Skip to content

Commit d5ecfe6

Browse files
ardagucluardaguclu
committed
Tombstone KMSConfig as it is obsolete
1 parent 88f1722 commit d5ecfe6

14 files changed

Lines changed: 53 additions & 1168 deletions

‎config/v1/tests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml‎

Lines changed: 0 additions & 194 deletions
This file was deleted.

‎config/v1/types_apiserver.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,7 @@ type APIServerEncryption struct {
196196
// +optional
197197
Type EncryptionType `json:"type,omitempty"`
198198

199+
// Tombstone: Functionality was not implemented for this struct. There will be newer struct for new design.
199200
// kms defines the configuration for the external KMS instance that manages the encryption keys,
200201
// when KMS encryption is enabled sensitive resources will be encrypted using keys managed by an
201202
// externally configured KMS instance.
@@ -207,7 +208,7 @@ type APIServerEncryption struct {
207208
// +openshift:enable:FeatureGate=KMSEncryptionProvider
208209
// +unionMember
209210
// +optional
210-
KMS *KMSConfig `json:"kms,omitempty"`
211+
//KMS *KMSConfig `json:"kms,omitempty"`
211212
}
212213

213214
// +openshift:validation:FeatureGateAwareEnum:featureGate="",enum="";identity;aescbc;aesgcm

‎config/v1/types_kmsencryption.go‎

Lines changed: 47 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,85 +1,59 @@
11
package v1
22

3+
// Start: TOMBSTONE
4+
35
// KMSConfig defines the configuration for the KMS instance
46
// that will be used with KMSEncryptionProvider encryption
5-
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'Manual' ? (has(self.manual) && has(self.manual.name) && self.manual.name != '') : !has(self.manual)",message="manual config with non-empty name is required when kms provider type is Manual, and forbidden otherwise"
67
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws config is required when kms provider type is AWS, and forbidden otherwise"
78
// +union
8-
type KMSConfig struct {
9-
// type defines the kind of platform for the KMS provider.
10-
// Available provider types are AWS, Manual.
11-
//
12-
// +unionDiscriminator
13-
// +required
14-
Type KMSProviderType `json:"type"`
15-
16-
// manual defines the configuration for manually managed KMS plugins.
17-
// The KMS plugin must be deployed as a static pod by the cluster admin.
18-
//
19-
// +unionMember
20-
// +optional
21-
Manual *ManualKMSConfig `json:"manual,omitempty"`
22-
23-
// aws defines the key config for using an AWS KMS instance
24-
// for the encryption. The AWS KMS instance is managed
25-
// by the user outside the purview of the control plane.
26-
// Deprecated: There is no logic listening to this resource type, we plan to remove it in next release.
27-
//
28-
// +unionMember
29-
// +optional
30-
AWS *AWSKMSConfig `json:"aws,omitempty"`
31-
}
32-
33-
// ManualKMSConfig defines the configuration for manually managed KMS plugins
34-
type ManualKMSConfig struct {
35-
// name specifies the KMS plugin name.
36-
// This name is templated into the UNIX domain socket path: unix:///var/run/kmsplugin/<name>.sock
37-
// and is between 1 and 80 characters in length.
38-
// The KMS plugin must listen at this socket path.
39-
// The name must be a safe socket filename and must not contain '/' or '..'.
40-
//
41-
// +kubebuilder:validation:MaxLength=80
42-
// +kubebuilder:validation:MinLength=1
43-
// +kubebuilder:validation:XValidation:rule="!self.contains('/') && !self.contains('..')",message="name must be a safe socket filename (must not contain '/' or '..')"
44-
// +optional
45-
Name string `json:"name,omitempty"`
46-
}
9+
//type KMSConfig struct {
10+
// type defines the kind of platform for the KMS provider.
11+
// Available provider types are AWS only.
12+
//
13+
// +unionDiscriminator
14+
// +required
15+
//Type KMSProviderType `json:"type"`
16+
17+
// aws defines the key config for using an AWS KMS instance
18+
// for the encryption. The AWS KMS instance is managed
19+
// by the user outside the purview of the control plane.
20+
//
21+
// +unionMember
22+
// +optional
23+
//AWS *AWSKMSConfig `json:"aws,omitempty"`
24+
//}
4725

4826
// AWSKMSConfig defines the KMS config specific to AWS KMS provider
49-
// Deprecated: There is no logic listening to this resource type, we plan to remove it in next release.
50-
type AWSKMSConfig struct {
51-
// keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
52-
// The value must adhere to the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`, where:
53-
// - `<region>` is the AWS region consisting of lowercase letters and hyphens followed by a number.
54-
// - `<account_id>` is a 12-digit numeric identifier for the AWS account.
55-
// - `<key_id>` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
56-
//
57-
// +kubebuilder:validation:MaxLength=128
58-
// +kubebuilder:validation:MinLength=1
59-
// +kubebuilder:validation:XValidation:rule="self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')",message="keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
60-
// +required
61-
KeyARN string `json:"keyARN"`
62-
// region specifies the AWS region where the KMS instance exists, and follows the format
63-
// `<region-prefix>-<region-name>-<number>`, e.g.: `us-east-1`.
64-
// Only lowercase letters and hyphens followed by numbers are allowed.
65-
//
66-
// +kubebuilder:validation:MaxLength=64
67-
// +kubebuilder:validation:MinLength=1
68-
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]+(-[a-z0-9]+)*$')",message="region must be a valid AWS region, consisting of lowercase characters, digits and hyphens (-) only."
69-
// +required
70-
Region string `json:"region"`
71-
}
27+
//type AWSKMSConfig struct {
28+
// keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
29+
// The value must adhere to the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`, where:
30+
// - `<region>` is the AWS region consisting of lowercase letters and hyphens followed by a number.
31+
// - `<account_id>` is a 12-digit numeric identifier for the AWS account.
32+
// - `<key_id>` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
33+
//
34+
// +kubebuilder:validation:MaxLength=128
35+
// +kubebuilder:validation:MinLength=1
36+
// +kubebuilder:validation:XValidation:rule="self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')",message="keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
37+
// +required
38+
//KeyARN string `json:"keyARN"`
39+
// region specifies the AWS region where the KMS instance exists, and follows the format
40+
// `<region-prefix>-<region-name>-<number>`, e.g.: `us-east-1`.
41+
// Only lowercase letters and hyphens followed by numbers are allowed.
42+
//
43+
// +kubebuilder:validation:MaxLength=64
44+
// +kubebuilder:validation:MinLength=1
45+
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]+(-[a-z0-9]+)*$')",message="region must be a valid AWS region, consisting of lowercase characters, digits and hyphens (-) only."
46+
// +required
47+
//Region string `json:"region"`
48+
//}
7249

7350
// KMSProviderType is a specific supported KMS provider
74-
// +kubebuilder:validation:Enum=AWS;Manual
75-
type KMSProviderType string
51+
// +kubebuilder:validation:Enum=AWS
52+
//type KMSProviderType string
7653

77-
const (
78-
// AWSKMSProvider represents a supported KMS provider for use with AWS KMS
79-
// Deprecated: There is no logic listening to this resource type, we plan to remove it in next release.
80-
AWSKMSProvider KMSProviderType = "AWS"
54+
//const (
55+
// AWSKMSProvider represents a supported KMS provider for use with AWS KMS
56+
// AWSKMSProvider KMSProviderType = "AWS"
57+
//)
8158

82-
// ManualKMSProvider represents a supported KMS provider is managed by user manually not by OpenShift.
83-
// KMS plugin is supposed to be run as static pods on each control plane
84-
ManualKMSProvider KMSProviderType = "Manual"
85-
)
59+
// End: TOMBSTONE

0 commit comments

Comments
 (0)