package kmsv2

import "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2"

Package kmsv2 transforms values for storage at rest using a Envelope v2 provider

Package kmsv2 transforms values for storage at rest using a Envelope v2 provider

Package kmsv2 transforms values for storage at rest using a Envelope provider

Index ¶

• Constants
• Variables
• func GenerateTransformer(ctx context.Context, uid string, envelopeService kmsservice.Service) (value.Transformer, *kmsservice.EncryptResponse, []byte, error)
• func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, stateFunc StateFunc) value.Transformer
• func NewGRPCService(ctx context.Context, endpoint, providerName string, callTimeout time.Duration) (kmsservice.Service, error)
• type ErrCodeKeyID
• func ValidateKeyID(keyID string) (ErrCodeKeyID, error)
• type State
• func (s *State) ValidateEncryptCapability() error
• type StateFunc

Constants ¶

const (
	// KMSAPIVersion is the version of the KMS API.
	KMSAPIVersion = "v2beta1"

	// KeyIDMaxSize is the maximum size of the keyID.
	KeyIDMaxSize = 1 * 1024 // 1 kB

)

Variables ¶

var NowFunc = time.Now

NowFunc is exported so tests can override it.

Functions ¶

func GenerateTransformer ¶

func GenerateTransformer(ctx context.Context, uid string, envelopeService kmsservice.Service) (value.Transformer, *kmsservice.EncryptResponse, []byte, error)

func NewEnvelopeTransformer ¶

func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, stateFunc StateFunc) value.Transformer

NewEnvelopeTransformer returns a transformer which implements a KEK-DEK based envelope encryption scheme. It uses envelopeService to encrypt and decrypt DEKs. Respective DEKs (in encrypted form) are prepended to the data items they encrypt.

func NewGRPCService ¶

func NewGRPCService(ctx context.Context, endpoint, providerName string, callTimeout time.Duration) (kmsservice.Service, error)

NewGRPCService returns an envelope.Service which use gRPC to communicate the remote KMS provider.

Types ¶

type ErrCodeKeyID ¶

type ErrCodeKeyID string

func ValidateKeyID ¶

func ValidateKeyID(keyID string) (ErrCodeKeyID, error)

ValidateKeyID tests the following: 1. The keyID is not empty. 2. The size of keyID is less than 1 kB.

type State ¶

type State struct {
	Transformer  value.Transformer
	EncryptedDEK []byte
	KeyID        string
	Annotations  map[string][]byte

	UID string

	ExpirationTimestamp time.Time

	// CacheKey is the key used to cache the DEK in transformer.cache.
	CacheKey []byte
}

func (*State) ValidateEncryptCapability ¶

func (s *State) ValidateEncryptCapability() error

type StateFunc ¶

type StateFunc func() (State, error)

Source Files ¶

cache.go envelope.go grpc_service.go

Directories ¶