Add KMS v2alpha1 API #110201

aramase · 2022-05-24T23:55:19Z

Signed-off-by: Anish Ramasekar anish.ramasekar@gmail.com

What type of PR is this?

/kind feature

What this PR does / why we need it:

Refactors the script for generating source files (v1beta1 and v2alpha1)
Adds KMS v2alpha1 API and generates source files

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Adds KMS v2alpha1 API

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[KEP]: https://github.com/kubernetes/enhancements/pull/3302

aramase · 2022-05-24T23:55:45Z

/sig auth
/hold
/cc @ritazh @enj

aramase · 2022-05-24T23:58:09Z

hack/update-generated-kms-dockerized.sh

+kube::protoc::generate_proto "${KUBE_KMS_V1BETA1}"
+kube::protoc::generate_proto "${KUBE_KMS_V2ALPHA1}"


hack/lib/protoc.sh uses api.proto as file name for protoc. I looked at other APIs and they're all named api.proto, so renamed this and reused the existing script for generating the source files.

leilajal · 2022-05-26T16:32:51Z

/remove-sig api-machinery

ritazh · 2022-05-31T15:33:45Z

/triage accepted

staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v2alpha1/api.proto

enj · 2022-06-24T14:19:41Z

/priority important-soon
/milestone v1.25
/assign

enj

This is close.

enj · 2022-06-24T14:25:24Z

staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1/api.pb.go

-var fileDescriptor_a0b84a42fa06f626 = []byte{
-	// 287 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x52, 0xcd, 0x4a, 0xc4, 0x30,
-	0x10, 0xde, 0xae, 0xb8, 0xc5, 0xb1, 0xb6, 0x10, 0x16, 0x2d, 0x9e, 0x34, 0x97, 0x55, 0x0f, 0x85,
-	0xd5, 0xbb, 0x88, 0xe8, 0x49, 0xf4, 0x50, 0xc1, 0xab, 0x64, 0xcb, 0xa0, 0x05, 0x9b, 0xc6, 0x24,
-	0x5b, 0xd9, 0x17, 0xf5, 0x79, 0xc4, 0x66, 0x5a, 0xd3, 0x15, 0x71, 0x8f, 0x33, 0x99, 0xef, 0x6f,
-	0x26, 0xb0, 0x67, 0x50, 0x37, 0x65, 0x81, 0x99, 0xd2, 0xb5, 0xad, 0x59, 0xd8, 0xcc, 0x17, 0x68,
-	0xc5, 0x9c, 0x9f, 0x41, 0xfc, 0x84, 0xda, 0x94, 0xb5, 0xcc, 0xf1, 0x7d, 0x89, 0xc6, 0xb2, 0x14,
-	0xc2, 0xc6, 0x75, 0xd2, 0xe0, 0x28, 0x38, 0xd9, 0xc9, 0xbb, 0x92, 0x7f, 0x40, 0xd2, 0xcf, 0x1a,
-	0x55, 0x4b, 0x83, 0x7f, 0x0f, 0xb3, 0x63, 0x88, 0xf4, 0x52, 0xda, 0xb2, 0xc2, 0x67, 0x29, 0x2a,
-	0x4c, 0xc7, 0xed, 0xf3, 0x2e, 0xf5, 0x1e, 0x44, 0x85, 0x6c, 0x06, 0x49, 0x37, 0xd2, 0x91, 0x6c,
-	0xb5, 0x53, 0x31, 0xb5, 0x49, 0x8d, 0x5f, 0x43, 0x7c, 0x83, 0x85, 0x5e, 0x29, 0xfb, 0xaf, 0x49,
-	0xb6, 0x0f, 0x93, 0xa2, 0x54, 0xaf, 0xa8, 0x5b, 0xc5, 0x28, 0xa7, 0x8a, 0xcf, 0x20, 0xe9, 0x39,
-	0xc8, 0xfc, 0x14, 0xb6, 0xd5, 0x9b, 0x28, 0x1d, 0x45, 0x94, 0xbb, 0x82, 0x5f, 0x41, 0x7c, 0x2b,
-	0x37, 0x14, 0xeb, 0x19, 0xc6, 0x3e, 0xc3, 0x29, 0x24, 0x3d, 0x03, 0x49, 0xfd, 0xb8, 0x0a, 0x7c,
-	0x57, 0xe7, 0x9f, 0x01, 0x4c, 0xef, 0x70, 0x75, 0x2f, 0xa4, 0x78, 0xc1, 0x0a, 0xa5, 0x7d, 0x74,
-	0x67, 0x62, 0x97, 0x10, 0x52, 0x7a, 0x76, 0x90, 0xd1, 0xb1, 0xb2, 0xe1, 0xa5, 0x0e, 0xd3, 0xdf,
-	0x0f, 0x4e, 0x8e, 0x8f, 0xbe, 0xf1, 0x14, 0xd7, 0xc3, 0x0f, 0x97, 0xe8, 0xe1, 0xd7, 0x36, 0xe3,
-	0xf0, 0x94, 0xc1, 0xc3, 0x0f, 0xf7, 0xe2, 0xe1, 0xd7, 0xe2, 0xf2, 0xd1, 0x62, 0xd2, 0xfe, 0xb3,
-	0x8b, 0xaf, 0x00, 0x00, 0x00, 0xff, 0xff, 0x33, 0x8d, 0x09, 0xe1, 0x78, 0x02, 0x00, 0x00,
+func init() { proto.RegisterFile("api.proto", fileDescriptor_00212fb1f9d3bf1c) }
+
+var fileDescriptor_00212fb1f9d3bf1c = []byte{
+	// 286 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x52, 0x4f, 0x4b, 0xc3, 0x30,
+	0x14, 0x5f, 0x27, 0xae, 0xec, 0x59, 0x5a, 0x08, 0x43, 0x8b, 0x27, 0xcd, 0x65, 0xea, 0xa1, 0x30,
+	0xbd, 0x8b, 0x88, 0x9e, 0x44, 0x0f, 0x15, 0xbc, 0x4a, 0x56, 0x1e, 0x1a, 0xb0, 0x69, 0x4c, 0xb3,
+	0xca, 0xbe, 0xa8, 0x9f, 0x47, 0x6c, 0x5e, 0x6b, 0x3a, 0x11, 0x77, 0x7c, 0x2f, 0xef, 0xf7, 0xef,
+	0xbd, 0xc0, 0x54, 0x68, 0x99, 0x69, 0x53, 0xd9, 0x8a, 0x85, 0xcd, 0x62, 0x89, 0x56, 0x2c, 0xf8,
+	0x19, 0xc4, 0x4f, 0x68, 0x6a, 0x59, 0xa9, 0x1c, 0xdf, 0x57, 0x58, 0x5b, 0x96, 0x42, 0xd8, 0xb8,
+	0x4e, 0x1a, 0x1c, 0x05, 0x27, 0xd3, 0xbc, 0x2b, 0xf9, 0x07, 0x24, 0xfd, 0x6c, 0xad, 0x2b, 0x55,
+	0xe3, 0xdf, 0xc3, 0xec, 0x18, 0x22, 0xb3, 0x52, 0x56, 0x96, 0xf8, 0xac, 0x44, 0x89, 0xe9, 0xb8,
+	0x7d, 0xde, 0xa3, 0xde, 0x83, 0x28, 0x91, 0xcd, 0x21, 0xe9, 0x46, 0x3a, 0x92, 0x9d, 0x76, 0x2a,
+	0xa6, 0x36, 0xa9, 0xf1, 0x6b, 0x88, 0x6f, 0xb0, 0x30, 0x6b, 0x6d, 0xff, 0x35, 0xc9, 0xf6, 0x61,
+	0x52, 0x48, 0xfd, 0x8a, 0xa6, 0x55, 0x8c, 0x72, 0xaa, 0xf8, 0x1c, 0x92, 0x9e, 0x83, 0xcc, 0xcf,
+	0x60, 0x57, 0xbf, 0x09, 0xe9, 0x28, 0xa2, 0xdc, 0x15, 0xfc, 0x0a, 0xe2, 0x5b, 0xb5, 0xa5, 0x58,
+	0xcf, 0x30, 0xf6, 0x19, 0x4e, 0x21, 0xe9, 0x19, 0x48, 0xea, 0xc7, 0x55, 0xe0, 0xbb, 0x3a, 0xff,
+	0x0c, 0x60, 0x76, 0x87, 0xeb, 0x7b, 0xa1, 0xc4, 0x0b, 0x96, 0xa8, 0xec, 0x23, 0x9a, 0x46, 0x16,
+	0xc8, 0x2e, 0x21, 0xa4, 0xf4, 0xec, 0x20, 0xa3, 0x63, 0x65, 0xc3, 0x4b, 0x1d, 0xa6, 0xbf, 0x1f,
+	0x9c, 0x1c, 0x1f, 0x7d, 0xe3, 0x29, 0xae, 0x87, 0x1f, 0x2e, 0xd1, 0xc3, 0x6f, 0x6c, 0xc6, 0xe1,
+	0x29, 0x83, 0x87, 0x1f, 0xee, 0xc5, 0xc3, 0x6f, 0xc4, 0xe5, 0xa3, 0xe5, 0xa4, 0xfd, 0x67, 0x17,
+	0x5f, 0x01, 0x00, 0x00, 0xff, 0xff, 0x57, 0xc8, 0x65, 0x5a, 0x74, 0x02, 0x00, 0x00,


I totally reviewed every byte of this change 😜

staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v2alpha1/api.proto

enj · 2022-06-24T14:36:47Z

staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v2alpha1/api.proto

+
+// This service defines the public APIs for remote KMS provider.
+service KeyManagementService {
+    // this API is meant to be polled (or maybe we should make it stream?)


We probably need to make that decision now.

+1 for polling. If the polling interval is not too high, I think that would be enough for us to detect any changes soon enough.

staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v2alpha1/api.proto

enj · 2022-06-24T15:29:49Z

/hold cancel

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

enj · 2022-06-24T18:46:11Z

/lgtm
/approve

k8s-ci-robot · 2022-06-24T18:49:08Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aramase, enj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~hack/OWNERS~~ [enj]
~~staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/OWNERS~~ [enj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot requested review from lavalamp and smarterclayton May 24, 2022 23:55

k8s-ci-robot added area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels May 24, 2022

k8s-ci-robot requested a review from enj May 24, 2022 23:55

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 24, 2022

k8s-ci-robot requested a review from ritazh May 24, 2022 23:55

aramase commented May 24, 2022

View reviewed changes

aramase force-pushed the kmsv2 branch from 7af2faf to 7a48fa1 Compare May 25, 2022 01:10

k8s-ci-robot removed the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label May 26, 2022

k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels May 31, 2022

enj added this to Needs Triage in SIG Auth Old Jun 6, 2022

ritazh moved this from Needs Triage to In Progress in SIG Auth Old Jun 8, 2022

aramase force-pushed the kmsv2 branch from 7a48fa1 to 77adedb Compare June 10, 2022 19:21

k8s-ci-robot added the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label Jun 10, 2022

ritazh reviewed Jun 21, 2022

View reviewed changes

staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v2alpha1/api.proto Outdated Show resolved Hide resolved

ritazh reviewed Jun 21, 2022

View reviewed changes

staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v2alpha1/api.proto Outdated Show resolved Hide resolved

aramase force-pushed the kmsv2 branch 2 times, most recently from 76e5480 to 57d0a05 Compare June 21, 2022 16:46

aramase requested a review from ritazh June 21, 2022 16:50

aramase force-pushed the kmsv2 branch from 57d0a05 to 365123b Compare June 21, 2022 17:39

k8s-ci-robot assigned enj Jun 24, 2022

k8s-ci-robot added the priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. label Jun 24, 2022

k8s-ci-robot added this to the v1.25 milestone Jun 24, 2022

k8s-ci-robot removed the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label Jun 24, 2022

enj suggested changes Jun 24, 2022

View reviewed changes

SIG Auth Old automation moved this from In Progress to Changes Requested Jun 24, 2022

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 24, 2022

aramase force-pushed the kmsv2 branch 2 times, most recently from eb446d1 to eb4c169 Compare June 24, 2022 17:10

aramase requested a review from enj June 24, 2022 17:10

Add KMS v2alpha1 API

9075454

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

aramase force-pushed the kmsv2 branch from eb4c169 to 9075454 Compare June 24, 2022 17:58

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jun 24, 2022

enj approved these changes Jun 24, 2022

View reviewed changes

aramase mentioned this pull request Jun 24, 2022

update proto snippets in kms v2 kubernetes/enhancements#3426

Merged

k8s-ci-robot merged commit 1d22329 into kubernetes:master Jun 24, 2022

SIG Auth Old automation moved this from Changes Requested to Closed / Done Jun 24, 2022

aramase deleted the kmsv2 branch June 24, 2022 19:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add KMS v2alpha1 API #110201

Add KMS v2alpha1 API #110201

aramase commented May 24, 2022

aramase commented May 24, 2022

aramase May 24, 2022

leilajal commented May 26, 2022

ritazh commented May 31, 2022

enj commented Jun 24, 2022

enj left a comment

enj Jun 24, 2022

enj Jun 24, 2022

aramase Jun 24, 2022

enj commented Jun 24, 2022

enj commented Jun 24, 2022

k8s-ci-robot commented Jun 24, 2022

		kube::protoc::generate_proto "${KUBE_KMS_V1BETA1}"
		kube::protoc::generate_proto "${KUBE_KMS_V2ALPHA1}"

Add KMS v2alpha1 API #110201

Add KMS v2alpha1 API #110201

Conversation

aramase commented May 24, 2022

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

aramase commented May 24, 2022

aramase May 24, 2022

Choose a reason for hiding this comment

leilajal commented May 26, 2022

ritazh commented May 31, 2022

enj commented Jun 24, 2022

enj left a comment

Choose a reason for hiding this comment

enj Jun 24, 2022

Choose a reason for hiding this comment

enj Jun 24, 2022

Choose a reason for hiding this comment

aramase Jun 24, 2022

Choose a reason for hiding this comment

enj commented Jun 24, 2022

enj commented Jun 24, 2022

k8s-ci-robot commented Jun 24, 2022