feat(encryption): refactor encryption provider scripts, update KMS integration, and enhance key management

ansible/roles/encryption/tasks/kms.yml

@@ -1,33 +1,16 @@
-- name: Check if required facts are set
-  ansible.builtin.fail:
-    msg: "The following variables are required: encryption_aws_access_key_id, encryption_aws_secret_access_key, encryption_kms_arn"
-  when:
-    - encryption_aws_access_key_id is not defined
-    - encryption_aws_secret_access_key is not defined
-    - encryption_kms_arn is not defined
-
 - name: Copy aws-encryption-provider binary to the host
   become: true
   ansible.builtin.copy:
     src: aws-encryption-provider
     dest: /usr/local/bin/aws-encryption-provider
-    mode: '0755'
-
-- name: Copy start script to the host
-  become: true
-  ansible.builtin.template:
-    src: start-encryption-provider.sh.j2
-    dest: /usr/local/bin/start-encryption-provider.sh
-    mode: '0755'
-    owner: root
-    group: root
+    mode: "0755"
 
 - name: Create KMS socket directory
   become: true
   ansible.builtin.file:
     path: /var/run/kmsplugin
     state: directory
-    mode: '0755'
+    mode: "0755"
     owner: root
     group: root
 
@@ -36,7 +19,7 @@
   ansible.builtin.template:
     src: aws-encryption-provider.service.j2
     dest: /etc/systemd/system/aws-encryption-provider.service
-    mode: '0644'
+    mode: "0644"
 
 - name: Reload systemd daemon
   become: true

ansible/roles/encryption/tasks/main.yml

@@ -28,8 +28,9 @@
     dest: "/usr/local/bin/"
     mode: "0750"
   with_items:
-    - "open_volume"
-    - "read_system_id"
+    - open_volume
+    - read_system_id
+    - start_encryption_provider
   tags:
     - roles::encryption::volume
 
@@ -43,6 +44,5 @@
 
 - name: Create KMS service
   ansible.builtin.include_tasks: kms.yml
-  when: encryption_aws_access_key_id is defined and encryption_aws_secret_access_key is defined and encryption_kms_arn is defined
   tags:
     - roles::encryption::kms