Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Introduce apiserver.config.k8s.io/v1 and use standard method for parsing encryption config file #67383

Merged
merged 2 commits into from
Nov 17, 2018
Merged

Introduce apiserver.config.k8s.io/v1 and use standard method for parsing encryption config file #67383

merged 2 commits into from
Nov 17, 2018

Conversation

stlaz
Copy link
Member

@stlaz stlaz commented Aug 14, 2018 •
edited by liggitt
Loading

What this PR does / why we need it:
This PR reworks handling of the configuration file for encryption at rest. Now it uses a standard approach for parsing and also it supports versioning. Also bumps encryption config to v1 (see #63032 (comment) for reasons)

/sig auth
/release-note-none
CC @simo5 @marrrvin @luxas

Fixes: #61420
Fixes: #61599

Obsoletes PR #63032

The API server encryption configuration file format has graduated to stable and moved to `apiVersion: apiserver.config.k8s.io/v1` and `kind: EncryptionConfiguration`.

@k8s-ci-robot k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 14, 2018
@k8s-ci-robot k8s-ci-robot requested review from bowei and enisoc August 14, 2018 12:03
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Aug 14, 2018
@stlaz stlaz changed the title Enc config promotion Introduce apiserver.config.k8s.io/v1 and use standard method for parsing encryption config file Aug 14, 2018
@stlaz
Copy link
Member Author

stlaz commented Aug 14, 2018

/release-note-none

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Aug 14, 2018
@neolit123
Copy link
Member

/ok-to-test
probably best to add a release note for this.

@k8s-ci-robot k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 14, 2018
@stlaz
Copy link
Member Author

stlaz commented Aug 15, 2018

/retest
Thanks, I'll add a release note on the way.

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Aug 16, 2018
@stlaz
Copy link
Member Author

stlaz commented Aug 16, 2018

Added a release note.

@stlaz
Copy link
Member Author

stlaz commented Aug 23, 2018

CC @liggitt @sttts @ericchiang as you were reviewing the original PR, too.

sttts
sttts reviewed Aug 23, 2018
View reviewed changes
staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config.go Outdated
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apimachinery/pkg/runtime/serializer"
kubecfg "k8s.io/apiserver/pkg/apis/config"
kubecfgv1 "k8s.io/apiserver/pkg/apis/config/v1"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

apiserverconfigv1

sttts
sttts reviewed Aug 23, 2018
View reviewed changes
test/integration/master/transformation_testcase.go Outdated
@@ -33,7 +33,7 @@ import (

corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apiserver/pkg/server/options/encryptionconfig"
kubecfgv1 "k8s.io/apiserver/pkg/apis/config/v1"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

apiserverconfigv1

@dims
Copy link
Member

dims commented Aug 23, 2018

/milestone v1.12

We need this for 1.12 right? please clear milestone if not

@k8s-ci-robot k8s-ci-robot added this to the v1.12 milestone Aug 23, 2018
@liggitt liggitt mentioned this pull request Aug 29, 2018
Closed
@liggitt
Copy link
Member

liggitt commented Aug 29, 2018

apologies for the delay on this and #63032 ... the bandwidth for component config review in 1.12 got consumed by the coarse-grained changes to split by component (#67233). I anticipate more progress being made on the apiserver config bits post-freeze.

@liggitt
Copy link
Member

liggitt commented Nov 13, 2018

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 13, 2018
@liggitt
Copy link
Member

liggitt commented Nov 13, 2018

staging godeps need updating (hack/update-staging-godeps.sh)

@liggitt
Copy link
Member

liggitt commented Nov 13, 2018

cc @immutableT for gce encryption config change. can you review and tag the appropriate approver?

@stlaz stlaz force-pushed the enc_config_promotion branch from 471bfcf to 628d1fe Compare November 13, 2018 17:05
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 13, 2018
@stlaz
Copy link
Member Author

stlaz commented Nov 13, 2018

Updated godeps. Hopefully everything will be alright now.

@liggitt
Copy link
Member

liggitt commented Nov 13, 2018

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 13, 2018
@liggitt
Copy link
Member

liggitt commented Nov 14, 2018 •
edited
Loading

/assign @mikedanese
for approval of cluster/gce changes

@mikedanese
Copy link
Member

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, mikedanese, stlaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 16, 2018
@cjwagner
Copy link
Member

Please add the appropriate priority/* label to this PR.

@liggitt
Copy link
Member

liggitt commented Nov 16, 2018

/priority important-soon

@k8s-ci-robot k8s-ci-robot added the priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. label Nov 16, 2018
@liggitt
Copy link
Member

liggitt commented Nov 16, 2018

@stlaz can you open a PR against https://github.com/kubernetes/website/tree/dev-1.13 updating the documentation around the encryption config file, noting the apiVersion and kind as of 1.13?

@liggitt
Copy link
Member

liggitt commented Nov 16, 2018

/retest

@AishSundar
Copy link
Contributor

/priority critical-urgent
/remove-priority important-soon

@k8s-ci-robot k8s-ci-robot added priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. and removed priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. labels Nov 16, 2018
@k8s-ci-robot k8s-ci-robot merged commit 1e22f08 into kubernetes:master Nov 17, 2018
@k8s-ci-robot
Copy link
Contributor

@stlaz: The following test failed, say /retest to rerun them all:

Test name Commit Details Rerun command
pull-kubernetes-e2e-gke 628d1fe link /test pull-kubernetes-e2e-gke

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@stlaz
Copy link
Member Author

stlaz commented Nov 17, 2018

@liggitt I will open a doc PR later today.

This was referenced Nov 18, 2018
Merged
Merged
Merged
@stlaz stlaz mentioned this pull request Apr 1, 2022
Closed
9 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@smarterclayton smarterclayton smarterclayton left review comments

@liggitt liggitt liggitt left review comments

@sttts sttts sttts left review comments

@php-coder php-coder php-coder left review comments

@bowei bowei Awaiting requested review from bowei

@enisoc enisoc Awaiting requested review from enisoc

Assignees

@dims dims

@liggitt liggitt

@smarterclayton smarterclayton

@mikedanese mikedanese

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. sig/network Categorizes an issue or PR as relevant to SIG Network. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
v1.13
Development

Successfully merging this pull request may close these issues.