github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-21 19:01:49 +00:00
Code Issues Projects Releases Wiki Activity

feat: add azure disk encryption(SSE+CMK) support

Browse Source
This commit is contained in:
andyzhangx 2019-10-31 13:24:43 +00:00
parent 00deec8719
commit f10d44bad2
2 changed files with 24 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
pkg/volume/azure_dd/azure_provision.go
View File

@ -131,8 +131,9 @@ func (p *azureDiskProvisioner) Provision(selectedNode *v1.Node, allowedTopologie
availabilityZones sets.String
selectedAvailabilityZone string
diskIopsReadWrite string
diskMbpsReadWrite string
diskIopsReadWrite string
diskMbpsReadWrite string
diskEncryptionSetID string
)
// maxLength = 79 - (4 for ".vhd") = 75
name := util.GenerateVolumeName(p.options.ClusterName, p.options.PVName, 75)
@ -175,6 +176,8 @@ func (p *azureDiskProvisioner) Provision(selectedNode *v1.Node, allowedTopologie
diskIopsReadWrite = v
case "diskmbpsreadwrite":
diskMbpsReadWrite = v
case "diskencryptionsetid":
diskEncryptionSetID = v
default:
return nil, fmt.Errorf("AzureDisk - invalid option %s in storage class", k)
}
@ -244,15 +247,16 @@ func (p *azureDiskProvisioner) Provision(selectedNode *v1.Node, allowedTopologie
}
volumeOptions := &azure.ManagedDiskOptions{
DiskName: name,
StorageAccountType: skuName,
ResourceGroup: resourceGroup,
PVCName: p.options.PVC.Name,
SizeGB: requestGiB,
Tags: tags,
AvailabilityZone: selectedAvailabilityZone,
DiskIOPSReadWrite: diskIopsReadWrite,
DiskMBpsReadWrite: diskMbpsReadWrite,
DiskName: name,
StorageAccountType: skuName,
ResourceGroup: resourceGroup,
PVCName: p.options.PVC.Name,
SizeGB: requestGiB,
Tags: tags,
AvailabilityZone: selectedAvailabilityZone,
DiskIOPSReadWrite: diskIopsReadWrite,
DiskMBpsReadWrite: diskMbpsReadWrite,
DiskEncryptionSetID: diskEncryptionSetID,
}
diskURI, err = diskController.CreateManagedDisk(volumeOptions)
if err != nil {

9
staging/src/k8s.io/legacy-cloud-providers/azure/azure_managedDiskController.go
View File

@ -67,6 +67,8 @@ type ManagedDiskOptions struct {
DiskIOPSReadWrite string
// Throughput Cap (MBps) for UltraSSD disk
DiskMBpsReadWrite string
// ResourceId of the disk encryption set to use for enabling encryption at rest.
DiskEncryptionSetID string
}
//CreateManagedDisk : create managed disk
@ -129,6 +131,13 @@ func (c *ManagedDiskController) CreateManagedDisk(options *ManagedDiskOptions) (
}
}
if options.DiskEncryptionSetID != "" {
diskProperties.Encryption = &compute.Encryption{
DiskEncryptionSetID: &options.DiskEncryptionSetID,
Type: compute.EncryptionAtRestWithCustomerKey,
}
}
model := compute.Disk{
Location: &c.common.location,
Tags: newTags,