feat: Added Custom KMS support for boot volume encryption, support for in-transit encryption (#62)

* feat: Added Custom KMS Key encryption support for Boot Volume.

Signed-off-by: Nikhil Kota <[email protected]>

* feat: Added support for in-transit encryption for the data volume's paravirtualized attachment.

Author: KSN2510

compute.tf

@@ -38,7 +38,8 @@ resource "oci_core_instance" "operator" {
     network_type     = "PARAVIRTUALIZED"
   }
 
-  # prevent the operator from destroying and recreating itself if the image ocid changes 
+  is_pv_encryption_in_transit_enabled = var.enable_pv_encryption_in_transit
+  # prevent the operator from destroying and recreating itself if the image ocid changes
   lifecycle {
     ignore_changes = [source_details[0].source_id]
   }
@@ -61,6 +62,7 @@ resource "oci_core_instance" "operator" {
   source_details {
     source_type = "image"
     source_id   = local.operator_image_id
+    kms_key_id  = var.boot_volume_encryption_key
   }
 
   state = var.operator_state

docs/terraformoptions.adoc

@@ -123,6 +123,16 @@ Ensure you review the {uri-terraform-dependencies}[dependencies].
 |imageid/Oracle
 |Oracle
 
+|`enable_pv_encryption_in_transit`
+|Whether to enable in-transit encryption for the data volume's paravirtualized attachment
+|true/false
+|false
+
+|`boot_volume_encryption_key`
+|The OCID of the OCI KMS key to assign as the master encryption key for the boot volume.
+|""
+|
+
 |`enable_operator_instance_principal`
 |Whether to enable instance_principal on the operator.
 |true/false

variables.tf

@@ -126,6 +126,18 @@ variable "upgrade_operator" {
   type        = bool
 }
 
+variable "enable_pv_encryption_in_transit" {
+  description = "Whether to enable in-transit encryption for the data volume's paravirtualized attachment. The default value is false"
+  default = false
+  type = bool
+}
+
+variable "boot_volume_encryption_key" {
+  description = "The OCID of the OCI KMS key to assign as the master encryption key for the boot volume."
+  default     = ""
+  type        = string
+}
+
 # operator notification
 variable "enable_operator_notification" {
   description = "Whether to enable ONS notification for the operator host."
@@ -150,3 +162,4 @@ variable "operator_notification_topic" {
   default     = "operator"
   type        = string
 }
+