feat(k8s): add Kubernetes KMS plugin and operator by p0wline · Pull Request #999 · Cosmian/kms

p0wline · 2026-06-12T09:50:01Z

Scope

This PR introduces two new crates under crate/clients/:

1. `k8s_plugin` — Kubernetes KMS Provider Plugin (v2)

A Unix-domain gRPC server implementing the Kubernetes KMS v2 provider API.
kube-apiserver calls it to encrypt/decrypt Data Encryption Keys (DEKs) stored in etcd.
The plugin delegates all crypto to the Cosmian KMS server.

Key files: src/main.rs, src/service.rs, src/config.rs, proto/v2.proto

2. `k8s_operator` — Kubernetes Operator (CRD controller + mutating admission webhook)

A full Kubernetes operator that:

Defines a KMSSecret CRD — declarative KMS-backed secrets with auto-refresh
Runs a reconciling controller (kube-runtime) that fetches secret bytes from the Cosmian KMS and stores them in Kubernetes Secrets
Runs a mutating admission webhook that rewrites Pod specs to inject an init-container that mounts KMS-fetched secrets into the pod filesystem at startup

This component is security-sensitive: it mutates Pod specs, injects init-containers, and manages long-lived KMS credentials on behalf of workloads.

Key files: src/webhook.rs, src/controller.rs, src/crd.rs, src/config.rs

Security notes

The KMS API token is injected into Pods via valueFrom.secretKeyRef (not as a literal value)
The Unix socket for the KMS plugin is created in a 0700 directory before bind to eliminate the TOCTOU window
The webhook TLS certificate is either loaded from disk or auto-generated (self-signed) at startup

p0wline · 2026-06-16T07:47:04Z

@copilot resolve the merge conflicts in this pull request

Copilot · 2026-06-16T07:48:57Z

@copilot resolve the merge conflicts in this pull request

Done — merged main (5.23.0) into this branch. The merge was clean with no conflicts. Merge commit: b634f5a.

Copilot

Pull request overview

Adds a new Kubernetes KMS v2 provider plugin binary (cosmian-kms-plugin) to let kube-apiserver delegate Encrypt/Decrypt operations to Cosmian KMS (via KMIP), along with documentation, test vectors, and Nix vendor-hash updates.

Changes:

Introduces cosmian_kms_k8s_plugin crate (gRPC service, YAML config, build-time proto generation).
Adds integration docs + MkDocs navigation entry for the Kubernetes plugin.
Adds a KMS test vector runner entry for the plugin flow and updates Nix expected vendor hashes / Cargo.lock.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`nix/expected-hashes/ui.vendor.non-fips.sha256`	Updates UI vendor hash for Nix builds.
`nix/expected-hashes/ui.vendor.fips.sha256`	Updates UI vendor hash for Nix builds.
`nix/expected-hashes/server.vendor.static.sha256`	Updates server vendor hash for Nix builds.
`nix/expected-hashes/cli.vendor.linux.sha256`	Updates CLI vendor hash for Nix builds.
`documentation/mkdocs.yml`	Adds the Kubernetes plugin page to site navigation.
`documentation/docs/integrations/kubernetes_kms_plugin.md`	New integration documentation for the Kubernetes KMS v2 plugin.
`crate/test_kms_server/src/vector_runner.rs`	Registers a new test vector for the plugin wrap/unwrap flow.
`crate/clients/k8s_plugin/src/service.rs`	Implements the KMS v2 gRPC service delegating to `KmsClient` KMIP Encrypt/Decrypt.
`crate/clients/k8s_plugin/src/main.rs`	Adds CLI entrypoint: loads config, binds Unix socket, serves tonic gRPC.
`crate/clients/k8s_plugin/src/kmsv2.proto`	Adds the Kubernetes KMS v2 proto definition (Apache 2.0 source).
`crate/clients/k8s_plugin/src/integration_tests.rs`	New end-to-end test: spins up test KMS + plugin and checks Status/Encrypt/Decrypt.
`crate/clients/k8s_plugin/src/error.rs`	Introduces plugin error type and maps it to `tonic::Status`.
`crate/clients/k8s_plugin/src/config.rs`	Adds YAML config schema + loader for the plugin.
`crate/clients/k8s_plugin/Cargo.toml`	New crate manifest (deps: tonic/prost/protox, serde_yaml, etc.).
`crate/clients/k8s_plugin/build.rs`	Generates tonic bindings from the proto at build time (protox-based).
`Cargo.toml`	Adds the new crate to the workspace members list.
`Cargo.lock`	Locks new dependencies pulled in by the plugin (tonic-build/protox/etc.).

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 12 comments.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 21 comments.

Copilot

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 53 out of 54 changed files in this pull request and generated 3 comments.

- Add cosmian_kms_k8s_plugin: gRPC KMS Provider Plugin v2 for kube-apiserver (etcd encryption at rest via Cosmian KMS) - Add cosmian_kms_k8s_operator: KMSSecret CRD controller + mutating admission webhook (inject KMS secrets into pods as volumes) - Move all module logic to lib.rs targets so tests run under cargo test --lib - Bump cosmian_logger to 0.8.0; replace cosmian_logger with tracing in WASM-compiled crates (cosmian_kmip, cosmian_kms_client_utils) to avoid mio/tokio-net transitive dependency breaking WASM builds - Extract generic restart_resource helper (operator); use chrono for RFC 3339 - Add Kubernetes KMS plugin documentation and mkdocs nav entry - Fix Nix vendor hashes and CI scripts for k8s crates

Copilot

Pull request overview

Copilot reviewed 53 out of 54 changed files in this pull request and generated 3 comments.

UnixListener/UnixListenerStream/UnixStream are not available on Windows. The integration_tests module was compiled as part of the lib test target on all platforms, causing compile errors on Windows CI. Gate it with #[cfg(all(test, unix))] so cargo test --lib --workspace passes on Windows.

…entry tests - k8s_plugin/main.rs: read ca_cert file to string before passing to HttpClientConfig.verified_cert (which expects inline PEM, not a path) - k8s_operator/config.rs: make kms_client_config() fallible (Result<KmsClientConfig, OperatorError>) and read tls_ca_cert file to string for the same reason; update call site in lib.rs with '?' - k8s_operator/lib.rs: add 7 unit tests for parse_uid_entry covering acceptance of a simple filename and rejection of path traversal, absolute paths, subdirectories, empty uid, and missing filename

…tils, pkcs11 Undo the cosmian_logger->tracing migration in all crates except the workspace version bump (Cargo.toml: cosmian_logger = '0.8.0' stays). Reverted files: - crate/kmip/src/** (restore cosmian_logger::{trace,warn,...} macros) - crate/kmip/Cargo.toml (restore original dep declaration) - crate/clients/client_utils/ (restore cosmian_logger dep + macro usage) - crate/clients/pkcs11/provider/src/lib.rs (restore original import path) - Cargo.lock updated accordingly Note: crate/server/Cargo.toml keeps features=[] since 'full' is gone in 0.8.0

Copilot

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 5 comments.

cosmian_logger 0.8.0 exports 'error' as a module, which conflicts with the 'mod error' declaration in the same file (E0255). Import the macro from cosmian_logger::reexport::tracing instead.

- webhook: inject KMS API token via valueFrom.secretKeyRef (not literal value) New config field api_token_secret_ref: Option<SecretKeyRef> in KmsConfig; build_patches emits valueFrom.secretKeyRef instead of a plaintext value. - webhook: add 8 unit tests for build_patches covering: no/existing volumes, no/existing initContainers, multi-container volumeMounts, token secretKeyRef, no-token path, custom secrets dir. - operator/Cargo.toml: use ring crypto backend for rcgen (drop aws-lc default). - k8s_plugin/main.rs: set parent socket directory to 0700 before bind to close TOCTOU window between UnixListener::bind and subsequent 0o600 chmod.

p0wline force-pushed the feat/k8s-kms-plugin branch 2 times, most recently from c5e3675 to 2317356 Compare June 15, 2026 13:03

Copilot started work on behalf of p0wline June 16, 2026 07:47 View session

Copilot finished work on behalf of p0wline June 16, 2026 07:49

p0wline force-pushed the feat/k8s-kms-plugin branch 2 times, most recently from 10eef1b to dc6f4ba Compare June 16, 2026 08:59

p0wline requested a review from Manuthor June 16, 2026 12:03

Copilot started work on behalf of p0wline June 16, 2026 12:41 View session

Copilot finished work on behalf of p0wline June 16, 2026 12:42

Cosmian deleted a comment from Copilot AI Jun 16, 2026

p0wline closed this Jun 16, 2026

Cosmian deleted a comment from Copilot AI Jun 16, 2026

p0wline reopened this Jun 16, 2026

p0wline requested a review from Copilot June 16, 2026 13:11

Copilot started reviewing on behalf of p0wline June 16, 2026 13:11 View session

Copilot AI reviewed Jun 16, 2026

View reviewed changes

p0wline force-pushed the feat/k8s-kms-plugin branch from 2bbd24f to 10119df Compare June 19, 2026 08:21

p0wline requested a review from Copilot June 19, 2026 08:22

Copilot started reviewing on behalf of p0wline June 19, 2026 08:22 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

p0wline mentioned this pull request Jun 23, 2026

feat(logger): add init_tracing() for Kubernetes OTLP deployments (v0.8.0) Cosmian/http_client_server#21

Merged

p0wline requested a review from Copilot June 23, 2026 14:26

Copilot started reviewing on behalf of p0wline June 23, 2026 14:26 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

p0wline requested a review from Copilot June 25, 2026 08:42

Copilot started reviewing on behalf of p0wline June 25, 2026 08:43 View session

Copilot AI reviewed Jun 25, 2026

View reviewed changes

p0wline requested a review from Copilot June 25, 2026 13:54

Copilot started reviewing on behalf of p0wline June 25, 2026 13:55 View session

Copilot AI reviewed Jun 25, 2026

View reviewed changes

Comment thread crate/clients/k8s_plugin/src/lib.rs Outdated

Comment thread crate/clients/k8s_operator/src/lib.rs Outdated

Comment thread crate/clients/k8s_operator/src/webhook.rs Outdated

p0wline force-pushed the feat/k8s-kms-plugin branch from f8543b9 to c89a0cf Compare June 25, 2026 15:16

p0wline requested a review from Copilot June 26, 2026 05:41

Copilot started reviewing on behalf of p0wline June 26, 2026 05:42 View session

Copilot AI reviewed Jun 26, 2026

View reviewed changes

Comment thread crate/clients/k8s_plugin/src/main.rs Outdated

Comment thread crate/clients/k8s_operator/src/config.rs Outdated

Comment thread crate/clients/k8s_operator/src/lib.rs

p0wline added 3 commits June 26, 2026 08:38

p0wline requested a review from Copilot June 26, 2026 12:20

Copilot started reviewing on behalf of p0wline June 26, 2026 12:21 View session

Copilot AI reviewed Jun 26, 2026

View reviewed changes

Comment thread Cargo.toml

Comment thread crate/clients/k8s_operator/src/webhook.rs Outdated

Comment thread crate/clients/k8s_operator/Cargo.toml

Comment thread crate/clients/k8s_operator/src/webhook.rs

Comment thread crate/clients/k8s_plugin/src/main.rs

fix(pkcs11): import tracing::error macro via reexport path

b102fa4

cosmian_logger 0.8.0 exports 'error' as a module, which conflicts with the 'mod error' declaration in the same file (E0255). Import the macro from cosmian_logger::reexport::tracing instead.

p0wline changed the title ~~Feat/k8s kms plugin~~ feat(k8s): add Kubernetes KMS plugin and operator Jun 26, 2026

Uh oh!

Conversation

p0wline commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scope

1. k8s_plugin — Kubernetes KMS Provider Plugin (v2)

2. k8s_operator — Kubernetes Operator (CRD controller + mutating admission webhook)

Security notes

Uh oh!

p0wline commented Jun 16, 2026

Uh oh!

Copilot AI commented Jun 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

p0wline commented Jun 12, 2026 •

edited

Loading

1. `k8s_plugin` — Kubernetes KMS Provider Plugin (v2)

2. `k8s_operator` — Kubernetes Operator (CRD controller + mutating admission webhook)