feat(encryption): implement AWS KMS integration with encryption provider and update related configurations

2025-05-11 19:41:48 +02:00
parent 3e12b13d95
commit 457f2bd810
17 changed files with 268 additions and 48 deletions
@@ -2,3 +2,9 @@
 encryption_volumes: []
 encryption_volumes_path: /var/lib/encrypted_volumes
 encryption_volumes_default_size: 1G
+
+encryption_aws_access_key_id:
+encryption_aws_secret_access_key:
+encryption_kms_arn:
+encryption_kms_region: eu-west-1
+encryption_kms_socket: /var/run/kmsplugin/socket.sock
@@ -0,0 +1,57 @@
+- name: Check if required facts are set
+  ansible.builtin.fail:
+    msg: "The following variables are required: encryption_aws_access_key_id, encryption_aws_secret_access_key, encryption_kms_arn"
+  when:
+    - encryption_aws_access_key_id is not defined
+    - encryption_aws_secret_access_key is not defined
+    - encryption_kms_arn is not defined
+
+- name: Copy aws-encryption-provider binary to the host
+  become: true
+  ansible.builtin.copy:
+    src: aws-encryption-provider
+    dest: /usr/local/bin/aws-encryption-provider
+    mode: '0755'
+
+- name: Copy start script to the host
+  become: true
+  ansible.builtin.template:
+    src: start-encryption-provider.sh.j2
+    dest: /usr/local/bin/start-encryption-provider.sh
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Create KMS socket directory
+  become: true
+  ansible.builtin.file:
+    path: /var/run/kmsplugin
+    state: directory
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Create systemd service file for aws-encryption-provider
+  become: true
+  ansible.builtin.template:
+    src: aws-encryption-provider.service.j2
+    dest: /etc/systemd/system/aws-encryption-provider.service
+    mode: '0644'
+
+- name: Reload systemd daemon
+  become: true
+  ansible.builtin.systemd:
+    daemon_reload: true
+    name: aws-encryption-provider
+
+- name: Enable aws-encryption-provider service
+  become: true
+  ansible.builtin.systemd:
+    name: aws-encryption-provider
+    enabled: true
+
+- name: Start aws-encryption-provider service
+  become: true
+  ansible.builtin.systemd:
+    name: aws-encryption-provider
+    state: started
@@ -5,8 +5,12 @@
    name:
      - cryptsetup
      - curl
+      - libc6
    state: present
  when: ansible_os_family == 'Debian'
+  tags:
+    - roles::encryption::packages
+    - roles::encryption::volume

 - name: Create folder to store volume
  become: true
@@ -14,6 +18,8 @@
    path: "{{ encryption_volumes_path }}"
    state: directory
    mode: "0750"
+  tags:
+    - roles::encryption::volume

 - name: Copy required scripts
  become: true
@@ -24,9 +30,19 @@
  with_items:
    - "open_volume"
    - "read_system_id"
+  tags:
+    - roles::encryption::volume

 - name: Create encrypted volumes
  ansible.builtin.include_tasks: volume.yml
  loop: "{{ encryption_volumes }}"
  loop_control:
    loop_var: item
+  tags:
+    - roles::encryption::volume
+
+- name: Create KMS service
+  ansible.builtin.include_tasks: kms.yml
+  when: encryption_aws_access_key_id is defined and encryption_aws_secret_access_key is defined and encryption_kms_arn is defined
+  tags:
+    - roles::encryption::kms
@@ -89,45 +89,17 @@

 - name: Create service to fetch key file and open LUKS device
  become: true
-  ansible.builtin.copy:
+  ansible.builtin.template:
+    src: key_fetch.service.j2
    dest: /etc/systemd/system/{{ key_fetch_service }}
    mode: "0644"
-    content: |
-      [Unit]
-      Description={{ item.name }} key fetch service
-      After={{ fetch_key_service_after }}
-      Before={{ fetch_key_service_before }}
-
-      [Service]
-      Type=oneshot
-      RemainAfterExit=true
-      ExecStart=/usr/local/bin/open_volume "{{ key_server }}" {{ disk_image_path }} {{ device_name }}
-      ExecStop=/usr/sbin/cryptsetup close {{ device_name }}
-
-      [Install]
-      WantedBy={{ fetch_key_service_wantedby }}

 - name: Create service to mount the local filesystem
  become: true
-  ansible.builtin.copy:
+  ansible.builtin.template:
+    src: mount.service.j2
    dest: /etc/systemd/system/{{ mount_service }}
    mode: "0644"
-    content: |
-      [Unit]
-
-      Description={{ item.name }} mount service
-      After={{ key_fetch_service }}
-      Requires={{ key_fetch_service }}
-      Before={{ mount_service_before }}
-
-      [Mount]
-      What=/dev/mapper/{{ device_name }}
-      Where={{ mount_point }}
-      Type=ext4
-      Options=defaults
-
-      [Install]
-      WantedBy={{ mount_service_wantedby }}

 - name: Reload systemd daemon
  become: true
@@ -0,0 +1,13 @@
+[Unit]
+Description=AWS Encryption Provider
+After=network.target
+Before=snap.microk8s.daemon-kubelite.service
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/start-encryption-provider.sh
+Restart=on-failure
+User=root
+
+[Install]
+WantedBy=snap.microk8s.daemon-kubelite.service
@@ -0,0 +1,13 @@
+[Unit]
+Description={{ item.name }} key fetch service
+After={{ fetch_key_service_after }}
+Before={{ fetch_key_service_before }}
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+ExecStart=/usr/local/bin/open_volume "{{ key_server }}" {{ disk_image_path }} {{ device_name }}
+ExecStop=/usr/sbin/cryptsetup close {{ device_name }}
+
+[Install]
+WantedBy={{ fetch_key_service_wantedby }}
@@ -0,0 +1,14 @@
+[Unit]
+Description={{ item.name }} mount service
+After={{ key_fetch_service }}
+Requires={{ key_fetch_service }}
+Before={{ mount_service_before }}
+
+[Mount]
+What=/dev/mapper/{{ device_name }}
+Where={{ mount_point }}
+Type=ext4
+Options=defaults
+
+[Install]
+WantedBy={{ mount_service_wantedby }}
@@ -0,0 +1,6 @@
+#!/bin/bash
+# This script is used to start the encryption provider for the application.
+# Managed by Ansible.
+export AWS_ACCESS_KEY_ID={{ encryption_aws_access_key_id }}
+export AWS_SECRET_ACCESS_KEY={{ encryption_aws_secret_access_key }}
+/usr/local/bin/aws-encryption-provider --key={{ encryption_kms_arn }} --region={{ encryption_kms_region }} --listen={{ encryption_kms_socket }}