config: add aesgcm to encryption config

Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
openshift · Feb 16, 2023 · 2c92106 · 2c92106
1 parent 11903e0
commit 2c92106
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/config/v1/0000_10_config-operator_01_apiserver.crd.yaml b/config/v1/0000_10_config-operator_01_apiserver.crd.yaml
@@ -101,6 +101,7 @@ spec:
                         - ""
                         - identity
                         - aescbc
+                        - aesgcm
                 servingCerts:
                   description: servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates will be used for serving secure traffic.
                   type: object

diff --git a/config/v1/types_apiserver.go b/config/v1/types_apiserver.go
@@ -184,7 +184,7 @@ type APIServerEncryption struct {
 	Type EncryptionType `json:"type,omitempty"`
 }
 
-// +kubebuilder:validation:Enum="";identity;aescbc
+// +kubebuilder:validation:Enum="";identity;aescbc;aesgcm
 type EncryptionType string
 
 const (
@@ -195,6 +195,10 @@ const (
 	// aescbc refers to a type where AES-CBC with PKCS#7 padding and a 32-byte key
 	// is used to perform encryption at the datastore layer.
 	EncryptionTypeAESCBC EncryptionType = "aescbc"
+
+	// aesgcm refers to a type where AES-GCM with random nonce and a 32-byte key
+	// is used to perform encryption at the datastore layer.
+	EncryptionTypeAESGCM EncryptionType = "aesgcm"
 )
 
 type APIServerStatus struct {