Skip to content

Commit 4727e39

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #31682 from tengqm/apiserver-encryption-v1
Add configuration reference for API server encryption
2 parents 9115aaa + 3e58334 commit 4727e39

File tree

3 files changed

+385
-83
lines changed

3 files changed

+385
-83
lines changed

‎content/en/docs/reference/_index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ operator to use or manage a cluster.
7575

7676

7777
* [kube-apiserver configuration (v1)](/docs/reference/config-api/apiserver-config.v1/)
78+
* [kube-apiserver encryption (v1)](/docs/reference/config-api/apiserver-encryption.v1/)
7879
* [kubelet configuration (v1alpha1)](/docs/reference/config-api/kubelet-config.v1alpha1/) and
7980
[kubelet configuration (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/)
8081
* [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) and

‎content/en/docs/reference/config-api/apiserver-encryption.v1.md

Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
---
2+
title: kube-apiserver Encryption Configuration (v1)
3+
content_type: tool-reference
4+
package: apiserver.config.k8s.io/v1
5+
auto_generated: true
6+
---
7+
<p>Package v1 is the v1 version of the API.</p>
8+
9+
10+
## Resource Types
11+
12+
13+
- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration)
14+
15+
16+
17+
## `EncryptionConfiguration` {#apiserver-config-k8s-io-v1-EncryptionConfiguration}
18+
19+
20+
21+
<p>EncryptionConfiguration stores the complete configuration for encryption providers.</p>
22+
23+
24+
<table class="table">
25+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
26+
<tbody>
27+
28+
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr>
29+
<tr><td><code>kind</code><br/>string</td><td><code>EncryptionConfiguration</code></td></tr>
30+
31+
32+
<tr><td><code>resources</code> <B>[Required]</B><br/>
33+
<a href="#apiserver-config-k8s-io-v1-ResourceConfiguration"><code>[]ResourceConfiguration</code></a>
34+
</td>
35+
<td>
36+
<p>resources is a list containing resources, and their corresponding encryption providers.</p>
37+
</td>
38+
</tr>
39+
</tbody>
40+
</table>
41+
42+
## `AESConfiguration` {#apiserver-config-k8s-io-v1-AESConfiguration}
43+
44+
45+
**Appears in:**
46+
47+
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
48+
49+
50+
<p>AESConfiguration contains the API configuration for an AES transformer.</p>
51+
52+
53+
<table class="table">
54+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
55+
<tbody>
56+
57+
58+
<tr><td><code>keys</code> <B>[Required]</B><br/>
59+
<a href="#apiserver-config-k8s-io-v1-Key"><code>[]Key</code></a>
60+
</td>
61+
<td>
62+
<p>keys is a list of keys to be used for creating the AES transformer.
63+
Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.</p>
64+
</td>
65+
</tr>
66+
</tbody>
67+
</table>
68+
69+
## `IdentityConfiguration` {#apiserver-config-k8s-io-v1-IdentityConfiguration}
70+
71+
72+
**Appears in:**
73+
74+
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
75+
76+
77+
<p>IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.</p>
78+
79+
80+
81+
82+
## `KMSConfiguration` {#apiserver-config-k8s-io-v1-KMSConfiguration}
83+
84+
85+
**Appears in:**
86+
87+
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
88+
89+
90+
<p>KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.</p>
91+
92+
93+
<table class="table">
94+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
95+
<tbody>
96+
97+
98+
<tr><td><code>name</code> <B>[Required]</B><br/>
99+
<code>string</code>
100+
</td>
101+
<td>
102+
<p>name is the name of the KMS plugin to be used.</p>
103+
</td>
104+
</tr>
105+
<tr><td><code>cachesize</code><br/>
106+
<code>int32</code>
107+
</td>
108+
<td>
109+
<p>cachesize is the maximum number of secrets which are cached in memory. The default value is 1000.
110+
Set to a negative value to disable caching.</p>
111+
</td>
112+
</tr>
113+
<tr><td><code>endpoint</code> <B>[Required]</B><br/>
114+
<code>string</code>
115+
</td>
116+
<td>
117+
<p>endpoint is the gRPC server listening address, for example &quot;unix:///var/run/kms-provider.sock&quot;.</p>
118+
</td>
119+
</tr>
120+
<tr><td><code>timeout</code><br/>
121+
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
122+
</td>
123+
<td>
124+
<p>timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.</p>
125+
</td>
126+
</tr>
127+
</tbody>
128+
</table>
129+
130+
## `Key` {#apiserver-config-k8s-io-v1-Key}
131+
132+
133+
**Appears in:**
134+
135+
- [AESConfiguration](#apiserver-config-k8s-io-v1-AESConfiguration)
136+
137+
- [SecretboxConfiguration](#apiserver-config-k8s-io-v1-SecretboxConfiguration)
138+
139+
140+
<p>Key contains name and secret of the provided key for a transformer.</p>
141+
142+
143+
<table class="table">
144+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
145+
<tbody>
146+
147+
148+
<tr><td><code>name</code> <B>[Required]</B><br/>
149+
<code>string</code>
150+
</td>
151+
<td>
152+
<p>name is the name of the key to be used while storing data to disk.</p>
153+
</td>
154+
</tr>
155+
<tr><td><code>secret</code> <B>[Required]</B><br/>
156+
<code>string</code>
157+
</td>
158+
<td>
159+
<p>secret is the actual key, encoded in base64.</p>
160+
</td>
161+
</tr>
162+
</tbody>
163+
</table>
164+
165+
## `ProviderConfiguration` {#apiserver-config-k8s-io-v1-ProviderConfiguration}
166+
167+
168+
**Appears in:**
169+
170+
- [ResourceConfiguration](#apiserver-config-k8s-io-v1-ResourceConfiguration)
171+
172+
173+
<p>ProviderConfiguration stores the provided configuration for an encryption provider.</p>
174+
175+
176+
<table class="table">
177+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
178+
<tbody>
179+
180+
181+
<tr><td><code>aesgcm</code> <B>[Required]</B><br/>
182+
<a href="#apiserver-config-k8s-io-v1-AESConfiguration"><code>AESConfiguration</code></a>
183+
</td>
184+
<td>
185+
<p>aesgcm is the configuration for the AES-GCM transformer.</p>
186+
</td>
187+
</tr>
188+
<tr><td><code>aescbc</code> <B>[Required]</B><br/>
189+
<a href="#apiserver-config-k8s-io-v1-AESConfiguration"><code>AESConfiguration</code></a>
190+
</td>
191+
<td>
192+
<p>aescbc is the configuration for the AES-CBC transformer.</p>
193+
</td>
194+
</tr>
195+
<tr><td><code>secretbox</code> <B>[Required]</B><br/>
196+
<a href="#apiserver-config-k8s-io-v1-SecretboxConfiguration"><code>SecretboxConfiguration</code></a>
197+
</td>
198+
<td>
199+
<p>secretbox is the configuration for the Secretbox based transformer.</p>
200+
</td>
201+
</tr>
202+
<tr><td><code>identity</code> <B>[Required]</B><br/>
203+
<a href="#apiserver-config-k8s-io-v1-IdentityConfiguration"><code>IdentityConfiguration</code></a>
204+
</td>
205+
<td>
206+
<p>identity is the (empty) configuration for the identity transformer.</p>
207+
</td>
208+
</tr>
209+
<tr><td><code>kms</code> <B>[Required]</B><br/>
210+
<a href="#apiserver-config-k8s-io-v1-KMSConfiguration"><code>KMSConfiguration</code></a>
211+
</td>
212+
<td>
213+
<p>kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.</p>
214+
</td>
215+
</tr>
216+
</tbody>
217+
</table>
218+
219+
## `ResourceConfiguration` {#apiserver-config-k8s-io-v1-ResourceConfiguration}
220+
221+
222+
**Appears in:**
223+
224+
- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration)
225+
226+
227+
<p>ResourceConfiguration stores per resource configuration.</p>
228+
229+
230+
<table class="table">
231+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
232+
<tbody>
233+
234+
235+
<tr><td><code>resources</code> <B>[Required]</B><br/>
236+
<code>[]string</code>
237+
</td>
238+
<td>
239+
<p>resources is a list of kubernetes resources which have to be encrypted.</p>
240+
</td>
241+
</tr>
242+
<tr><td><code>providers</code> <B>[Required]</B><br/>
243+
<a href="#apiserver-config-k8s-io-v1-ProviderConfiguration"><code>[]ProviderConfiguration</code></a>
244+
</td>
245+
<td>
246+
<p>providers is a list of transformers to be used for reading and writing the resources to disk.
247+
eg: aesgcm, aescbc, secretbox, identity.</p>
248+
</td>
249+
</tr>
250+
</tbody>
251+
</table>
252+
253+
## `SecretboxConfiguration` {#apiserver-config-k8s-io-v1-SecretboxConfiguration}
254+
255+
256+
**Appears in:**
257+
258+
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
259+
260+
261+
<p>SecretboxConfiguration contains the API configuration for an Secretbox transformer.</p>
262+
263+
264+
<table class="table">
265+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
266+
<tbody>
267+
268+
269+
<tr><td><code>keys</code> <B>[Required]</B><br/>
270+
<a href="#apiserver-config-k8s-io-v1-Key"><code>[]Key</code></a>
271+
</td>
272+
<td>
273+
<p>keys is a list of keys to be used for creating the Secretbox transformer.
274+
Each key has to be 32 bytes long.</p>
275+
</td>
276+
</tr>
277+
</tbody>
278+
</table>
279+

0 commit comments

Comments
 (0)