github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #121485 from ritazh/kmsv2-ga

Browse Source 
[KMSv2] promote KMSv2 and KMSv2KDF to GA
This commit is contained in:
Kubernetes Prow Robot
2023-10-27 02:23:50 +02:00
committed by GitHub
parent 0712728ee9 a9b1adbafc
commit ebf46ce1b4
11 changed files with 265 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
test/integration/controlplane/transformation/kms_transformation_test.go
View File

@@ -38,16 +38,19 @@ import (
clientv3 "go.etcd.io/etcd/client/v3"
"golang.org/x/crypto/cryptobyte"
apiextensionsclientset "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
"k8s.io/apimachinery/pkg/api/meta"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/apiserver/pkg/features"
genericapiserver "k8s.io/apiserver/pkg/server"
"k8s.io/apiserver/pkg/storage/value"
aestransformer "k8s.io/apiserver/pkg/storage/value/encrypt/aes"
mock "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/testing/v1beta1"
"k8s.io/apiserver/pkg/util/feature"
utilfeature "k8s.io/apiserver/pkg/util/feature"
"k8s.io/client-go/dynamic"
"k8s.io/client-go/rest"
featuregatetesting "k8s.io/component-base/featuregate/testing"
@@ -125,6 +128,8 @@ func (r envelope) plainTextPayload(secretETCDPath string) ([]byte, error) {
// 8. No-op updates to the secret should cause new AES GCM key to be used
// 9. Direct AES GCM decryption works after the new AES GCM key is used
func TestKMSProvider(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
encryptionConfig := `
kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1
@@ -301,6 +306,8 @@ resources:
// 10. confirm that cluster wide secret read still works
// 11. confirm that api server can restart with last applied encryption config
func TestEncryptionConfigHotReload(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
storageConfig := framework.SharedEtcd()
encryptionConfig := `
kind: EncryptionConfiguration
@@ -592,14 +599,20 @@ resources:
t.Run("encrypt all resources", func(t *testing.T) {
_ = mock.NewBase64Plugin(t, "@encrypt-all-kms-provider.sock")
defer featuregatetesting.SetFeatureGateDuringTest(t, feature.DefaultFeatureGate, "AllAlpha", true)()
defer featuregatetesting.SetFeatureGateDuringTest(t, feature.DefaultFeatureGate, "AllBeta", true)()
// To ensure we are checking all REST resources
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, "AllAlpha", true)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, "AllBeta", true)()
// Need to enable this explicitly as the feature is deprecated
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
test, err := newTransformTest(t, encryptionConfig, false, "", nil)
if err != nil {
t.Fatalf("failed to start KUBE API Server with encryptionConfig")
}
defer test.cleanUp()
etcd.CreateTestCRDs(t, apiextensionsclientset.NewForConfigOrDie(test.kubeAPIServer.ClientConfig), false, etcd.GetCustomResourceDefinitionData()...)
_, serverResources, err := test.restClient.Discovery().ServerGroupsAndResources()
if err != nil {
t.Fatal(err)
@@ -608,6 +621,8 @@ resources:
client := dynamic.NewForConfigOrDie(test.kubeAPIServer.ClientConfig)
etcdStorageData := etcd.GetEtcdStorageDataForNamespace(testNamespace)
restResourceSet := sets.New[schema.GroupVersionResource]()
stubResourceSet := sets.New[schema.GroupVersionResource]()
for _, resource := range resources {
gvr := resource.Mapping.Resource
stub := etcdStorageData[gvr].Stub
@@ -617,7 +632,7 @@ resources:
t.Errorf("skipping resource %s because stub is empty", gvr)
continue
}
restResourceSet.Insert(gvr)
dynamicClient, obj, err := etcd.JSONToUnstructured(stub, testNamespace, &meta.RESTMapping{
Resource: gvr,
GroupVersionKind: gvr.GroupVersion().WithKind(resource.Mapping.GroupVersionKind.Kind),
@@ -632,7 +647,15 @@ resources:
t.Fatal(err)
}
}
for gvr, data := range etcdStorageData {
if data.Stub == "" {
continue
}
stubResourceSet.Insert(gvr)
}
if !restResourceSet.Equal(stubResourceSet) {
t.Errorf("failed to check all REST resources: %q", restResourceSet.SymmetricDifference(stubResourceSet).UnsortedList())
}
rawClient, etcdClient, err := integration.GetEtcdClients(test.kubeAPIServer.ServerOpts.Etcd.StorageConfig.Transport)
if err != nil {
t.Fatalf("failed to create etcd client: %v", err)
@@ -706,6 +729,8 @@ resources:
_ = mock.NewBase64Plugin(t, "@kms-provider.sock")
_ = mock.NewBase64Plugin(t, "@encrypt-all-kms-provider.sock")
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
test, err := newTransformTest(t, encryptionConfig, false, "", nil)
if err != nil {
t.Fatalf("failed to start KUBE API Server with encryptionConfig\n %s, error: %v", encryptionConfig, err)
@@ -777,6 +802,8 @@ resources:
}
func TestEncryptionConfigHotReloadFileWatch(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
testCases := []struct {
sleep time.Duration
name string
@@ -1017,6 +1044,8 @@ func updateFile(t *testing.T, configDir, filename string, newContent []byte) {
}
func TestKMSHealthz(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
encryptionConfig := `
kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1
@@ -1078,6 +1107,8 @@ resources:
}
func TestKMSHealthzWithReload(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, true)()
encryptionConfig := `
kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1