Merge pull request #67383 from stlaz/enc_config_promotion

Introduce apiserver.config.k8s.io/v1 and use standard method for parsing encryption config file
kubernetes · Nov 17, 2018 · 1e22f08 · 1e22f08
2 parents 859ab74 + 628d1fe
commit 1e22f08
Show file tree

Hide file tree

Showing 19 changed files with 1,154 additions and 88 deletions.
diff --git a/cluster/gce/config-default.sh b/cluster/gce/config-default.sh
@@ -219,8 +219,8 @@ fi
 ENCRYPTION_PROVIDER_CONFIG="${ENCRYPTION_PROVIDER_CONFIG:-}"
 if [[ -z "${ENCRYPTION_PROVIDER_CONFIG}" ]]; then
     ENCRYPTION_PROVIDER_CONFIG=$(cat << EOM | base64 | tr -d '\r\n'
-kind: EncryptionConfig
-apiVersion: v1
+kind: EncryptionConfiguration
+apiVersion: apiserver.config.k8s.io/v1
 resources:
   - resources:
     - secrets

diff --git a/staging/src/k8s.io/apiserver/pkg/apis/config/BUILD b/staging/src/k8s.io/apiserver/pkg/apis/config/BUILD
@@ -4,13 +4,18 @@ go_library(
     name = "go_default_library",
     srcs = [
         "doc.go",
+        "register.go",
         "types.go",
         "zz_generated.deepcopy.go",
     ],
     importmap = "k8s.io/kubernetes/vendor/k8s.io/apiserver/pkg/apis/config",
     importpath = "k8s.io/apiserver/pkg/apis/config",
     visibility = ["//visibility:public"],
-    deps = ["//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library"],
+    deps = [
+        "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+    ],
 )
 
 filegroup(
@@ -24,6 +29,7 @@ filegroup(
     name = "all-srcs",
     srcs = [
         ":package-srcs",
+        "//staging/src/k8s.io/apiserver/pkg/apis/config/v1:all-srcs",
         "//staging/src/k8s.io/apiserver/pkg/apis/config/v1alpha1:all-srcs",
         "//staging/src/k8s.io/apiserver/pkg/apis/config/validation:all-srcs",
     ],

diff --git a/staging/src/k8s.io/apiserver/pkg/apis/config/register.go b/staging/src/k8s.io/apiserver/pkg/apis/config/register.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var (
+	// SchemeBuilder points to a list of functions added to Scheme.
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	// AddToScheme adds this group to a scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)
+
+// GroupName is the group name use in this package.
+const GroupName = "apiserver.config.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind.
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource.
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+func addKnownTypes(scheme *runtime.Scheme) error {
+	// TODO this will get cleaned up with the scheme types are fixed
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&EncryptionConfiguration{},
+	)
+	return nil
+}
diff --git a/staging/src/k8s.io/apiserver/pkg/apis/config/types.go b/staging/src/k8s.io/apiserver/pkg/apis/config/types.go
@@ -56,3 +56,71 @@ type DebuggingConfiguration struct {
 	// enableProfiling is true.
 	EnableContentionProfiling bool
 }
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// EncryptionConfiguration stores the complete configuration for encryption providers.
+type EncryptionConfiguration struct {
+	metav1.TypeMeta
+	// resources is a list containing resources, and their corresponding encryption providers.
+	Resources []ResourceConfiguration
+}
+
+// ResourceConfiguration stores per resource configuration.
+type ResourceConfiguration struct {
+	// resources is a list of kubernetes resources which have to be encrypted.
+	Resources []string
+	// providers is a list of transformers to be used for reading and writing the resources to disk.
+	// eg: aesgcm, aescbc, secretbox, identity.
+	Providers []ProviderConfiguration
+}
+
+// ProviderConfiguration stores the provided configuration for an encryption provider.
+type ProviderConfiguration struct {
+	// aesgcm is the configuration for the AES-GCM transformer.
+	AESGCM *AESConfiguration
+	// aescbc is the configuration for the AES-CBC transformer.
+	AESCBC *AESConfiguration
+	// secretbox is the configuration for the Secretbox based transformer.
+	Secretbox *SecretboxConfiguration
+	// identity is the (empty) configuration for the identity transformer.
+	Identity *IdentityConfiguration
+	// kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.
+	KMS *KMSConfiguration
+}
+
+// AESConfiguration contains the API configuration for an AES transformer.
+type AESConfiguration struct {
+	// keys is a list of keys to be used for creating the AES transformer.
+	// Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.
+	Keys []Key
+}
+
+// SecretboxConfiguration contains the API configuration for an Secretbox transformer.
+type SecretboxConfiguration struct {
+	// keys is a list of keys to be used for creating the Secretbox transformer.
+	// Each key has to be 32 bytes long.
+	Keys []Key
+}
+
+// Key contains name and secret of the provided key for a transformer.
+type Key struct {
+	// name is the name of the key to be used while storing data to disk.
+	Name string
+	// secret is the actual key, encoded in base64.
+	Secret string
+}
+
+// IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.
+type IdentityConfiguration struct{}
+
+// KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.
+type KMSConfiguration struct {
+	// name is the name of the KMS plugin to be used.
+	Name string
+	// cacheSize is the maximum number of secrets which are cached in memory. The default value is 1000.
+	// +optional
+	CacheSize int32
+	// endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".
+	Endpoint string
+}
diff --git a/staging/src/k8s.io/apiserver/pkg/apis/config/v1/BUILD b/staging/src/k8s.io/apiserver/pkg/apis/config/v1/BUILD
@@ -0,0 +1,37 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "register.go",
+        "types.go",
+        "zz_generated.conversion.go",
+        "zz_generated.deepcopy.go",
+        "zz_generated.defaults.go",
+    ],
+    importmap = "k8s.io/kubernetes/vendor/k8s.io/apiserver/pkg/apis/config/v1",
+    importpath = "k8s.io/apiserver/pkg/apis/config/v1",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/conversion:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/apis/config:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)
diff --git a/staging/src/k8s.io/apiserver/pkg/apis/config/v1/doc.go b/staging/src/k8s.io/apiserver/pkg/apis/config/v1/doc.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:conversion-gen=k8s.io/apiserver/pkg/apis/config
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=apiserver.config.k8s.io
+
+// Package v1 is the v1 version of the API.
+package v1
diff --git a/staging/src/k8s.io/apiserver/pkg/apis/config/v1/register.go b/staging/src/k8s.io/apiserver/pkg/apis/config/v1/register.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName is the group name use in this package.
+const GroupName = "apiserver.config.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+var (
+	// SchemeBuilder points to a list of functions added to Scheme.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// AddToScheme adds this group to a scheme.
+	AddToScheme = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&EncryptionConfiguration{},
+	)
+	// also register into the v1 group as EncryptionConfig (due to a docs bug)
+	scheme.AddKnownTypeWithName(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "EncryptionConfig"}, &EncryptionConfiguration{})
+	return nil
+}
diff --git a/.../server/options/encryptionconfig/types.go → ....io/apiserver/pkg/apis/config/v1/types.go b/.../server/options/encryptionconfig/types.go → ....io/apiserver/pkg/apis/config/v1/types.go
@@ -14,50 +14,51 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package encryptionconfig
+package v1
 
-// EncryptionConfig stores the complete configuration for encryption providers.
-type EncryptionConfig struct {
-	// kind is the type of configuration file.
-	Kind string `json:"kind"`
-	// apiVersion is the API version this file has to be parsed as.
-	APIVersion string `json:"apiVersion"`
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// EncryptionConfiguration stores the complete configuration for encryption providers.
+type EncryptionConfiguration struct {
+	metav1.TypeMeta
 	// resources is a list containing resources, and their corresponding encryption providers.
-	Resources []ResourceConfig `json:"resources"`
+	Resources []ResourceConfiguration `json:"resources"`
 }
 
-// ResourceConfig stores per resource configuration.
-type ResourceConfig struct {
+// ResourceConfiguration stores per resource configuration.
+type ResourceConfiguration struct {
 	// resources is a list of kubernetes resources which have to be encrypted.
 	Resources []string `json:"resources"`
 	// providers is a list of transformers to be used for reading and writing the resources to disk.
 	// eg: aesgcm, aescbc, secretbox, identity.
-	Providers []ProviderConfig `json:"providers"`
+	Providers []ProviderConfiguration `json:"providers"`
 }
 
-// ProviderConfig stores the provided configuration for an encryption provider.
-type ProviderConfig struct {
+// ProviderConfiguration stores the provided configuration for an encryption provider.
+type ProviderConfiguration struct {
 	// aesgcm is the configuration for the AES-GCM transformer.
-	AESGCM *AESConfig `json:"aesgcm,omitempty"`
+	AESGCM *AESConfiguration `json:"aesgcm,omitempty"`
 	// aescbc is the configuration for the AES-CBC transformer.
-	AESCBC *AESConfig `json:"aescbc,omitempty"`
+	AESCBC *AESConfiguration `json:"aescbc,omitempty"`
 	// secretbox is the configuration for the Secretbox based transformer.
-	Secretbox *SecretboxConfig `json:"secretbox,omitempty"`
+	Secretbox *SecretboxConfiguration `json:"secretbox,omitempty"`
 	// identity is the (empty) configuration for the identity transformer.
-	Identity *IdentityConfig `json:"identity,omitempty"`
+	Identity *IdentityConfiguration `json:"identity,omitempty"`
 	// kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.
-	KMS *KMSConfig `json:"kms,omitempty"`
+	KMS *KMSConfiguration `json:"kms,omitempty"`
 }
 
-// AESConfig contains the API configuration for an AES transformer.
-type AESConfig struct {
+// AESConfiguration contains the API configuration for an AES transformer.
+type AESConfiguration struct {
 	// keys is a list of keys to be used for creating the AES transformer.
 	// Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.
 	Keys []Key `json:"keys"`
 }
 
-// SecretboxConfig contains the API configuration for an Secretbox transformer.
-type SecretboxConfig struct {
+// SecretboxConfiguration contains the API configuration for an Secretbox transformer.
+type SecretboxConfiguration struct {
 	// keys is a list of keys to be used for creating the Secretbox transformer.
 	// Each key has to be 32 bytes long.
 	Keys []Key `json:"keys"`
@@ -71,16 +72,16 @@ type Key struct {
 	Secret string `json:"secret"`
 }
 
-// IdentityConfig is an empty struct to allow identity transformer in provider configuration.
-type IdentityConfig struct{}
+// IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.
+type IdentityConfiguration struct{}
 
-// KMSConfig contains the name, cache size and path to configuration file for a KMS based envelope transformer.
-type KMSConfig struct {
+// KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.
+type KMSConfiguration struct {
 	// name is the name of the KMS plugin to be used.
 	Name string `json:"name"`
 	// cacheSize is the maximum number of secrets which are cached in memory. The default value is 1000.
 	// +optional
-	CacheSize int `json:"cachesize,omitempty"`
-	// the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".
+	CacheSize int32 `json:"cachesize,omitempty"`
+	// endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".
 	Endpoint string `json:"endpoint"`
 }