KMS v2 Improvements

[ritazh]

Enhancement Description

• One-line enhancement description (can be used as a release note): Introduce KMS v2alpha1 API to add performance, rotation, and observability improvements
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3299-kms-v2-improvements
• Discussion Link:
  • 3299-kms-v2-improvements #3302
  • Sig Auth meetings for 20220608: https://youtu.be/SNnvZVvk5VQ
• Primary contact (assignee): @ritazh @aramase
• Responsible SIGs: sig-auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.25
  • Beta release target (x.y): 1.27
  • Stable release target (x.y): 1.29
• Alpha
  • KEP (k/enhancements) update PR(s):
    • 3299-kms-v2-improvements #3302
  • Code (k/k) update PR(s):
    • Implement KMS v2alpha1 kubernetes#111126
  • Docs (k/website) update PR(s):
    • KMS v2alpha1 website#35046
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-3299: Update kmsv2 kep for beta #3804
  • Code (k/k) update PR(s):
    • kmsv2: implement expire cache with clock  kubernetes#113121
    • [KMSv2] Use status key ID to determine staleness of encrypted data kubernetes#114544
    • kmsv2: add grpc service kubernetes#114678
    • [KMSv2] apiserver/kmsv2: mv Service interface into kmsv2 kubernetes#114922
    • [KMSv2] Generate proto API and update feature gate for beta kubernetes#115123
    • [KMSv2] store hash of encrypted DEK as key in cache kubernetes#115350
    • kmsv2: add metrics kubernetes#115394
    • [KMSv2] Add metrics for grpc service kubernetes#115649
    • [KMSv2] implement local KEK service kubernetes#115677
    • [KMSv2] Add kind cluster and encryption config for e2e kubernetes#115714
    • [KMSv2] Implement local KEK generation and rotation kubernetes#115814
    • kmsv2: add metrics for invalid_key_id_from_status_total kubernetes#115846
    • [KMSv2] restructure kms staging dir kubernetes#115938
    • [KMSv2] update kms_operations_latency_seconds metric bucket range kubernetes#115947
    • [kmsv2] feat: add kms mock plugin for e2e tests kubernetes#116022
    • kmsv2: add mock kms for reference implementation kubernetes#116031
    • [KMSv2] remove setting dek_cache_inter_arrival_time_seconds for KMSv2 only kubernetes#116053
    • [KMSv2] log request metadata as part of read/write kubernetes#116055
    • [KMSv2] update ci script to create cluster and gather metrics kubernetes#116148
    • kmsv2: re-use DEK while key ID is unchanged kubernetes#116155
    • kmsv2: improve test coverage kubernetes#116202
    • [KMSv2] use encDEK, keyID and annotations to generate cache key kubernetes#116345
    • [KMSv2] fix: increases timeout to avoid flake kubernetes#116626
    • [KMSv2] remove key hierarchy in reference implementation kubernetes#116630
  • Docs (k/website) update PR(s):
    • Add docs to accompany KMS v2beta1 changes website#39110

[ritazh]

/sig auth

[ritazh]

/triage accepted

[enj]

/milestone v1.25

[Priyankasaggu11929]

Hello @ritazh 👋, 1.25 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PST on Thursday June 16, 2022.

For note, This enhancement is targeting for stage alpha for 1.25 (correct me, if otherwise)

Here's where this enhancement currently stands: (updated on June 9, 2022)

• KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable
• KEP has a updated detailed test plan section filled out
• KEP has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

Looks like for this one, we would need to update the following in the open KEP PR #3302:

• update the status in the kep.yaml file to implementable
• Update the KEP README.md file add updated detailed test plan section

For note, the status of this enhancement is marked as at risk. Thank you for keeping the issue description up-to-date!

[Priyankasaggu11929]

Hello @ritazh 👋, just a quick check-in again, as we approach the 1.25 enhancements freeze.

Please plan to get the pending items done before enhancements freeze on Thursday, June 23, 2022 at 18:00 PM PT.

For note, the current status of the enhancement is atat-risk. Thank you!

[Priyankasaggu11929]

With KEP PR #3302 merged, the enhancement is ready for 1.25 enhancements freeze.

For note, the status is now marked as tracked in the enhancements tracking sheet. Thank you!

[didicodes]

Hello @ritazh 👋, 1.25 Release Docs Shadow here.

This enhancement is marked as ‘Needs Docs’ for the 1.25 release. Please follow the steps detailed in the documentation to open a PR against the dev-1.25 branch in the k/website repo. This PR can be just a placeholder at this time and must be created by August 4.


Also, take a look at Documenting for a release to familiarize yourself with the docs requirement for the release. Thank you!