googlecloudplatform / k8s-cloudkms-plugin Goto Github PK

Instead of RegisterMetrics with a sync.Once, just add

func init() {
  prometheus.MustRegister(CloudKMSOperationalLatencies)
  prometheus.MustRegister(CloudKMSOperationalFailuresTotal)
}

(you can have multiple init funcs btw).

Opened at https://github.com/GoogleCloudPlatform/k8s-cloudkms-plugin/blob/master/plugin/http_client.go#L45 and not closed

Currently test_config.go is exposed to non-test code and is included in final binary
Move it to plugin_test.go since it's test-specific data.

The only identifiers used in main are:

• MetricsPort/Path
• HealthzPort/Path
• New
• NewOrchestrator
• KeyURIPattern

Unexport:

• APIVersion
• TestKeyURI
• CloudKMSOperationalLatencies
• CloudKMSOperationalFailuresTotal
• RecordCloudKMSOperation
• RegisterMetrics
• Metrics/NewMetrics
• TokenConfig
• Validator/NewValidator

https://github.com/GoogleCloudPlatform/k8s-cloudkms-plugin/blob/master/plugin/http_client_test.go#L25

Hi,

As per kubernetes/enhancements#460 (comment) I was hoping some deployment instructions would be made available

Any news on this?

This isn't really the appropriate place to be posting this. But I figured I would make someone aware of a project I'm working on that uses KMS to encrypt secrets to be stored in source control which can also sync with K8s.

https://github.com/sourcec0de/gvault

I'm curious how I could get my tool to play well with this plugin :)

Following the example on the main documentation, references the pre-built image gcr.io/cloud-kms-lab/cloud-kms-plugin:dev

When running the image using the example code:

docker run \
    --name="kms-plugin" \
    --network="host" \
    --detach \
    --rm \
    --volume "${SOCKET_DIR}:${SOCKET_DIR}:rw" \
    "${PLUGIN_IMAGE}" \
      /k8s-cloud-kms-plugin \
        --logtostderr \
        --integration-test="true" \
        --path-to-unix-socket="${SOCKET_PATH}" \
        --key-uri="${KMS_FULL_KEY}"

(with the variables set accordingly), docker throws out this error:

docker: Error response from daemon: OCI runtime create failed: container_linux.go:345: starting container process caused "exec: \"/k8s-cloud-kms-plugin\": stat /k8s-cloud-kms-plugin: no such file or directory": unknown.

I'm assuming this isn't intentional? Rebuilding the image using the guide also gives the same error using the newly built image.

Hello!

I cannot push to my project the image, i am getting this error when I run bazel run cmd/plugin:push

INFO: Writing tracer profile to '/private/var/tmp/_bazel_murbano/73b6f5ffed7a5444a1c9c28cf5208578/command.profile.gz'
ERROR: /private/var/tmp/_bazel_murbano/73b6f5ffed7a5444a1c9c28cf5208578/external/io_bazel_rules_go/BUILD.bazel:66:1: in go_context_data rule @io_bazel_rules_go//:go_con
text_data: 
Traceback (most recent call last):
        File "/private/var/tmp/_bazel_murbano/73b6f5ffed7a5444a1c9c28cf5208578/external/io_bazel_rules_go/BUILD.bazel", line 66
                go_context_data(name = 'go_context_data')
        File "/private/var/tmp/_bazel_murbano/73b6f5ffed7a5444a1c9c28cf5208578/external/io_bazel_rules_go/go/private/context.bzl", line 400, in _go_context_data_impl
                cc_common.configure_features(<3 more arguments>)
Incompatible flag --incompatible_require_ctx_in_configure_features has been flipped, and the mandatory parameter 'ctx' of cc_common.configure_features is missing. Please add 'ctx' as a named parameter. See https://github.com/bazelbuild/bazel/issues/7793 for details.
DEBUG: Rule 'distroless_static' indicated that a canonical reproducible form can be obtained by modifying arguments digest = "sha256:c6d5981545ce1406d33e61434c61e9452da
d93ecd8397c41e89036ef977a88f4"
DEBUG: Call stack for the definition of repository 'distroless_static' which is a container_pull (rule definition at /private/var/tmp/_bazel_murbano/73b6f5ffed7a5444a1c
9c28cf5208578/external/io_bazel_rules_docker/container/pull.bzl:173:18):
 - /Users/murbano/go/src/github.com/GoogleCloudPlatform/k8s-cloudkms-plugin/WORKSPACE:107:1
ERROR: Analysis of target '//cmd/plugin:push' failed; build aborted: Analysis of target '@io_bazel_rules_go//:go_context_data' failed; build aborted
INFO: Elapsed time: 0.560s
INFO: 0 processes.
FAILED: Build did NOT complete successfully (1 packages loaded, 31 targets configured)
FAILED: Build did NOT complete successfully (1 packages loaded, 31 targets configured)

I am using last version of bazel 1.1.0.

According to the EncryptionConfiguration specification, it is only possible to configure a single KMS provider for a given K8s resource type.

Since Google Cloud KMS plugin is only configured with a single Cloud KMS key resource name, that means that that single key will be used to encrypt resources of all workloads running in the cluster.

If the key has to be replaced, that would affect encrypted data of all applications running in the cluster.

Even though the procedure for key replacement for the entire cluster and for the single application be similar, would it make sense and possible to extend the plugin to support different keys for different namespaces or workload identities?

https://github.com/GoogleCloudPlatform/k8s-cloudkms-plugin/tree/master/v1beta1 has the compiled Go proto stub, but not the .proto file itself.

Hello 👋🏻

As part of Kubernetes 1.25 enhancement we (sig-auth kms wg) are proposing a new v2alpha1 KeyManagementService service contract to:

• enable fully automated key rotation for the latest key
• improve KMS plugin health check reliability
• improve observability of envelop operations between kube-apiserver, KMS plugins and KMS

This is the doc that documents the limitations with the current KMS v1 API.

In addition, we are also proposing a SIG-Auth maintained KMS plugin reference implementation. This implementation will support a key hierarchy design that implements the v2alpha1 API and will serve as a baseline that provides:

• improve readiness times for clusters with a large number of encrypted resources
• reduce the likelihood of hitting the external KMS request rate limit
• metrics and tracing support

We have a KEP open for this proposal that details the changes and design: kubernetes/enhancements#3302

Call to action

We are looking for feedback on the proposed changes in the KEP from all the plugin authors who are currently using the KMS v1 API. Please review the proposal and comment on the PR if there are any questions/concerns with the proposed design.

The package is imported in
https://github.com/GoogleCloudPlatform/k8s-cloudkms-plugin/blob/master/plugin/http_client.go#L33

error during build:

[opc@instance-iad k8s-cloudkms-plugin]$ make
rm -f k8s-cloud-kms-plugin
GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go test ./...
plugin/http_client.go:33:2: cannot find package "gopkg.in/gcfg.v1" in any of:
/home/opc/go/src/github.com/GoogleCloudPlatform/k8s-cloudkms-plugin/vendor/gopkg.in/gcfg.v1 (vendor tree)
/usr/local/go/src/gopkg.in/gcfg.v1 (from $GOROOT)
/home/opc/go/src/gopkg.in/gcfg.v1 (from $GOPATH)
make: *** [build] Error 1