From 1acdb4ae86e0e43475c31f108a6106b1f5ea5027 Mon Sep 17 00:00:00 2001 From: Anish Ramasekar Date: Thu, 6 Jul 2023 13:39:03 -0700 Subject: [PATCH] [KMSv2] Mark KMS v1beta1 as deprecated with no further fixes (#119007) * add feature gate Signed-off-by: Anish Ramasekar * add validation and warning in load config Signed-off-by: Anish Ramasekar * mark v1beta1 proto message deprecated Signed-off-by: Anish Ramasekar --------- Signed-off-by: Anish Ramasekar --- .../apiserver/pkg/features/kube_features.go | 9 ++++ .../server/options/encryptionconfig/config.go | 5 ++ .../options/encryptionconfig/config_test.go | 34 +++++++++++++ staging/src/k8s.io/kms/apis/v1beta1/api.pb.go | 50 +++++++++++-------- staging/src/k8s.io/kms/apis/v1beta1/api.proto | 8 ++- .../src/k8s.io/kms/apis/v1beta1/v1beta1.go | 1 + 6 files changed, 84 insertions(+), 23 deletions(-) diff --git a/staging/src/k8s.io/apiserver/pkg/features/kube_features.go b/staging/src/k8s.io/apiserver/pkg/features/kube_features.go index 6084a86f893..5f6a3381a66 100644 --- a/staging/src/k8s.io/apiserver/pkg/features/kube_features.go +++ b/staging/src/k8s.io/apiserver/pkg/features/kube_features.go @@ -109,6 +109,13 @@ const ( // Allows for updating watchcache resource version with progress notify events. EfficientWatchResumption featuregate.Feature = "EfficientWatchResumption" + // owner: @aramase + // kep: https://kep.k8s.io/3299 + // deprecated: v1.28 + // + // Enables KMS v1 API for encryption at rest. + KMSv1 featuregate.Feature = "KMSv1" + // owner: @aramase // kep: https://kep.k8s.io/3299 // alpha: v1.25 @@ -232,6 +239,8 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS EfficientWatchResumption: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, + KMSv1: {Default: true, PreRelease: featuregate.Deprecated}, + KMSv2: {Default: true, PreRelease: featuregate.Beta}, OpenAPIEnums: {Default: true, PreRelease: featuregate.Beta}, diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config.go b/staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config.go index 79243993939..8f1445ac049 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config.go +++ b/staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config.go @@ -674,6 +674,11 @@ func kmsPrefixTransformer(ctx context.Context, config *apiserverconfig.KMSConfig kmsName := config.Name switch config.APIVersion { case kmsAPIVersionV1: + if !utilfeature.DefaultFeatureGate.Enabled(features.KMSv1) { + return storagevalue.PrefixTransformer{}, nil, nil, fmt.Errorf("KMSv1 is deprecated and will only receive security updates going forward. Use KMSv2 instead. Set --feature-gates=KMSv1=true to use the deprecated KMSv1 feature.") + } + klog.InfoS("KMSv1 is deprecated and will only receive security updates going forward. Use KMSv2 instead.") + envelopeService, err := envelopeServiceFactory(ctx, config.Endpoint, config.Timeout.Duration) if err != nil { return storagevalue.PrefixTransformer{}, nil, nil, fmt.Errorf("could not configure KMSv1-Plugin's probe %q, error: %w", kmsName, err) diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config_test.go b/staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config_test.go index bac46f3f162..915efec1dc8 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config_test.go +++ b/staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config_test.go @@ -187,6 +187,7 @@ func TestLegacyConfig(t *testing.T) { func TestEncryptionProviderConfigCorrect(t *testing.T) { defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv2, true)() + // Set factory for mock envelope service factory := envelopeServiceFactory factoryKMSv2 := EnvelopeKMSv2ServiceFactory @@ -318,6 +319,37 @@ func TestEncryptionProviderConfigCorrect(t *testing.T) { } } +func TestKMSv1Deprecation(t *testing.T) { + testCases := []struct { + name string + kmsv1Enabled bool + expectedErr string + }{ + { + name: "config with kmsv1, KMSv1=false", + kmsv1Enabled: false, + expectedErr: "KMSv1 is deprecated and will only receive security updates going forward. Use KMSv2 instead. Set --feature-gates=KMSv1=true to use the deprecated KMSv1 feature.", + }, + { + name: "config with kmsv1, KMSv1=true", + kmsv1Enabled: true, + expectedErr: "", + }, + } + + for _, testCase := range testCases { + t.Run(testCase.name, func(t *testing.T) { + defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv1, testCase.kmsv1Enabled)() + + kmsv1Config := "testdata/valid-configs/kms/multiple-providers.yaml" + _, err := LoadEncryptionConfig(testContext(t), kmsv1Config, false) + if !strings.Contains(errString(err), testCase.expectedErr) { + t.Fatalf("expected error %q, got %q", testCase.expectedErr, errString(err)) + } + }) + } +} + func TestKMSMaxTimeout(t *testing.T) { defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.KMSv2, true)() @@ -717,6 +749,7 @@ func TestKMSPluginHealthz(t *testing.T) { // tests for masking rules func TestWildcardMasking(t *testing.T) { + testCases := []struct { desc string config *apiserverconfig.EncryptionConfiguration @@ -1124,6 +1157,7 @@ func TestWildcardMasking(t *testing.T) { } func TestWildcardStructure(t *testing.T) { + testCases := []struct { desc string expectedResourceTransformers map[string]string diff --git a/staging/src/k8s.io/kms/apis/v1beta1/api.pb.go b/staging/src/k8s.io/kms/apis/v1beta1/api.pb.go index 49c4713fb43..3361bc5f5eb 100644 --- a/staging/src/k8s.io/kms/apis/v1beta1/api.pb.go +++ b/staging/src/k8s.io/kms/apis/v1beta1/api.pb.go @@ -15,7 +15,7 @@ limitations under the License. */ // Code generated by protoc-gen-gogo. DO NOT EDIT. -// source: api.proto +// api.proto is a deprecated file. package v1beta1 @@ -40,6 +40,7 @@ var _ = math.Inf // proto package needs to be updated. const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. type VersionRequest struct { // Version of the KMS plugin API. Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"` @@ -79,6 +80,7 @@ func (m *VersionRequest) GetVersion() string { return "" } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. type VersionResponse struct { // Version of the KMS plugin API. Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"` @@ -136,6 +138,7 @@ func (m *VersionResponse) GetRuntimeVersion() string { return "" } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. type DecryptRequest struct { // Version of the KMS plugin API. Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"` @@ -184,6 +187,7 @@ func (m *DecryptRequest) GetCipher() []byte { return nil } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. type DecryptResponse struct { // The decrypted data. Plain []byte `protobuf:"bytes,1,opt,name=plain,proto3" json:"plain,omitempty"` @@ -223,6 +227,7 @@ func (m *DecryptResponse) GetPlain() []byte { return nil } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. type EncryptRequest struct { // Version of the KMS plugin API. Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"` @@ -271,6 +276,7 @@ func (m *EncryptRequest) GetPlain() []byte { return nil } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. type EncryptResponse struct { // The encrypted data. Cipher []byte `protobuf:"bytes,1,opt,name=cipher,proto3" json:"cipher,omitempty"` @@ -322,27 +328,27 @@ func init() { func init() { proto.RegisterFile("api.proto", fileDescriptor_00212fb1f9d3bf1c) } var fileDescriptor_00212fb1f9d3bf1c = []byte{ - // 308 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x52, 0x4f, 0x4b, 0xc3, 0x30, - 0x14, 0x5f, 0x27, 0x6e, 0xec, 0x59, 0x5a, 0x08, 0xc3, 0x55, 0x4f, 0x9a, 0xcb, 0xd4, 0x43, 0xcb, - 0xf4, 0xe2, 0x49, 0x64, 0xe8, 0x49, 0xf4, 0x50, 0xc1, 0x83, 0x17, 0xc9, 0xca, 0x43, 0xc3, 0x6c, - 0x1a, 0x93, 0xac, 0xb2, 0x2f, 0xea, 0xe7, 0x11, 0xdb, 0xb4, 0xa6, 0x13, 0xd1, 0xe3, 0x7b, 0xf9, - 0xfd, 0x79, 0xbf, 0xf7, 0x02, 0x23, 0x26, 0x79, 0x2c, 0x55, 0x61, 0x0a, 0x32, 0x2c, 0x67, 0x0b, - 0x34, 0x6c, 0x46, 0x4f, 0x20, 0x78, 0x40, 0xa5, 0x79, 0x21, 0x52, 0x7c, 0x5b, 0xa1, 0x36, 0x24, - 0x82, 0x61, 0x59, 0x77, 0x22, 0xef, 0xc0, 0x3b, 0x1a, 0xa5, 0x4d, 0x49, 0xdf, 0x21, 0x6c, 0xb1, - 0x5a, 0x16, 0x42, 0xe3, 0xef, 0x60, 0x72, 0x08, 0xbe, 0x5a, 0x09, 0xc3, 0x73, 0x7c, 0x12, 0x2c, - 0xc7, 0xa8, 0x5f, 0x3d, 0xef, 0xd8, 0xde, 0x1d, 0xcb, 0x91, 0x4c, 0x21, 0x6c, 0x20, 0x8d, 0xc8, - 0x56, 0x85, 0x0a, 0x6c, 0xdb, 0xba, 0xd1, 0x39, 0x04, 0x57, 0x98, 0xa9, 0xb5, 0x34, 0x7f, 0x0e, - 0x49, 0x76, 0x61, 0x90, 0x71, 0xf9, 0x82, 0xaa, 0x72, 0xf4, 0x53, 0x5b, 0xd1, 0x29, 0x84, 0xad, - 0x86, 0x1d, 0x7e, 0x0c, 0xdb, 0xf2, 0x95, 0xf1, 0x5a, 0xc2, 0x4f, 0xeb, 0x82, 0x5e, 0x42, 0x70, - 0x2d, 0xfe, 0x69, 0xd6, 0x2a, 0xf4, 0x5d, 0x85, 0x63, 0x08, 0x5b, 0x05, 0x6b, 0xf5, 0x3d, 0x95, - 0xe7, 0x4e, 0x75, 0xfa, 0xe1, 0xc1, 0xf8, 0x06, 0xd7, 0xb7, 0x4c, 0xb0, 0x67, 0xcc, 0x51, 0x98, - 0x7b, 0x54, 0x25, 0xcf, 0x90, 0x5c, 0xc0, 0xd0, 0xa6, 0x27, 0x93, 0xd8, 0x1e, 0x2b, 0xee, 0x5e, - 0x6a, 0x3f, 0xfa, 0xf9, 0x50, 0xdb, 0xd1, 0xde, 0x17, 0xdf, 0xc6, 0x75, 0xf8, 0xdd, 0x25, 0x3a, - 0xfc, 0x8d, 0xcd, 0xd4, 0x7c, 0x9b, 0xc1, 0xe1, 0x77, 0xf7, 0xe2, 0xf0, 0x37, 0xe2, 0xd2, 0xde, - 0x7c, 0xef, 0x71, 0xb2, 0x3c, 0xd7, 0x31, 0x2f, 0x92, 0x65, 0xae, 0x13, 0x26, 0xb9, 0x4e, 0x2c, - 0x78, 0x31, 0xa8, 0xbe, 0xe0, 0xd9, 0x67, 0x00, 0x00, 0x00, 0xff, 0xff, 0x13, 0xcb, 0x8d, 0x9b, - 0x8f, 0x02, 0x00, 0x00, + // 314 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x52, 0xcf, 0x4a, 0xf3, 0x40, + 0x10, 0xef, 0xf6, 0xe3, 0x6b, 0xe9, 0x58, 0x12, 0x58, 0x8a, 0x0d, 0xe2, 0x41, 0xf7, 0x52, 0xf5, + 0x90, 0x52, 0xbd, 0x78, 0x12, 0x29, 0x7a, 0x12, 0x3d, 0x44, 0xf0, 0xe0, 0x45, 0xb6, 0x61, 0xd0, + 0xa5, 0x66, 0xb3, 0xee, 0x6e, 0x23, 0x7d, 0x33, 0x9f, 0xc4, 0xe7, 0x11, 0x93, 0x4d, 0xdc, 0x54, + 0x44, 0x8f, 0x33, 0xfb, 0xfb, 0x33, 0xbf, 0x99, 0x85, 0x01, 0x57, 0x22, 0x56, 0x3a, 0xb7, 0x39, + 0xed, 0x17, 0xb3, 0x05, 0x5a, 0x3e, 0x63, 0x47, 0x10, 0xdc, 0xa1, 0x36, 0x22, 0x97, 0x09, 0xbe, + 0xac, 0xd0, 0x58, 0x1a, 0x41, 0xbf, 0xa8, 0x3a, 0x11, 0xd9, 0x23, 0x07, 0x83, 0xa4, 0x2e, 0xd9, + 0x2b, 0x84, 0x0d, 0xd6, 0xa8, 0x5c, 0x1a, 0xfc, 0x19, 0x4c, 0xf7, 0x61, 0xa8, 0x57, 0xd2, 0x8a, + 0x0c, 0x1f, 0x24, 0xcf, 0x30, 0xea, 0x96, 0xcf, 0x5b, 0xae, 0x77, 0xc3, 0x33, 0xa4, 0x13, 0x08, + 0x6b, 0x48, 0x2d, 0xf2, 0xaf, 0x44, 0x05, 0xae, 0xed, 0xdc, 0xd8, 0x1c, 0x82, 0x0b, 0x4c, 0xf5, + 0x5a, 0xd9, 0x5f, 0x87, 0xa4, 0xdb, 0xd0, 0x4b, 0x85, 0x7a, 0x42, 0x5d, 0x3a, 0x0e, 0x13, 0x57, + 0xb1, 0x09, 0x84, 0x8d, 0x86, 0x1b, 0x7e, 0x04, 0xff, 0xd5, 0x33, 0x17, 0x95, 0xc4, 0x30, 0xa9, + 0x0a, 0x76, 0x0e, 0xc1, 0xa5, 0xfc, 0xa3, 0x59, 0xa3, 0xd0, 0xf5, 0x15, 0x0e, 0x21, 0x6c, 0x14, + 0x9c, 0xd5, 0xd7, 0x54, 0xc4, 0x9f, 0xea, 0xf8, 0x9d, 0xc0, 0xe8, 0x0a, 0xd7, 0xd7, 0x5c, 0xf2, + 0x47, 0xcc, 0x50, 0xda, 0x5b, 0xd4, 0x85, 0x48, 0x91, 0x9e, 0x41, 0xdf, 0xa5, 0xa7, 0xe3, 0xd8, + 0x1d, 0x2b, 0x6e, 0x5f, 0x6a, 0x27, 0xfa, 0xfe, 0x50, 0xd9, 0xb1, 0xce, 0x27, 0xdf, 0xc5, 0xf5, + 0xf8, 0xed, 0x25, 0x7a, 0xfc, 0x8d, 0xcd, 0x54, 0x7c, 0x97, 0xc1, 0xe3, 0xb7, 0xf7, 0xe2, 0xf1, + 0x37, 0xe2, 0xb2, 0xce, 0x7c, 0xf7, 0x7e, 0xbc, 0x3c, 0x35, 0xb1, 0xc8, 0xa7, 0xcb, 0xcc, 0x4c, + 0xb9, 0x12, 0x66, 0xea, 0xc0, 0x6f, 0x84, 0x2c, 0x7a, 0xe5, 0x2f, 0x3c, 0xf9, 0x08, 0x00, 0x00, + 0xff, 0xff, 0x18, 0x47, 0x93, 0xb2, 0x92, 0x02, 0x00, 0x00, } // Reference imports to suppress errors if they are not otherwise used. diff --git a/staging/src/k8s.io/kms/apis/v1beta1/api.proto b/staging/src/k8s.io/kms/apis/v1beta1/api.proto index 22450edcd87..f62abc7bff9 100644 --- a/staging/src/k8s.io/kms/apis/v1beta1/api.proto +++ b/staging/src/k8s.io/kms/apis/v1beta1/api.proto @@ -19,6 +19,7 @@ syntax = "proto3"; package v1beta1; option go_package = "k8s.io/kms/apis/v1beta1"; +option deprecated = true; // This service defines the public APIs for remote KMS provider. service KeyManagementService { @@ -31,11 +32,13 @@ service KeyManagementService { rpc Encrypt(EncryptRequest) returns (EncryptResponse) {} } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. message VersionRequest { // Version of the KMS plugin API. string version = 1; } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. message VersionResponse { // Version of the KMS plugin API. string version = 1; @@ -45,6 +48,7 @@ message VersionResponse { string runtime_version = 3; } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. message DecryptRequest { // Version of the KMS plugin API. string version = 1; @@ -52,11 +56,13 @@ message DecryptRequest { bytes cipher = 2; } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. message DecryptResponse { // The decrypted data. bytes plain = 1; } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. message EncryptRequest { // Version of the KMS plugin API. string version = 1; @@ -64,8 +70,8 @@ message EncryptRequest { bytes plain = 2; } +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. message EncryptResponse { // The encrypted data. bytes cipher = 1; } - diff --git a/staging/src/k8s.io/kms/apis/v1beta1/v1beta1.go b/staging/src/k8s.io/kms/apis/v1beta1/v1beta1.go index 842d0a2fdc7..aae3359ef90 100644 --- a/staging/src/k8s.io/kms/apis/v1beta1/v1beta1.go +++ b/staging/src/k8s.io/kms/apis/v1beta1/v1beta1.go @@ -15,6 +15,7 @@ limitations under the License. */ // Package v1beta1 contains definition of kms-plugin's gRPC service. +// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead. package v1beta1 // IsVersionCheckMethod determines whether the supplied method is a version check against kms-plugin.