@@ -32,7 +32,7 @@ Install [`kubectl`](/docs/tasks/tools/#kubectl).
32
32
33
33
## Re-encrypt Kubernetes secrets using storage version migration
34
34
- To begin with, [ configure KMS provider] ( /docs/tasks/administer-cluster/kms-provider/ )
35
- to encrypt data at rest in etcd using following encryption configuration.
35
+ to encrypt data at rest in etcd using following encryption configuration.
36
36
``` yaml
37
37
kind : EncryptionConfiguration
38
38
apiVersion : apiserver.config.k8s.io/v1
@@ -89,14 +89,14 @@ with new key `key2`, you will use _Storage Version Migration_.
89
89
kubectl apply -f migrate-secret.yaml
90
90
` ` `
91
91
- Monitor migration of Secrets by checking the `.status` of the StorageVersionMigration.
92
- A successful migration should have its
92
+ A successful migration should have its
93
93
` Succeeded` condition set to true. Get the StorageVersionMigration object
94
94
as follows :
95
95
` ` ` shell
96
96
kubectl get storageversionmigration.storagemigration.k8s.io/secrets-migration -o yaml
97
97
` ` `
98
98
99
- The output is similar to:
99
+ The output is similar to :
100
100
` ` ` yaml
101
101
kind: StorageVersionMigration
102
102
apiVersion: storagemigration.k8s.io/v1alpha1
@@ -125,7 +125,7 @@ as follows:
125
125
- [Verify](/docs/tasks/administer-cluster/kms-provider/#verifying-that-the-data-is-encrypted)
126
126
the stored secret is now prefixed with `k8s:enc:aescbc:v1:key2`.
127
127
128
- # # Update the preferred storage schema of the resource while moving from _v1_ to _v2_
128
+ # # Update the preferred storage schema of a CRD
129
129
Consider a scenario where a {{< glossary_tooltip term_id="CustomResourceDefinition" text="CustomResourceDefinition" >}}
130
130
(CRD) is created to serve custom resources (CRs) and is set as the preferred storage schema. When it's time
131
131
to introduce v2 of the CRD, it can be added for serving only with a conversion
@@ -189,7 +189,7 @@ This migration can be achieved through _Storage Version Migration_ to migrate al
189
189
` ` ` shell
190
190
ETCDCTL_API=3 etcdctl get /kubernetes.io/stable.example.com/testcrds/default/cr1 [...] | hexdump -C
191
191
` ` `
192
- where [...] contains the additional arguments for connecting to the etcd server.
192
+ where ` [...]` contains the additional arguments for connecting to the etcd server.
193
193
- Update the CRD `test-crd.yaml` to include v2 version for serving and storage
194
194
and v1 as serving only, as follows :
195
195
` ` ` yaml
@@ -256,7 +256,7 @@ This migration can be achieved through _Storage Version Migration_ to migrate al
256
256
` ` ` shell
257
257
ETCDCTL_API=3 etcdctl get /kubernetes.io/stable.example.com/testcrds/default/cr2 [...] | hexdump -C
258
258
` ` `
259
- where [...] contains the additional arguments for connecting to the etcd server.
259
+ where ` [...]` contains the additional arguments for connecting to the etcd server.
260
260
- Create a StorageVersionMigration manifest named `migrate-crd.yaml`, with the contents as follows :
261
261
` ` ` yaml
262
262
kind: StorageVersionMigration
@@ -274,7 +274,7 @@ This migration can be achieved through _Storage Version Migration_ to migrate al
274
274
kubectl apply -f migrate-crd.yaml
275
275
` ` `
276
276
- Monitor migration of secrets using status. Successful migration should have
277
- _Succeeded_ condition set to _true_ in the status field. Get the migration resource
277
+ ` Succeeded ` condition set to "True" in the status field. Get the migration resource
278
278
as follows :
279
279
` ` ` shell
280
280
kubectl get storageversionmigration.storagemigration.k8s.io/crdsvm -o yaml
@@ -310,4 +310,4 @@ This migration can be achieved through _Storage Version Migration_ to migrate al
310
310
` ` ` shell
311
311
ETCDCTL_API=3 etcdctl get /kubernetes.io/stable.example.com/testcrds/default/cr1 [...] | hexdump -C
312
312
` ` `
313
- where [...] contains the additional arguments for connecting to the etcd server.
313
+ where ` [...]` contains the additional arguments for connecting to the etcd server.
0 commit comments