Skip to content

Commit 1488460

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#84605 from andyzhangx/byok
add azure disk encryption(SSE+CMK) support
2 parents efe5edf + b26467b commit 1488460

File tree

8 files changed

+53
-25
lines changed

8 files changed

+53
-25
lines changed

‎pkg/volume/azure_dd/azure_provision.go‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -131,8 +131,9 @@ func (p *azureDiskProvisioner) Provision(selectedNode *v1.Node, allowedTopologie
131131
availabilityZones sets.String
132132
selectedAvailabilityZone string
133133

134-
diskIopsReadWrite string
135-
diskMbpsReadWrite string
134+
diskIopsReadWrite string
135+
diskMbpsReadWrite string
136+
diskEncryptionSetID string
136137
)
137138
// maxLength = 79 - (4 for ".vhd") = 75
138139
name := util.GenerateVolumeName(p.options.ClusterName, p.options.PVName, 75)
@@ -175,6 +176,8 @@ func (p *azureDiskProvisioner) Provision(selectedNode *v1.Node, allowedTopologie
175176
diskIopsReadWrite = v
176177
case "diskmbpsreadwrite":
177178
diskMbpsReadWrite = v
179+
case "diskencryptionsetid":
180+
diskEncryptionSetID = v
178181
default:
179182
return nil, fmt.Errorf("AzureDisk - invalid option %s in storage class", k)
180183
}
@@ -244,15 +247,16 @@ func (p *azureDiskProvisioner) Provision(selectedNode *v1.Node, allowedTopologie
244247
}
245248

246249
volumeOptions := &azure.ManagedDiskOptions{
247-
DiskName: name,
248-
StorageAccountType: skuName,
249-
ResourceGroup: resourceGroup,
250-
PVCName: p.options.PVC.Name,
251-
SizeGB: requestGiB,
252-
Tags: tags,
253-
AvailabilityZone: selectedAvailabilityZone,
254-
DiskIOPSReadWrite: diskIopsReadWrite,
255-
DiskMBpsReadWrite: diskMbpsReadWrite,
250+
DiskName: name,
251+
StorageAccountType: skuName,
252+
ResourceGroup: resourceGroup,
253+
PVCName: p.options.PVC.Name,
254+
SizeGB: requestGiB,
255+
Tags: tags,
256+
AvailabilityZone: selectedAvailabilityZone,
257+
DiskIOPSReadWrite: diskIopsReadWrite,
258+
DiskMBpsReadWrite: diskMbpsReadWrite,
259+
DiskEncryptionSetID: diskEncryptionSetID,
256260
}
257261
diskURI, err = diskController.CreateManagedDisk(volumeOptions)
258262
if err != nil {

‎staging/src/k8s.io/legacy-cloud-providers/azure/azure_controller_common.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ func (c *controllerCommon) getNodeVMSet(nodeName types.NodeName, crt cacheReadTy
9898
// AttachDisk attaches a vhd to vm. The vhd must exist, can be identified by diskName, diskURI.
9999
// return (lun, error)
100100
func (c *controllerCommon) AttachDisk(isManagedDisk bool, diskName, diskURI string, nodeName types.NodeName, cachingMode compute.CachingTypes) (int32, error) {
101+
diskEncryptionSetID := ""
101102
if isManagedDisk {
102103
diskName := path.Base(diskURI)
103104
resourceGroup, err := getResourceGroupFromDiskURI(diskURI)
@@ -122,6 +123,11 @@ func (c *controllerCommon) AttachDisk(isManagedDisk bool, diskName, diskURI stri
122123
danglingErr := volerr.NewDanglingError(attachErr, types.NodeName(attachedNode), "")
123124
return -1, danglingErr
124125
}
126+
127+
if disk.DiskProperties != nil && disk.DiskProperties.Encryption != nil &&
128+
disk.DiskProperties.Encryption.DiskEncryptionSetID != nil {
129+
diskEncryptionSetID = *disk.DiskProperties.Encryption.DiskEncryptionSetID
130+
}
125131
}
126132

127133
vmset, err := c.getNodeVMSet(nodeName, cacheReadTypeUnsafe)
@@ -145,7 +151,7 @@ func (c *controllerCommon) AttachDisk(isManagedDisk bool, diskName, diskURI stri
145151
}
146152

147153
klog.V(2).Infof("Trying to attach volume %q lun %d to node %q.", diskURI, lun, nodeName)
148-
return lun, vmset.AttachDisk(isManagedDisk, diskName, diskURI, nodeName, lun, cachingMode)
154+
return lun, vmset.AttachDisk(isManagedDisk, diskName, diskURI, nodeName, lun, cachingMode, diskEncryptionSetID)
149155
}
150156

151157
// DetachDisk detaches a disk from host. The vhd can be identified by diskName or diskURI.

‎staging/src/k8s.io/legacy-cloud-providers/azure/azure_controller_standard.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ import (
3030

3131
// AttachDisk attaches a vhd to vm
3232
// the vhd must exist, can be identified by diskName, diskURI, and lun.
33-
func (as *availabilitySet) AttachDisk(isManagedDisk bool, diskName, diskURI string, nodeName types.NodeName, lun int32, cachingMode compute.CachingTypes) error {
33+
func (as *availabilitySet) AttachDisk(isManagedDisk bool, diskName, diskURI string, nodeName types.NodeName, lun int32, cachingMode compute.CachingTypes, diskEncryptionSetID string) error {
3434
vm, err := as.getVirtualMachine(nodeName, cacheReadTypeDefault)
3535
if err != nil {
3636
return err
@@ -46,15 +46,17 @@ func (as *availabilitySet) AttachDisk(isManagedDisk bool, diskName, diskURI stri
4646
copy(disks, *vm.StorageProfile.DataDisks)
4747

4848
if isManagedDisk {
49+
managedDisk := &compute.ManagedDiskParameters{ID: &diskURI}
50+
if diskEncryptionSetID != "" {
51+
managedDisk.DiskEncryptionSet = &compute.DiskEncryptionSetParameters{ID: &diskEncryptionSetID}
52+
}
4953
disks = append(disks,
5054
compute.DataDisk{
5155
Name: &diskName,
5256
Lun: &lun,
5357
Caching: cachingMode,
5458
CreateOption: "attach",
55-
ManagedDisk: &compute.ManagedDiskParameters{
56-
ID: &diskURI,
57-
},
59+
ManagedDisk: managedDisk,
5860
})
5961
} else {
6062
disks = append(disks,
@@ -77,7 +79,7 @@ func (as *availabilitySet) AttachDisk(isManagedDisk bool, diskName, diskURI stri
7779
},
7880
},
7981
}
80-
klog.V(2).Infof("azureDisk - update(%s): vm(%s) - attach disk(%s, %s)", nodeResourceGroup, vmName, diskName, diskURI)
82+
klog.V(2).Infof("azureDisk - update(%s): vm(%s) - attach disk(%s, %s) with DiskEncryptionSetID(%s)", nodeResourceGroup, vmName, diskName, diskURI, diskEncryptionSetID)
8183
ctx, cancel := getContextWithCancel()
8284
defer cancel()
8385

‎staging/src/k8s.io/legacy-cloud-providers/azure/azure_controller_standard_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ func TestStandardAttachDisk(t *testing.T) {
5353
setTestVirtualMachines(testCloud, map[string]string{"vm1": "PowerState/Running"}, false)
5454

5555
err := vmSet.AttachDisk(true, "",
56-
"uri", test.nodeName, 0, compute.CachingTypesReadOnly)
56+
"uri", test.nodeName, 0, compute.CachingTypesReadOnly, "")
5757
assert.Equal(t, test.expectedErr, err != nil, "TestCase[%d]: %s", i, test.desc)
5858
}
5959
}

‎staging/src/k8s.io/legacy-cloud-providers/azure/azure_controller_vmss.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ import (
3030

3131
// AttachDisk attaches a vhd to vm
3232
// the vhd must exist, can be identified by diskName, diskURI, and lun.
33-
func (ss *scaleSet) AttachDisk(isManagedDisk bool, diskName, diskURI string, nodeName types.NodeName, lun int32, cachingMode compute.CachingTypes) error {
33+
func (ss *scaleSet) AttachDisk(isManagedDisk bool, diskName, diskURI string, nodeName types.NodeName, lun int32, cachingMode compute.CachingTypes, diskEncryptionSetID string) error {
3434
vmName := mapNodeNameToVMName(nodeName)
3535
ssName, instanceID, vm, err := ss.getVmssVM(vmName, cacheReadTypeDefault)
3636
if err != nil {
@@ -48,15 +48,17 @@ func (ss *scaleSet) AttachDisk(isManagedDisk bool, diskName, diskURI string, nod
4848
copy(disks, *vm.StorageProfile.DataDisks)
4949
}
5050
if isManagedDisk {
51+
managedDisk := &compute.ManagedDiskParameters{ID: &diskURI}
52+
if diskEncryptionSetID != "" {
53+
managedDisk.DiskEncryptionSet = &compute.DiskEncryptionSetParameters{ID: &diskEncryptionSetID}
54+
}
5155
disks = append(disks,
5256
compute.DataDisk{
5357
Name: &diskName,
5458
Lun: &lun,
5559
Caching: compute.CachingTypes(cachingMode),
5660
CreateOption: "attach",
57-
ManagedDisk: &compute.ManagedDiskParameters{
58-
ID: &diskURI,
59-
},
61+
ManagedDisk: managedDisk,
6062
})
6163
} else {
6264
disks = append(disks,
@@ -90,7 +92,7 @@ func (ss *scaleSet) AttachDisk(isManagedDisk bool, diskName, diskURI string, nod
9092
return err
9193
}
9294

93-
klog.V(2).Infof("azureDisk - update(%s): vm(%s) - attach disk(%s, %s)", nodeResourceGroup, nodeName, diskName, diskURI)
95+
klog.V(2).Infof("azureDisk - update(%s): vm(%s) - attach disk(%s, %s) with DiskEncryptionSetID(%s)", nodeResourceGroup, nodeName, diskName, diskURI, diskEncryptionSetID)
9496
_, err = ss.VirtualMachineScaleSetVMsClient.Update(ctx, nodeResourceGroup, ssName, instanceID, newVM, "attach_disk")
9597
if err != nil {
9698
detail := err.Error()

‎staging/src/k8s.io/legacy-cloud-providers/azure/azure_fakes.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -942,7 +942,7 @@ func (f *fakeVMSet) EnsureBackendPoolDeleted(service *v1.Service, backendPoolID,
942942
return fmt.Errorf("unimplemented")
943943
}
944944

945-
func (f *fakeVMSet) AttachDisk(isManagedDisk bool, diskName, diskURI string, nodeName types.NodeName, lun int32, cachingMode compute.CachingTypes) error {
945+
func (f *fakeVMSet) AttachDisk(isManagedDisk bool, diskName, diskURI string, nodeName types.NodeName, lun int32, cachingMode compute.CachingTypes, diskEncryptionSetID string) error {
946946
return fmt.Errorf("unimplemented")
947947
}
948948

‎staging/src/k8s.io/legacy-cloud-providers/azure/azure_managedDiskController.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ const (
4040
// default IOPS Caps & Throughput Cap (MBps) per https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disks-ultra-ssd
4141
defaultDiskIOPSReadWrite = 500
4242
defaultDiskMBpsReadWrite = 100
43+
44+
diskEncryptionSetIDFormat = "/subscriptions/{subs-id}/resourceGroups/{rg-name}/providers/Microsoft.Compute/diskEncryptionSets/{diskEncryptionSet-name}"
4345
)
4446

4547
//ManagedDiskController : managed disk controller struct
@@ -67,6 +69,8 @@ type ManagedDiskOptions struct {
6769
DiskIOPSReadWrite string
6870
// Throughput Cap (MBps) for UltraSSD disk
6971
DiskMBpsReadWrite string
72+
// ResourceId of the disk encryption set to use for enabling encryption at rest.
73+
DiskEncryptionSetID string
7074
}
7175

7276
//CreateManagedDisk : create managed disk
@@ -129,6 +133,16 @@ func (c *ManagedDiskController) CreateManagedDisk(options *ManagedDiskOptions) (
129133
}
130134
}
131135

136+
if options.DiskEncryptionSetID != "" {
137+
if strings.Index(strings.ToLower(options.DiskEncryptionSetID), "/subscriptions/") != 0 {
138+
return "", fmt.Errorf("AzureDisk - format of DiskEncryptionSetID(%s) is incorrect, correct format: %s", options.DiskEncryptionSetID, diskEncryptionSetIDFormat)
139+
}
140+
diskProperties.Encryption = &compute.Encryption{
141+
DiskEncryptionSetID: &options.DiskEncryptionSetID,
142+
Type: compute.EncryptionAtRestWithCustomerKey,
143+
}
144+
}
145+
132146
model := compute.Disk{
133147
Location: &c.common.location,
134148
Tags: newTags,

‎staging/src/k8s.io/legacy-cloud-providers/azure/azure_vmsets.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ type VMSet interface {
6666
EnsureBackendPoolDeleted(service *v1.Service, backendPoolID, vmSetName string, backendAddressPools *[]network.BackendAddressPool) error
6767

6868
// AttachDisk attaches a vhd to vm. The vhd must exist, can be identified by diskName, diskURI, and lun.
69-
AttachDisk(isManagedDisk bool, diskName, diskURI string, nodeName types.NodeName, lun int32, cachingMode compute.CachingTypes) error
69+
AttachDisk(isManagedDisk bool, diskName, diskURI string, nodeName types.NodeName, lun int32, cachingMode compute.CachingTypes, diskEncryptionSetID string) error
7070
// DetachDisk detaches a vhd from host. The vhd can be identified by diskName or diskURI.
7171
DetachDisk(diskName, diskURI string, nodeName types.NodeName) (*http.Response, error)
7272
// GetDataDisks gets a list of data disks attached to the node.

0 commit comments

Comments
 (0)