are expected to use KMSSecretData.Set, which rejects empty values and underscores in secretName.
func ToEncryptionState ¶
func ToEncryptionState(secretData *Config, keySecrets []*corev1.Secret) (map[schema.GroupResource]state.GroupResourceState, []state.KeyState)
ToEncryptionState converts config to state. Read keys contain a potential write key. Read keys are sorted, recent first.
It assumes: - the first provider provides the write key - the structure of the encryptionConfig matches the output generated by FromEncryptionState:
- one resource per provider
- one key per provider
- each resource has a distinct configuration with zero or more key based providers and the identity provider.
- the last providers might be of type aesgcm. Then it carries the names of identity keys, recent first. We never use aesgcm as a real key because it is unsafe.
Types ¶
type Config ¶
type Config struct {
Encryption *apiserverconfigv1.EncryptionConfiguration
// KMSPlugins maps keyID to plugin-specific configuration,
// carried from Key Secrets into the encryption-config Secret.
KMSPlugins map[string]configv1.KMSPluginConfig
// KMSPluginsSecretData maps keyID to secret data carried from
// Key Secrets into the encryption-config Secret.
// Structure: keyID → referenceName → dataKey → value.
KMSPluginsSecretData KMSPluginsReferenceData
// KMSPluginsConfigMapData maps keyID to configmap data carried from
// Key Secrets into the encryption-config Secret.
// Structure: keyID → referenceName → dataKey → value.
KMSPluginsConfigMapData KMSPluginsReferenceData
}
Config stores the EncryptionConfiguration and additional operator-managed encryption state that doesn't fit into the upstream type.
func FromEncryptionState ¶
func FromEncryptionState(encryptionState map[schema.GroupResource]state.GroupResourceState) (*Config, error)
FromEncryptionState converts encryption state to Config.
func (*Config) HasEncryptionConfiguration ¶
type KMSPluginsReferenceData ¶
type KMSPluginsReferenceData struct {
// contains filtered or unexported fields
}
KMSPluginsReferenceData maps keyID to reference data carried from Key Secrets into the encryption-config Secret. Structure: keyID → referenceName → dataKey → value.
func (*KMSPluginsReferenceData) FlatEntriesByKeyID ¶
func (d *KMSPluginsReferenceData) FlatEntriesByKeyID() map[string]map[string][]byte
FlatEntriesByKeyID returns the stored data as a map of keyID to flat entries, where each flat entry is keyed by "referenceName_dataKey".
func (*KMSPluginsReferenceData) Get ¶
func (d *KMSPluginsReferenceData) Get(keyID string) (state.KMSReferenceData, bool)
Get returns the KMSReferenceData for the given keyID and true if it exists, or a zero value and false otherwise. It is safe to call on a nil map.
func (*KMSPluginsReferenceData) SetFromRawKey ¶
func (d *KMSPluginsReferenceData) SetFromRawKey(keyID, rawKey string, value []byte) error
SetFromRawKey stores a value for the given keyID, splitting rawKey on "_" into referenceName and dataKey.
Source Files
Directories