github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[KMSv2] Mark KMS v1beta1 as deprecated with no further fixes (#119007)

Browse Source 
* add feature gate

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

* add validation and warning in load config

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

* mark v1beta1 proto message deprecated

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

---------

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
This commit is contained in:
Anish Ramasekar
2023-07-06 13:39:03 -07:00
committed by GitHub
parent d02d8ba635
commit 1acdb4ae86
6 changed files with 84 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
staging/src/k8s.io/apiserver/pkg/features/kube_features.go
View File

@@ -109,6 +109,13 @@ const (
// Allows for updating watchcache resource version with progress notify events. // Allows for updating watchcache resource version with progress notify events.
EfficientWatchResumption featuregate.Feature = "EfficientWatchResumption" EfficientWatchResumption featuregate.Feature = "EfficientWatchResumption"
// owner: @aramase
// kep: https://kep.k8s.io/3299
// deprecated: v1.28
//
// Enables KMS v1 API for encryption at rest.
KMSv1 featuregate.Feature = "KMSv1"
// owner: @aramase // owner: @aramase
// kep: https://kep.k8s.io/3299 // kep: https://kep.k8s.io/3299
// alpha: v1.25 // alpha: v1.25
@@ -232,6 +239,8 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS
EfficientWatchResumption: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, EfficientWatchResumption: {Default: true, PreRelease: featuregate.GA, LockToDefault: true},
KMSv1: {Default: true, PreRelease: featuregate.Deprecated},
KMSv2: {Default: true, PreRelease: featuregate.Beta}, KMSv2: {Default: true, PreRelease: featuregate.Beta},
OpenAPIEnums: {Default: true, PreRelease: featuregate.Beta}, OpenAPIEnums: {Default: true, PreRelease: featuregate.Beta},

5
staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config.go
View File

@@ -674,6 +674,11 @@ func kmsPrefixTransformer(ctx context.Context, config *apiserverconfig.KMSConfig
kmsName := config.Name kmsName := config.Name
switch config.APIVersion { switch config.APIVersion {
case kmsAPIVersionV1: case kmsAPIVersionV1:
if !utilfeature.DefaultFeatureGate.Enabled(features.KMSv1) {
return storagevalue.PrefixTransformer{}, nil, nil, fmt.Errorf("KMSv1 is deprecated and will only receive security updates going forward. Use KMSv2 instead. Set --feature-gates=KMSv1=true to use the deprecated KMSv1 feature.")
}
klog.InfoS("KMSv1 is deprecated and will only receive security updates going forward. Use KMSv2 instead.")
envelopeService, err := envelopeServiceFactory(ctx, config.Endpoint, config.Timeout.Duration) envelopeService, err := envelopeServiceFactory(ctx, config.Endpoint, config.Timeout.Duration)
if err != nil { if err != nil {
return storagevalue.PrefixTransformer{}, nil, nil, fmt.Errorf("could not configure KMSv1-Plugin's probe %q, error: %w", kmsName, err) return storagevalue.PrefixTransformer{}, nil, nil, fmt.Errorf("could not configure KMSv1-Plugin's probe %q, error: %w", kmsName, err)

34
staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config_test.go
View File

@@ -187,6 +187,7 @@ func TestLegacyConfig(t *testing.T) {
func TestEncryptionProviderConfigCorrect(t *testing.T) { func TestEncryptionProviderConfigCorrect(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv2, true)() defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv2, true)()
// Set factory for mock envelope service // Set factory for mock envelope service
factory := envelopeServiceFactory factory := envelopeServiceFactory
factoryKMSv2 := EnvelopeKMSv2ServiceFactory factoryKMSv2 := EnvelopeKMSv2ServiceFactory
@@ -318,6 +319,37 @@ func TestEncryptionProviderConfigCorrect(t *testing.T) {
} }
} }
func TestKMSv1Deprecation(t *testing.T) {
testCases := []struct {
name string
kmsv1Enabled bool
expectedErr string
}{
{
name: "config with kmsv1, KMSv1=false",
kmsv1Enabled: false,
expectedErr: "KMSv1 is deprecated and will only receive security updates going forward. Use KMSv2 instead. Set --feature-gates=KMSv1=true to use the deprecated KMSv1 feature.",
},
{
name: "config with kmsv1, KMSv1=true",
kmsv1Enabled: true,
expectedErr: "",
},
}
for _, testCase := range testCases {
t.Run(testCase.name, func(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, testCase.kmsv1Enabled)()
kmsv1Config := "testdata/valid-configs/kms/multiple-providers.yaml"
_, err := LoadEncryptionConfig(testContext(t), kmsv1Config, false)
if !strings.Contains(errString(err), testCase.expectedErr) {
t.Fatalf("expected error %q, got %q", testCase.expectedErr, errString(err))
}
})
}
}
func TestKMSMaxTimeout(t *testing.T) { func TestKMSMaxTimeout(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv2, true)() defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv2, true)()
@@ -717,6 +749,7 @@ func TestKMSPluginHealthz(t *testing.T) {
// tests for masking rules // tests for masking rules
func TestWildcardMasking(t *testing.T) { func TestWildcardMasking(t *testing.T) {
testCases := []struct { testCases := []struct {
desc string desc string
config *apiserverconfig.EncryptionConfiguration config *apiserverconfig.EncryptionConfiguration
@@ -1124,6 +1157,7 @@ func TestWildcardMasking(t *testing.T) {
} }
func TestWildcardStructure(t *testing.T) { func TestWildcardStructure(t *testing.T) {
testCases := []struct { testCases := []struct {
desc string desc string
expectedResourceTransformers map[string]string expectedResourceTransformers map[string]string

50
staging/src/k8s.io/kms/apis/v1beta1/api.pb.go
View File

@@ -15,7 +15,7 @@ limitations under the License.
*/ */
// Code generated by protoc-gen-gogo. DO NOT EDIT. // Code generated by protoc-gen-gogo. DO NOT EDIT.
// source: api.proto // api.proto is a deprecated file.
package v1beta1 package v1beta1
@@ -40,6 +40,7 @@ var _ = math.Inf
// proto package needs to be updated. // proto package needs to be updated.
const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
type VersionRequest struct { type VersionRequest struct {
// Version of the KMS plugin API. // Version of the KMS plugin API.
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"` Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
@@ -79,6 +80,7 @@ func (m *VersionRequest) GetVersion() string {
return "" return ""
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
type VersionResponse struct { type VersionResponse struct {
// Version of the KMS plugin API. // Version of the KMS plugin API.
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"` Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
@@ -136,6 +138,7 @@ func (m *VersionResponse) GetRuntimeVersion() string {
return "" return ""
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
type DecryptRequest struct { type DecryptRequest struct {
// Version of the KMS plugin API. // Version of the KMS plugin API.
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"` Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
@@ -184,6 +187,7 @@ func (m *DecryptRequest) GetCipher() []byte {
return nil return nil
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
type DecryptResponse struct { type DecryptResponse struct {
// The decrypted data. // The decrypted data.
Plain []byte `protobuf:"bytes,1,opt,name=plain,proto3" json:"plain,omitempty"` Plain []byte `protobuf:"bytes,1,opt,name=plain,proto3" json:"plain,omitempty"`
@@ -223,6 +227,7 @@ func (m *DecryptResponse) GetPlain() []byte {
return nil return nil
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
type EncryptRequest struct { type EncryptRequest struct {
// Version of the KMS plugin API. // Version of the KMS plugin API.
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"` Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
@@ -271,6 +276,7 @@ func (m *EncryptRequest) GetPlain() []byte {
return nil return nil
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
type EncryptResponse struct { type EncryptResponse struct {
// The encrypted data. // The encrypted data.
Cipher []byte `protobuf:"bytes,1,opt,name=cipher,proto3" json:"cipher,omitempty"` Cipher []byte `protobuf:"bytes,1,opt,name=cipher,proto3" json:"cipher,omitempty"`
@@ -322,27 +328,27 @@ func init() {
func init() { proto.RegisterFile("api.proto", fileDescriptor_00212fb1f9d3bf1c) } func init() { proto.RegisterFile("api.proto", fileDescriptor_00212fb1f9d3bf1c) }
var fileDescriptor_00212fb1f9d3bf1c = []byte{ var fileDescriptor_00212fb1f9d3bf1c = []byte{
// 308 bytes of a gzipped FileDescriptorProto // 314 bytes of a gzipped FileDescriptorProto
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x52, 0x4f, 0x4b, 0xc3, 0x30, 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x52, 0xcf, 0x4a, 0xf3, 0x40,
0x14, 0x5f, 0x27, 0x6e, 0xec, 0x59, 0x5a, 0x08, 0xc3, 0x55, 0x4f, 0x9a, 0xcb, 0xd4, 0x43, 0xcb, 0x10, 0xef, 0xf6, 0xe3, 0x6b, 0xe9, 0x58, 0x12, 0x58, 0x8a, 0x0d, 0xe2, 0x41, 0xf7, 0x52, 0xf5,
0xf4, 0xe2, 0x49, 0x64, 0xe8, 0x49, 0xf4, 0x50, 0xc1, 0x83, 0x17, 0xc9, 0xca, 0x43, 0xc3, 0x6c, 0x90, 0x52, 0xbd, 0x78, 0x12, 0x29, 0x7a, 0x12, 0x3d, 0x44, 0xf0, 0xe0, 0x45, 0xb6, 0x61, 0xd0,
0x1a, 0x93, 0xac, 0xb2, 0x2f, 0xea, 0xe7, 0x11, 0xdb, 0xb4, 0xa6, 0x13, 0xd1, 0xe3, 0x7b, 0xf9, 0xa5, 0x66, 0xb3, 0xee, 0x6e, 0x23, 0x7d, 0x33, 0x9f, 0xc4, 0xe7, 0x11, 0x93, 0x4d, 0xdc, 0x54,
0xfd, 0x79, 0xbf, 0xf7, 0x02, 0x23, 0x26, 0x79, 0x2c, 0x55, 0x61, 0x0a, 0x32, 0x2c, 0x67, 0x0b, 0x44, 0x8f, 0x33, 0xfb, 0xfb, 0x33, 0xbf, 0x99, 0x85, 0x01, 0x57, 0x22, 0x56, 0x3a, 0xb7, 0x39,
0x34, 0x6c, 0x46, 0x4f, 0x20, 0x78, 0x40, 0xa5, 0x79, 0x21, 0x52, 0x7c, 0x5b, 0xa1, 0x36, 0x24, 0xed, 0x17, 0xb3, 0x05, 0x5a, 0x3e, 0x63, 0x47, 0x10, 0xdc, 0xa1, 0x36, 0x22, 0x97, 0x09, 0xbe,
0x82, 0x61, 0x59, 0x77, 0x22, 0xef, 0xc0, 0x3b, 0x1a, 0xa5, 0x4d, 0x49, 0xdf, 0x21, 0x6c, 0xb1, 0xac, 0xd0, 0x58, 0x1a, 0x41, 0xbf, 0xa8, 0x3a, 0x11, 0xd9, 0x23, 0x07, 0x83, 0xa4, 0x2e, 0xd9,
0x5a, 0x16, 0x42, 0xe3, 0xef, 0x60, 0x72, 0x08, 0xbe, 0x5a, 0x09, 0xc3, 0x73, 0x7c, 0x12, 0x2c, 0x2b, 0x84, 0x0d, 0xd6, 0xa8, 0x5c, 0x1a, 0xfc, 0x19, 0x4c, 0xf7, 0x61, 0xa8, 0x57, 0xd2, 0x8a,
0xc7, 0xa8, 0x5f, 0x3d, 0xef, 0xd8, 0xde, 0x1d, 0xcb, 0x91, 0x4c, 0x21, 0x6c, 0x20, 0x8d, 0xc8, 0x0c, 0x1f, 0x24, 0xcf, 0x30, 0xea, 0x96, 0xcf, 0x5b, 0xae, 0x77, 0xc3, 0x33, 0xa4, 0x13, 0x08,
0x56, 0x85, 0x0a, 0x6c, 0xdb, 0xba, 0xd1, 0x39, 0x04, 0x57, 0x98, 0xa9, 0xb5, 0x34, 0x7f, 0x0e, 0x6b, 0x48, 0x2d, 0xf2, 0xaf, 0x44, 0x05, 0xae, 0xed, 0xdc, 0xd8, 0x1c, 0x82, 0x0b, 0x4c, 0xf5,
0x49, 0x76, 0x61, 0x90, 0x71, 0xf9, 0x82, 0xaa, 0x72, 0xf4, 0x53, 0x5b, 0xd1, 0x29, 0x84, 0xad, 0x5a, 0xd9, 0x5f, 0x87, 0xa4, 0xdb, 0xd0, 0x4b, 0x85, 0x7a, 0x42, 0x5d, 0x3a, 0x0e, 0x13, 0x57,
0x86, 0x1d, 0x7e, 0x0c, 0xdb, 0xf2, 0x95, 0xf1, 0x5a, 0xc2, 0x4f, 0xeb, 0x82, 0x5e, 0x42, 0x70, 0xb1, 0x09, 0x84, 0x8d, 0x86, 0x1b, 0x7e, 0x04, 0xff, 0xd5, 0x33, 0x17, 0x95, 0xc4, 0x30, 0xa9,
0x2d, 0xfe, 0x69, 0xd6, 0x2a, 0xf4, 0x5d, 0x85, 0x63, 0x08, 0x5b, 0x05, 0x6b, 0xf5, 0x3d, 0x95, 0x0a, 0x76, 0x0e, 0xc1, 0xa5, 0xfc, 0xa3, 0x59, 0xa3, 0xd0, 0xf5, 0x15, 0x0e, 0x21, 0x6c, 0x14,
0xe7, 0x4e, 0x75, 0xfa, 0xe1, 0xc1, 0xf8, 0x06, 0xd7, 0xb7, 0x4c, 0xb0, 0x67, 0xcc, 0x51, 0x98, 0x9c, 0xd5, 0xd7, 0x54, 0xc4, 0x9f, 0xea, 0xf8, 0x9d, 0xc0, 0xe8, 0x0a, 0xd7, 0xd7, 0x5c, 0xf2,
0x7b, 0x54, 0x25, 0xcf, 0x90, 0x5c, 0xc0, 0xd0, 0xa6, 0x27, 0x93, 0xd8, 0x1e, 0x2b, 0xee, 0x5e, 0x47, 0xcc, 0x50, 0xda, 0x5b, 0xd4, 0x85, 0x48, 0x91, 0x9e, 0x41, 0xdf, 0xa5, 0xa7, 0xe3, 0xd8,
0x6a, 0x3f, 0xfa, 0xf9, 0x50, 0xdb, 0xd1, 0xde, 0x17, 0xdf, 0xc6, 0x75, 0xf8, 0xdd, 0x25, 0x3a, 0x1d, 0x2b, 0x6e, 0x5f, 0x6a, 0x27, 0xfa, 0xfe, 0x50, 0xd9, 0xb1, 0xce, 0x27, 0xdf, 0xc5, 0xf5,
0xfc, 0x8d, 0xcd, 0xd4, 0x7c, 0x9b, 0xc1, 0xe1, 0x77, 0xf7, 0xe2, 0xf0, 0x37, 0xe2, 0xd2, 0xde, 0xf8, 0xed, 0x25, 0x7a, 0xfc, 0x8d, 0xcd, 0x54, 0x7c, 0x97, 0xc1, 0xe3, 0xb7, 0xf7, 0xe2, 0xf1,
0x7c, 0xef, 0x71, 0xb2, 0x3c, 0xd7, 0x31, 0x2f, 0x92, 0x65, 0xae, 0x13, 0x26, 0xb9, 0x4e, 0x2c, 0x37, 0xe2, 0xb2, 0xce, 0x7c, 0xf7, 0x7e, 0xbc, 0x3c, 0x35, 0xb1, 0xc8, 0xa7, 0xcb, 0xcc, 0x4c,
0x78, 0x31, 0xa8, 0xbe, 0xe0, 0xd9, 0x67, 0x00, 0x00, 0x00, 0xff, 0xff, 0x13, 0xcb, 0x8d, 0x9b, 0xb9, 0x12, 0x66, 0xea, 0xc0, 0x6f, 0x84, 0x2c, 0x7a, 0xe5, 0x2f, 0x3c, 0xf9, 0x08, 0x00, 0x00,
0x8f, 0x02, 0x00, 0x00, 0xff, 0xff, 0x18, 0x47, 0x93, 0xb2, 0x92, 0x02, 0x00, 0x00,
} }
// Reference imports to suppress errors if they are not otherwise used. // Reference imports to suppress errors if they are not otherwise used.

8
staging/src/k8s.io/kms/apis/v1beta1/api.proto
View File

@@ -19,6 +19,7 @@ syntax = "proto3";
package v1beta1; package v1beta1;
option go_package = "k8s.io/kms/apis/v1beta1"; option go_package = "k8s.io/kms/apis/v1beta1";
option deprecated = true;
// This service defines the public APIs for remote KMS provider. // This service defines the public APIs for remote KMS provider.
service KeyManagementService { service KeyManagementService {
@@ -31,11 +32,13 @@ service KeyManagementService {
rpc Encrypt(EncryptRequest) returns (EncryptResponse) {} rpc Encrypt(EncryptRequest) returns (EncryptResponse) {}
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
message VersionRequest { message VersionRequest {
// Version of the KMS plugin API. // Version of the KMS plugin API.
string version = 1; string version = 1;
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
message VersionResponse { message VersionResponse {
// Version of the KMS plugin API. // Version of the KMS plugin API.
string version = 1; string version = 1;
@@ -45,6 +48,7 @@ message VersionResponse {
string runtime_version = 3; string runtime_version = 3;
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
message DecryptRequest { message DecryptRequest {
// Version of the KMS plugin API. // Version of the KMS plugin API.
string version = 1; string version = 1;
@@ -52,11 +56,13 @@ message DecryptRequest {
bytes cipher = 2; bytes cipher = 2;
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
message DecryptResponse { message DecryptResponse {
// The decrypted data. // The decrypted data.
bytes plain = 1; bytes plain = 1;
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
message EncryptRequest { message EncryptRequest {
// Version of the KMS plugin API. // Version of the KMS plugin API.
string version = 1; string version = 1;
@@ -64,8 +70,8 @@ message EncryptRequest {
bytes plain = 2; bytes plain = 2;
} }
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
message EncryptResponse { message EncryptResponse {
// The encrypted data. // The encrypted data.
bytes cipher = 1; bytes cipher = 1;
} }

1
staging/src/k8s.io/kms/apis/v1beta1/v1beta1.go
View File

@@ -15,6 +15,7 @@ limitations under the License.
*/ */
// Package v1beta1 contains definition of kms-plugin's gRPC service. // Package v1beta1 contains definition of kms-plugin's gRPC service.
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
package v1beta1 package v1beta1
// IsVersionCheckMethod determines whether the supplied method is a version check against kms-plugin. // IsVersionCheckMethod determines whether the supplied method is a version check against kms-plugin.