github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[KMSv2] promote KMSv2 and KMSv2KDF to GA

Browse Source 
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
This commit is contained in:
Rita Zhang
2023-10-24 09:50:45 -07:00
parent 1fc3d10f7e
commit a9b1adbafc
11 changed files with 265 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
test/integration/controlplane/transformation/kms_transformation_test.go
View File

@@ -38,16 +38,19 @@ import (
clientv3 "go.etcd.io/etcd/client/v3"
"golang.org/x/crypto/cryptobyte"
apiextensionsclientset "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
"k8s.io/apimachinery/pkg/api/meta"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/apiserver/pkg/features"
genericapiserver "k8s.io/apiserver/pkg/server"
"k8s.io/apiserver/pkg/storage/value"
aestransformer "k8s.io/apiserver/pkg/storage/value/encrypt/aes"
mock "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/testing/v1beta1"
"k8s.io/apiserver/pkg/util/feature"
utilfeature "k8s.io/apiserver/pkg/util/feature"
"k8s.io/client-go/dynamic"
"k8s.io/client-go/rest"
featuregatetesting "k8s.io/component-base/featuregate/testing"
@@ -125,6 +128,8 @@ func (r envelope) plainTextPayload(secretETCDPath string) ([]byte, error) {
// 8. No-op updates to the secret should cause new AES GCM key to be used
// 9. Direct AES GCM decryption works after the new AES GCM key is used
func TestKMSProvider(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
encryptionConfig := `
kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1
@@ -301,6 +306,8 @@ resources:
// 10. confirm that cluster wide secret read still works
// 11. confirm that api server can restart with last applied encryption config
func TestEncryptionConfigHotReload(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
storageConfig := framework.SharedEtcd()
encryptionConfig := `
kind: EncryptionConfiguration
@@ -596,14 +603,20 @@ resources:
t.Run("encrypt all resources", func(t *testing.T) {
_ = mock.NewBase64Plugin(t, "@encrypt-all-kms-provider.sock")
defer featuregatetesting.SetFeatureGateDuringTest(t, feature.DefaultFeatureGate, "AllAlpha", true)()
defer featuregatetesting.SetFeatureGateDuringTest(t, feature.DefaultFeatureGate, "AllBeta", true)()
// To ensure we are checking all REST resources
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, "AllAlpha", true)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, "AllBeta", true)()
// Need to enable this explicitly as the feature is deprecated
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
test, err := newTransformTest(t, encryptionConfig, false, "", nil)
if err != nil {
t.Fatalf("failed to start KUBE API Server with encryptionConfig")
}
defer test.cleanUp()
etcd.CreateTestCRDs(t, apiextensionsclientset.NewForConfigOrDie(test.kubeAPIServer.ClientConfig), false, etcd.GetCustomResourceDefinitionData()...)
_, serverResources, err := test.restClient.Discovery().ServerGroupsAndResources()
if err != nil {
t.Fatal(err)
@@ -612,6 +625,8 @@ resources:
client := dynamic.NewForConfigOrDie(test.kubeAPIServer.ClientConfig)
etcdStorageData := etcd.GetEtcdStorageDataForNamespace(testNamespace)
restResourceSet := sets.New[schema.GroupVersionResource]()
stubResourceSet := sets.New[schema.GroupVersionResource]()
for _, resource := range resources {
gvr := resource.Mapping.Resource
stub := etcdStorageData[gvr].Stub
@@ -621,7 +636,7 @@ resources:
t.Errorf("skipping resource %s because stub is empty", gvr)
continue
}
restResourceSet.Insert(gvr)
dynamicClient, obj, err := etcd.JSONToUnstructured(stub, testNamespace, &meta.RESTMapping{
Resource: gvr,
GroupVersionKind: gvr.GroupVersion().WithKind(resource.Mapping.GroupVersionKind.Kind),
@@ -636,7 +651,15 @@ resources:
t.Fatal(err)
}
}
for gvr, data := range etcdStorageData {
if data.Stub == "" {
continue
}
stubResourceSet.Insert(gvr)
}
if !restResourceSet.Equal(stubResourceSet) {
t.Errorf("failed to check all REST resources: %q", restResourceSet.SymmetricDifference(stubResourceSet).UnsortedList())
}
rawClient, etcdClient, err := integration.GetEtcdClients(test.kubeAPIServer.ServerOpts.Etcd.StorageConfig.Transport)
if err != nil {
t.Fatalf("failed to create etcd client: %v", err)
@@ -710,6 +733,8 @@ resources:
_ = mock.NewBase64Plugin(t, "@kms-provider.sock")
_ = mock.NewBase64Plugin(t, "@encrypt-all-kms-provider.sock")
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
test, err := newTransformTest(t, encryptionConfig, false, "", nil)
if err != nil {
t.Fatalf("failed to start KUBE API Server with encryptionConfig\n %s, error: %v", encryptionConfig, err)
@@ -781,6 +806,8 @@ resources:
}
func TestEncryptionConfigHotReloadFileWatch(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
testCases := []struct {
sleep time.Duration
name string
@@ -998,6 +1025,8 @@ func verifyIfKMSTransformersSwapped(t *testing.T, wantPrefix string, test *trans
}
func TestKMSHealthz(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
encryptionConfig := `
kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1
@@ -1059,6 +1088,8 @@ resources:
}
func TestKMSHealthzWithReload(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
encryptionConfig := `
kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1