Skip to content

Commit 6e578cb

Browse files
k0dak0da
committed
RKE2ControlPlane: v1beta1 support EncryptionConfig
This commit adds RKE2ControlPlane.spec.serverConfig.secretsEncryption property. This allows to specify provider type (aescbc or secretbox) and load encryption key from a secret. Signed-off-by: Dinar Valeev <k0da@opensuse.org>
1 parent 6df9b19 commit 6e578cb

9 files changed

Lines changed: 370 additions & 0 deletions

‎controlplane/api/v1alpha1/rke2controlplane_types.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,10 @@ type RKE2ServerConfig struct {
132132
//+optional
133133
Etcd EtcdConfig `json:"etcd,omitempty"`
134134

135+
// SecretsEncrytion defines encryption at rest configuration
136+
//+optional
137+
SecretsEncryptionProvider *SecretsEncryption `json:"secretsEncryption,omitempty"`
138+
135139
// KubeAPIServer defines optional custom configuration of the Kube API Server.
136140
//+optional
137141
KubeAPIServer *bootstrapv1alpha1.ComponentConfig `json:"kubeAPIServer,omitempty"`
@@ -202,6 +206,15 @@ type RKE2ControlPlaneStatus struct {
202206
AvailableServerIPs []string `json:"availableServerIPs,omitempty"`
203207
}
204208

209+
// SecretsEncryption defines encryption configuration.
210+
type SecretsEncryption struct {
211+
// EncyptionKey secret reference
212+
EncryptionKeySecret *corev1.ObjectReference `json:"encryptionKeySecret,omitempty"`
213+
// Encryption provider
214+
// +kubebuilder:validation:Enum=aescbc;secretbox
215+
Provider string `json:"provider,omitempty"`
216+
}
217+
205218
//+kubebuilder:object:root=true
206219
//+kubebuilder:subresource:status
207220

‎controlplane/api/v1alpha1/zz_generated.conversion.go‎

Lines changed: 34 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎controlplane/api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎controlplane/api/v1beta1/rke2controlplane_types.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,10 @@ type RKE2ServerConfig struct {
211211
//+optional
212212
Etcd EtcdConfig `json:"etcd,omitempty"`
213213

214+
// SecretsEncrytion defines encryption at rest configuration
215+
//+optional
216+
SecretsEncryptionProvider *SecretsEncryption `json:"secretsEncryption,omitempty"`
217+
214218
// KubeAPIServer defines optional custom configuration of the Kube API Server.
215219
//+optional
216220
KubeAPIServer *bootstrapv1.ComponentConfig `json:"kubeAPIServer,omitempty"`
@@ -402,6 +406,15 @@ type EtcdS3 struct {
402406
Folder string `json:"folder,omitempty"`
403407
}
404408

409+
// SecretsEncryption defines encryption configuration.
410+
type SecretsEncryption struct {
411+
// EncyptionKey secret reference
412+
EncryptionKeySecret *corev1.ObjectReference `json:"encryptionKeySecret,omitempty"`
413+
// Encryption provider
414+
// +kubebuilder:validation:Enum=aescbc;secretbox
415+
Provider string `json:"provider,omitempty"`
416+
}
417+
405418
// CNI defines the Cni options for deploying RKE2.
406419
type CNI string
407420

‎controlplane/api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎controlplane/config/crd/bases/controlplane.cluster.x-k8s.io_rke2controlplanes.yaml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1113,6 +1113,59 @@ spec:
11131113
pauseImage:
11141114
description: PauseImage Override image to use for pause.
11151115
type: string
1116+
secretsEncryption:
1117+
description: SecretsEncrytion defines encryption at rest configuration
1118+
properties:
1119+
encryptionKeySecret:
1120+
description: EncyptionKey secret reference
1121+
properties:
1122+
apiVersion:
1123+
description: API version of the referent.
1124+
type: string
1125+
fieldPath:
1126+
description: |-
1127+
If referring to a piece of an object instead of an entire object, this string
1128+
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
1129+
For example, if the object reference is to a container within a pod, this would take on a value like:
1130+
"spec.containers{name}" (where "name" refers to the name of the container that triggered
1131+
the event) or if no container name is specified "spec.containers[2]" (container with
1132+
index 2 in this pod). This syntax is chosen only to have some well-defined way of
1133+
referencing a part of an object.
1134+
type: string
1135+
kind:
1136+
description: |-
1137+
Kind of the referent.
1138+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1139+
type: string
1140+
name:
1141+
description: |-
1142+
Name of the referent.
1143+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1144+
type: string
1145+
namespace:
1146+
description: |-
1147+
Namespace of the referent.
1148+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
1149+
type: string
1150+
resourceVersion:
1151+
description: |-
1152+
Specific resourceVersion to which this reference is made, if any.
1153+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
1154+
type: string
1155+
uid:
1156+
description: |-
1157+
UID of the referent.
1158+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
1159+
type: string
1160+
type: object
1161+
x-kubernetes-map-type: atomic
1162+
provider:
1163+
description: Encryption provider
1164+
enum:
1165+
- aescbc
1166+
- secretbox
1167+
type: string
1168+
type: object
11161169
serviceNodePortRange:
11171170
description: 'ServiceNodePortRange is the port range to reserve
11181171
for services with NodePort visibility (default: "30000-32767").'
@@ -2557,6 +2610,59 @@ spec:
25572610
pauseImage:
25582611
description: PauseImage Override image to use for pause.
25592612
type: string
2613+
secretsEncryption:
2614+
description: SecretsEncrytion defines encryption at rest configuration
2615+
properties:
2616+
encryptionKeySecret:
2617+
description: EncyptionKey secret reference
2618+
properties:
2619+
apiVersion:
2620+
description: API version of the referent.
2621+
type: string
2622+
fieldPath:
2623+
description: |-
2624+
If referring to a piece of an object instead of an entire object, this string
2625+
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
2626+
For example, if the object reference is to a container within a pod, this would take on a value like:
2627+
"spec.containers{name}" (where "name" refers to the name of the container that triggered
2628+
the event) or if no container name is specified "spec.containers[2]" (container with
2629+
index 2 in this pod). This syntax is chosen only to have some well-defined way of
2630+
referencing a part of an object.
2631+
type: string
2632+
kind:
2633+
description: |-
2634+
Kind of the referent.
2635+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
2636+
type: string
2637+
name:
2638+
description: |-
2639+
Name of the referent.
2640+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2641+
type: string
2642+
namespace:
2643+
description: |-
2644+
Namespace of the referent.
2645+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
2646+
type: string
2647+
resourceVersion:
2648+
description: |-
2649+
Specific resourceVersion to which this reference is made, if any.
2650+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
2651+
type: string
2652+
uid:
2653+
description: |-
2654+
UID of the referent.
2655+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
2656+
type: string
2657+
type: object
2658+
x-kubernetes-map-type: atomic
2659+
provider:
2660+
description: Encryption provider
2661+
enum:
2662+
- aescbc
2663+
- secretbox
2664+
type: string
2665+
type: object
25602666
serviceNodePortRange:
25612667
description: 'ServiceNodePortRange is the port range to reserve
25622668
for services with NodePort visibility (default: "30000-32767").'

‎controlplane/config/crd/bases/controlplane.cluster.x-k8s.io_rke2controlplanetemplates.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1414,6 +1414,60 @@ spec:
14141414
pauseImage:
14151415
description: PauseImage Override image to use for pause.
14161416
type: string
1417+
secretsEncryption:
1418+
description: SecretsEncrytion defines encryption at rest
1419+
configuration
1420+
properties:
1421+
encryptionKeySecret:
1422+
description: EncyptionKey secret reference
1423+
properties:
1424+
apiVersion:
1425+
description: API version of the referent.
1426+
type: string
1427+
fieldPath:
1428+
description: |-
1429+
If referring to a piece of an object instead of an entire object, this string
1430+
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
1431+
For example, if the object reference is to a container within a pod, this would take on a value like:
1432+
"spec.containers{name}" (where "name" refers to the name of the container that triggered
1433+
the event) or if no container name is specified "spec.containers[2]" (container with
1434+
index 2 in this pod). This syntax is chosen only to have some well-defined way of
1435+
referencing a part of an object.
1436+
type: string
1437+
kind:
1438+
description: |-
1439+
Kind of the referent.
1440+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1441+
type: string
1442+
name:
1443+
description: |-
1444+
Name of the referent.
1445+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1446+
type: string
1447+
namespace:
1448+
description: |-
1449+
Namespace of the referent.
1450+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
1451+
type: string
1452+
resourceVersion:
1453+
description: |-
1454+
Specific resourceVersion to which this reference is made, if any.
1455+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
1456+
type: string
1457+
uid:
1458+
description: |-
1459+
UID of the referent.
1460+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
1461+
type: string
1462+
type: object
1463+
x-kubernetes-map-type: atomic
1464+
provider:
1465+
description: Encryption provider
1466+
enum:
1467+
- aescbc
1468+
- secretbox
1469+
type: string
1470+
type: object
14171471
serviceNodePortRange:
14181472
description: 'ServiceNodePortRange is the port range to
14191473
reserve for services with NodePort visibility (default:

0 commit comments

Comments
 (0)