Skip to content

CNTRLPLANE-3237: operator/encryption: add FlatEntry and FormatKMSSecretDataKey helpers for secret data keys #2269

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jun 3, 2026
+28 −6
Merged

CNTRLPLANE-3237: operator/encryption: add FlatEntry and FormatKMSSecretDataKey helpers for secret data keys #2269

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions pkg/operator/encryption/encryptiondata/secret.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ func FromSecret(encryptionConfigSecret *corev1.Secret) (*Config, error) {
// which is then split on "_" to recover secretName and dataKey.
var kmsPluginsSecretData KMSPluginsSecretData
for key, value := range encryptionConfigSecret.Data {
keyID, rawKey, found, err := parseSecretDataKey(key)
keyID, rawKey, found, err := parseKMSSecretDataKey(key)
if err != nil {
return nil, fmt.Errorf("failed to parse secret data key %s: %w", key, err)
}
Expand Down Expand Up @@ -151,8 +151,8 @@ func ToSecret(ns, name string, secretData *Config) (*corev1.Secret, error) {
// Each entry from FlatEntries() (e.g. "app-role_role-id") is combined with the keyID
// (e.g. "1") to produce "kms-plugin-secret-app-role_role-id-1".
for keyID, flatEntries := range secretData.KMSPluginsSecretData.FlatEntriesByKeyID() {
for flatKey, value := range flatEntries {
s.Data[encryptionConfigSecretDataPrefix+flatKey+"-"+keyID] = value
for rawKey, value := range flatEntries {
s.Data[FormatKMSSecretDataKey(rawKey, keyID)] = value
}
}

Expand Down Expand Up @@ -202,7 +202,19 @@ func ExtractUniqueAndSortedKMSConfigurations(secretData *Config) ([]*apiserverco
return result, nil
}

func parseSecretDataKey(dataKey string) (keyID, rawKey string, found bool, err error) {
// FormatKMSSecretDataKey returns the data key used in the encryption-config Secret
// for a KMS plugin secret entry: "kms-plugin-secret-{rawKey}-{keyID}",
// where rawKey is the combined "secretName_dataKey" from KMSSecretData.FlatEntry.
//
// Note:
//
// It does not validate inputs. The callers are expected to use KMSSecretData.Set,
// which rejects empty values and underscores in secretName.
func FormatKMSSecretDataKey(rawKey, keyID string) string {
return fmt.Sprintf("%s%s-%s", encryptionConfigSecretDataPrefix, rawKey, keyID)
}

func parseKMSSecretDataKey(dataKey string) (keyID, rawKey string, found bool, err error) {
rest, found := strings.CutPrefix(dataKey, encryptionConfigSecretDataPrefix)
if !found {
return "", "", false, nil
Expand Down
2 changes: 1 addition & 1 deletion pkg/operator/encryption/encryptiondata/secret_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,7 +421,7 @@ func TestParseSecretDataKey(t *testing.T) {

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
keyID, rawKey, found, err := parseSecretDataKey(tt.dataKey)
keyID, rawKey, found, err := parseKMSSecretDataKey(tt.dataKey)
if tt.wantErr {
if err == nil {
t.Fatal("expected error, got nil")
Expand Down
12 changes: 11 additions & 1 deletion pkg/operator/encryption/state/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,16 @@ func (d *KMSSecretData) SetFromRawKey(rawKey string, value []byte) error {
return d.Set(parts[0], parts[1], value)
}

// FlatEntry returns the combined key "secretName_dataKey" used in flat representations.
//
// Note:
//
// It does not validate inputs. The callers are expected to use Set,
// which rejects empty values and underscores in secretName.
func (d *KMSSecretData) FlatEntry(secretName, dataKey string) string {
Copy link
Copy Markdown
Member

@ardaguclu ardaguclu Jun 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a particular reason to locate it under KMSSecretData? or just to follow the convention of FlatEntries?

Copy link
Copy Markdown
Contributor Author

@p0lyn0mial p0lyn0mial Jun 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It belongs to KMSSecretData semantically.

It's the encoding convention that Set, SetFromRawKey, and FlatEntries all revolve around.
Keeping it on the type makes it discoverable alongside those methods.

Does it make sense ?

return secretName + secretDataKeySeparator + dataKey
}

// FlatEntries returns the stored data as a flat map keyed by "secretName_dataKey".
// "_" separates secretName from dataKey because "_" is forbidden in
// Kubernetes secret names, making the split unambiguous.
Expand All @@ -136,7 +146,7 @@ func (d *KMSSecretData) FlatEntries() map[string][]byte {
result := map[string][]byte{}
for secretName, keys := range d.entries {
for dataKey, value := range keys {
result[secretName+secretDataKeySeparator+dataKey] = value
result[d.FlatEntry(secretName, dataKey)] = value
}
}
return result
Expand Down