-
Notifications
You must be signed in to change notification settings - Fork 280
/
etcdencryption.go
96 lines (83 loc) · 2.37 KB
/
etcdencryption.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
package v1alpha1
import (
"net/url"
"time"
"github.com/pkg/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"github.com/aws/eks-anywhere/pkg/utils/ptr"
)
var (
// DefaultKMSCacheSize is the default cache size for KMS provider (1000).
DefaultKMSCacheSize = ptr.Int32(1000)
// DefaultKMSTimeout is the default timeout for KMS provider (3s).
DefaultKMSTimeout = metav1.Duration{Duration: time.Second * 3}
)
// ValidateEtcdEncryptionConfig validates the etcd encryption configuration.
func ValidateEtcdEncryptionConfig(config *[]EtcdEncryption) error {
if config == nil {
return nil
}
if len(*config) == 0 {
return errors.New("etcdEncryption cannot be empty")
}
if len(*config) != 1 {
return errors.New("etcdEncryption config is invalid, only 1 encryption config is supported currently")
}
for i, c := range *config {
if len(c.Providers) == 0 {
return errors.Errorf("etcdEncryption[%d].providers cannot be empty", i)
}
if len(c.Providers) != 1 {
return errors.Errorf("etcdEncryption[%d].providers in invalid, only 1 encryption provider is currently supported", i)
}
for j, p := range c.Providers {
if err := validateKMSConfig(p.KMS); err != nil {
return errors.Errorf("etcdEncryption[%d].providers[%d] is invalid: %v", i, j, err)
}
}
if len(c.Resources) == 0 {
return errors.Errorf("etcdEncryption[%d].resources cannot be empty", i)
}
}
return nil
}
func validateKMSConfig(kms *KMS) error {
if kms == nil {
return errors.New("kms cannot be nil")
}
if len(kms.Name) == 0 {
return errors.New("kms.name cannot be empty")
}
if len(kms.SocketListenAddress) == 0 {
return errors.New("kms.socketListenAddress cannot be empty")
}
u, err := url.Parse(kms.SocketListenAddress)
if err != nil {
return errors.Errorf("kms.socketListenAddress is malformed: %v", err)
}
if u.Scheme != "unix" {
return errors.Errorf("kms.socketListenAddress has unsupported scheme: %v", u.Scheme)
}
return nil
}
func setEtcdEncryptionConfigDefaults(cluster *Cluster) error {
if cluster.Spec.EtcdEncryption == nil {
return nil
}
for _, c := range *cluster.Spec.EtcdEncryption {
for _, p := range c.Providers {
setKMSConfigDefauts(p.KMS)
}
}
return nil
}
func setKMSConfigDefauts(kms *KMS) {
if kms != nil {
if kms.CacheSize == nil {
kms.CacheSize = DefaultKMSCacheSize
}
if kms.Timeout == nil {
kms.Timeout = &DefaultKMSTimeout
}
}
}