mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-29 06:27:05 +00:00
Remove Google Cloud KMS integration for encryption-at-rest.
This commit is contained in:
Saksham Sharma
parent
7a6a58f444
commit
261772b65c
@ -1491,10 +1491,6 @@ function start-kube-apiserver {
|
||||
|
||||
if [[ -n "${ENCRYPTION_PROVIDER_CONFIG:-}" ]]; then
|
||||
local encryption_provider_config_path="/etc/srv/kubernetes/encryption-provider-config.yml"
|
||||
if [[ -n "${GOOGLE_CLOUD_KMS_CONFIG_FILE_NAME:-}" && -n "${GOOGLE_CLOUD_KMS_CONFIG:-}" ]]; then
|
||||
echo "${GOOGLE_CLOUD_KMS_CONFIG}" | base64 --decode > "${GOOGLE_CLOUD_KMS_CONFIG_FILE_NAME}"
|
||||
fi
|
||||
|
||||
echo "${ENCRYPTION_PROVIDER_CONFIG}" | base64 --decode > "${encryption_provider_config_path}"
|
||||
params+=" --experimental-encryption-provider-config=${encryption_provider_config_path}"
|
||||
fi
|
||||
|
||||
@ -265,13 +265,6 @@ func CreateKubeAPIServerConfig(s *options.ServerRunOptions, nodeTunneler tunnele
|
||||
return nil, nil, nil, nil, nil, utilerrors.NewAggregate(errs)
|
||||
}
|
||||
|
||||
if s.CloudProvider != nil {
|
||||
// Initialize the cloudprovider once, to give it a chance to register KMS plugins, if any.
|
||||
_, err := cloudprovider.InitCloudProvider(s.CloudProvider.CloudProvider, s.CloudProvider.CloudConfigFile)
|
||||
if err != nil {
|
||||
return nil, nil, nil, nil, nil, err
|
||||
}
|
||||
}
|
||||
genericConfig, sharedInformers, versionedInformers, insecureServingOptions, serviceResolver, err := BuildGenericConfig(s, proxyTransport)
|
||||
if err != nil {
|
||||
return nil, nil, nil, nil, nil, err
|
||||
|
||||
@ -40,7 +40,6 @@ go_library(
|
||||
"gce_urlmap.go",
|
||||
"gce_util.go",
|
||||
"gce_zones.go",
|
||||
"kms.go",
|
||||
"metrics.go",
|
||||
"token_source.go",
|
||||
],
|
||||
@ -61,7 +60,6 @@ go_library(
|
||||
"//vendor/github.com/prometheus/client_golang/prometheus:go_default_library",
|
||||
"//vendor/golang.org/x/oauth2:go_default_library",
|
||||
"//vendor/golang.org/x/oauth2/google:go_default_library",
|
||||
"//vendor/google.golang.org/api/cloudkms/v1:go_default_library",
|
||||
"//vendor/google.golang.org/api/compute/v0.alpha:go_default_library",
|
||||
"//vendor/google.golang.org/api/compute/v0.beta:go_default_library",
|
||||
"//vendor/google.golang.org/api/compute/v1:go_default_library",
|
||||
@ -77,8 +75,6 @@ go_library(
|
||||
"//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
|
||||
"//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
|
||||
"//vendor/k8s.io/apimachinery/pkg/watch:go_default_library",
|
||||
"//vendor/k8s.io/apiserver/pkg/server/options/encryptionconfig:go_default_library",
|
||||
"//vendor/k8s.io/apiserver/pkg/storage/value/encrypt/envelope:go_default_library",
|
||||
"//vendor/k8s.io/client-go/kubernetes:go_default_library",
|
||||
"//vendor/k8s.io/client-go/kubernetes/scheme:go_default_library",
|
||||
"//vendor/k8s.io/client-go/kubernetes/typed/core/v1:go_default_library",
|
||||
|
||||
@ -34,8 +34,6 @@ import (
|
||||
"k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/util/sets"
|
||||
"k8s.io/apimachinery/pkg/util/wait"
|
||||
"k8s.io/apiserver/pkg/server/options/encryptionconfig"
|
||||
"k8s.io/apiserver/pkg/storage/value/encrypt/envelope"
|
||||
clientset "k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/kubernetes/scheme"
|
||||
v1core "k8s.io/client-go/kubernetes/typed/core/v1"
|
||||
@ -48,7 +46,6 @@ import (
|
||||
"github.com/golang/glog"
|
||||
"golang.org/x/oauth2"
|
||||
"golang.org/x/oauth2/google"
|
||||
cloudkms "google.golang.org/api/cloudkms/v1"
|
||||
computealpha "google.golang.org/api/compute/v0.alpha"
|
||||
computebeta "google.golang.org/api/compute/v0.beta"
|
||||
compute "google.golang.org/api/compute/v1"
|
||||
@ -106,7 +103,6 @@ type GCECloud struct {
|
||||
serviceBeta *computebeta.Service
|
||||
serviceAlpha *computealpha.Service
|
||||
containerService *container.Service
|
||||
cloudkmsService *cloudkms.Service
|
||||
client clientset.Interface
|
||||
clientBuilder controller.ControllerClientBuilder
|
||||
eventBroadcaster record.EventBroadcaster
|
||||
@ -195,10 +191,6 @@ type CloudConfig struct {
|
||||
AlphaFeatureGate *AlphaFeatureGate
|
||||
}
|
||||
|
||||
// kmsPluginRegisterOnce prevents the cloudprovider from registering its KMS plugin
|
||||
// more than once in the KMS plugin registry.
|
||||
var kmsPluginRegisterOnce sync.Once
|
||||
|
||||
func init() {
|
||||
cloudprovider.RegisterCloudProvider(
|
||||
ProviderName,
|
||||
@ -212,11 +204,6 @@ func (g *GCECloud) GetComputeService() *compute.Service {
|
||||
return g.service
|
||||
}
|
||||
|
||||
// Raw access to the cloudkmsService of GCE cloud. Required for encryption of etcd using Google KMS.
|
||||
func (g *GCECloud) GetKMSService() *cloudkms.Service {
|
||||
return g.cloudkmsService
|
||||
}
|
||||
|
||||
// newGCECloud creates a new instance of GCECloud.
|
||||
func newGCECloud(config io.Reader) (gceCloud *GCECloud, err error) {
|
||||
var cloudConfig *CloudConfig
|
||||
@ -404,12 +391,6 @@ func CreateGCECloud(config *CloudConfig) (*GCECloud, error) {
|
||||
}
|
||||
containerService.UserAgent = userAgent
|
||||
|
||||
cloudkmsService, err := cloudkms.New(client)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
cloudkmsService.UserAgent = userAgent
|
||||
|
||||
// ProjectID and.NetworkProjectID may be project number or name.
|
||||
projID, netProjID := tryConvertToProjectNames(config.ProjectID, config.NetworkProjectID, service)
|
||||
onXPN := projID != netProjID
|
||||
@ -474,7 +455,6 @@ func CreateGCECloud(config *CloudConfig) (*GCECloud, error) {
|
||||
serviceAlpha: serviceAlpha,
|
||||
serviceBeta: serviceBeta,
|
||||
containerService: containerService,
|
||||
cloudkmsService: cloudkmsService,
|
||||
projectID: projID,
|
||||
networkProjectID: netProjID,
|
||||
onXPN: onXPN,
|
||||
@ -494,14 +474,6 @@ func CreateGCECloud(config *CloudConfig) (*GCECloud, error) {
|
||||
|
||||
gce.manager = &gceServiceManager{gce}
|
||||
|
||||
// Registering the KMS plugin only the first time.
|
||||
kmsPluginRegisterOnce.Do(func() {
|
||||
// Register the Google Cloud KMS based service in the KMS plugin registry.
|
||||
encryptionconfig.KMSPluginRegistry.Register(KMSServiceName, func(config io.Reader) (envelope.Service, error) {
|
||||
return gce.getGCPCloudKMSService(config)
|
||||
})
|
||||
})
|
||||
|
||||
return gce, nil
|
||||
}
|
||||
|
||||
|
||||
@ -1,167 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package gce
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
"io"
|
||||
|
||||
"github.com/golang/glog"
|
||||
cloudkms "google.golang.org/api/cloudkms/v1"
|
||||
"google.golang.org/api/googleapi"
|
||||
gcfg "gopkg.in/gcfg.v1"
|
||||
"k8s.io/apiserver/pkg/storage/value/encrypt/envelope"
|
||||
)
|
||||
|
||||
const (
|
||||
// KMSServiceName is the name of the cloudkms provider registered by this cloud.
|
||||
KMSServiceName = "gcp-cloudkms"
|
||||
|
||||
defaultGKMSKeyRing = "google-container-engine"
|
||||
defaultGKMSKeyRingLocation = "global"
|
||||
)
|
||||
|
||||
// gkmsConfig contains the GCE specific KMS configuration for setting up a KMS connection.
|
||||
type gkmsConfig struct {
|
||||
Global struct {
|
||||
// location is the KMS location of the KeyRing to be used for encryption.
|
||||
// It can be found by checking the available KeyRings in the IAM UI.
|
||||
// This is not the same as the GCP location of the project.
|
||||
// +optional
|
||||
Location string `gcfg:"kms-location"`
|
||||
// keyRing is the keyRing of the hosted key to be used. The default value is "google-kubernetes".
|
||||
// +optional
|
||||
KeyRing string `gcfg:"kms-keyring"`
|
||||
// cryptoKey is the name of the key to be used for encryption of Data-Encryption-Keys.
|
||||
CryptoKey string `gcfg:"kms-cryptokey"`
|
||||
}
|
||||
}
|
||||
|
||||
// readGCPCloudKMSConfig parses and returns the configuration parameters for Google Cloud KMS.
|
||||
func readGCPCloudKMSConfig(reader io.Reader) (*gkmsConfig, error) {
|
||||
cfg := &gkmsConfig{}
|
||||
if err := gcfg.FatalOnly(gcfg.ReadInto(cfg, reader)); err != nil {
|
||||
glog.Errorf("Couldn't read Google Cloud KMS config: %v", err)
|
||||
return nil, err
|
||||
}
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
// gkmsService provides Encrypt and Decrypt methods which allow cryptographic operations
|
||||
// using Google Cloud KMS service.
|
||||
type gkmsService struct {
|
||||
parentName string
|
||||
cloudkmsService *cloudkms.Service
|
||||
}
|
||||
|
||||
// getGCPCloudKMSService provides a Google Cloud KMS based implementation of envelope.Service.
|
||||
func (gce *GCECloud) getGCPCloudKMSService(config io.Reader) (envelope.Service, error) {
|
||||
kmsConfig, err := readGCPCloudKMSConfig(config)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Hosting on GCE/GKE with Google KMS encryption provider
|
||||
cloudkmsService := gce.GetKMSService()
|
||||
|
||||
// Set defaults for location and keyRing.
|
||||
location := kmsConfig.Global.Location
|
||||
if len(location) == 0 {
|
||||
location = defaultGKMSKeyRingLocation
|
||||
}
|
||||
keyRing := kmsConfig.Global.KeyRing
|
||||
if len(keyRing) == 0 {
|
||||
keyRing = defaultGKMSKeyRing
|
||||
}
|
||||
|
||||
cryptoKey := kmsConfig.Global.CryptoKey
|
||||
if len(cryptoKey) == 0 {
|
||||
return nil, fmt.Errorf("missing cryptoKey for cloudprovided KMS: " + KMSServiceName)
|
||||
}
|
||||
|
||||
parentName := fmt.Sprintf("projects/%s/locations/%s", gce.projectID, location)
|
||||
|
||||
// Create the keyRing if it does not exist yet
|
||||
_, err = cloudkmsService.Projects.Locations.KeyRings.Create(parentName,
|
||||
&cloudkms.KeyRing{}).KeyRingId(keyRing).Do()
|
||||
if err != nil && unrecoverableCreationError(err) {
|
||||
return nil, err
|
||||
}
|
||||
parentName = parentName + "/keyRings/" + keyRing
|
||||
|
||||
// Create the cryptoKey if it does not exist yet
|
||||
_, err = cloudkmsService.Projects.Locations.KeyRings.CryptoKeys.Create(parentName,
|
||||
&cloudkms.CryptoKey{
|
||||
Purpose: "ENCRYPT_DECRYPT",
|
||||
}).CryptoKeyId(cryptoKey).Do()
|
||||
if err != nil && unrecoverableCreationError(err) {
|
||||
return nil, err
|
||||
}
|
||||
parentName = parentName + "/cryptoKeys/" + cryptoKey
|
||||
|
||||
service := &gkmsService{
|
||||
parentName: parentName,
|
||||
cloudkmsService: cloudkmsService,
|
||||
}
|
||||
|
||||
// Sanity check before startup. For non-GCP clusters, the user's account may not have permissions to create
|
||||
// the key. We need to verify the existence of the key before apiserver startup.
|
||||
_, err = service.Encrypt([]byte("test"))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to encrypt data using Google cloudkms, using key %s. Ensure that the keyRing and cryptoKey exist. Got error: %v", parentName, err)
|
||||
}
|
||||
|
||||
return service, nil
|
||||
}
|
||||
|
||||
// Decrypt decrypts a base64 representation of encrypted bytes.
|
||||
func (t *gkmsService) Decrypt(data string) ([]byte, error) {
|
||||
resp, err := t.cloudkmsService.Projects.Locations.KeyRings.CryptoKeys.
|
||||
Decrypt(t.parentName, &cloudkms.DecryptRequest{
|
||||
Ciphertext: data,
|
||||
}).Do()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return base64.StdEncoding.DecodeString(resp.Plaintext)
|
||||
}
|
||||
|
||||
// Encrypt encrypts bytes, and returns base64 representation of the ciphertext.
|
||||
func (t *gkmsService) Encrypt(data []byte) (string, error) {
|
||||
resp, err := t.cloudkmsService.Projects.Locations.KeyRings.CryptoKeys.
|
||||
Encrypt(t.parentName, &cloudkms.EncryptRequest{
|
||||
Plaintext: base64.StdEncoding.EncodeToString(data),
|
||||
}).Do()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return resp.Ciphertext, nil
|
||||
}
|
||||
|
||||
// unrecoverableCreationError decides if Kubernetes should ignore the encountered Google KMS
|
||||
// error. Only to be used for errors seen while creating a KeyRing or CryptoKey.
|
||||
func unrecoverableCreationError(err error) bool {
|
||||
apiError, isAPIError := err.(*googleapi.Error)
|
||||
// 409 means the object exists.
|
||||
// 403 means we do not have permission to create the object, the user must do it.
|
||||
// Else, it is an unrecoverable error.
|
||||
if !isAPIError || (apiError.Code != 409 && apiError.Code != 403) {
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user