package kmsv2

import "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2"

Package kmsv2 transforms values for storage at rest using a Envelope v2 provider

Package kmsv2 transforms values for storage at rest using a Envelope v2 provider

Package kmsv2 transforms values for storage at rest using a Envelope provider

Index ¶

• Constants
• func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, keyIDGetter KeyIDGetterFunc, probeHealthzCheck ProbeHealthzCheckFunc, baseTransformerFunc func(cipher.Block) value.Transformer) value.Transformer
• func NewGRPCService(ctx context.Context, endpoint, providerName string, callTimeout time.Duration) (kmsservice.Service, error)
• type ErrCodeKeyID
• func ValidateKeyID(keyID string) (ErrCodeKeyID, error)
• type KeyIDGetterFunc
• type ProbeHealthzCheckFunc

Constants ¶

const (
	// KMSAPIVersion is the version of the KMS API.
	KMSAPIVersion = "v2alpha1"

	// KeyIDMaxSize is the maximum size of the keyID.
	KeyIDMaxSize = 1 * 1024 // 1 kB

)

Functions ¶

func NewEnvelopeTransformer ¶

func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, keyIDGetter KeyIDGetterFunc, probeHealthzCheck ProbeHealthzCheckFunc, baseTransformerFunc func(cipher.Block) value.Transformer) value.Transformer

NewEnvelopeTransformer returns a transformer which implements a KEK-DEK based envelope encryption scheme. It uses envelopeService to encrypt and decrypt DEKs. Respective DEKs (in encrypted form) are prepended to the data items they encrypt.

func NewGRPCService ¶

func NewGRPCService(ctx context.Context, endpoint, providerName string, callTimeout time.Duration) (kmsservice.Service, error)

NewGRPCService returns an envelope.Service which use gRPC to communicate the remote KMS provider.

Types ¶

type ErrCodeKeyID ¶

type ErrCodeKeyID string

func ValidateKeyID ¶

func ValidateKeyID(keyID string) (ErrCodeKeyID, error)

ValidateKeyID tests the following: 1. The keyID is not empty. 2. The size of keyID is less than 1 kB.

type KeyIDGetterFunc ¶

type KeyIDGetterFunc func(context.Context) (keyID string, err error)

type ProbeHealthzCheckFunc ¶

type ProbeHealthzCheckFunc func(context.Context) (err error)

Source Files ¶

cache.go envelope.go grpc_service.go

Directories ¶