feat(encryption): implement AWS KMS integration with encryption provider and update related configurations

2025-05-11 19:41:48 +02:00
parent 3e12b13d95
commit 457f2bd810
17 changed files with 268 additions and 48 deletions
@@ -0,0 +1,13 @@
+[Unit]
+Description=AWS Encryption Provider
+After=network.target
+Before=snap.microk8s.daemon-kubelite.service
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/start-encryption-provider.sh
+Restart=on-failure
+User=root
+
+[Install]
+WantedBy=snap.microk8s.daemon-kubelite.service
@@ -0,0 +1,13 @@
+[Unit]
+Description={{ item.name }} key fetch service
+After={{ fetch_key_service_after }}
+Before={{ fetch_key_service_before }}
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+ExecStart=/usr/local/bin/open_volume "{{ key_server }}" {{ disk_image_path }} {{ device_name }}
+ExecStop=/usr/sbin/cryptsetup close {{ device_name }}
+
+[Install]
+WantedBy={{ fetch_key_service_wantedby }}
@@ -0,0 +1,14 @@
+[Unit]
+Description={{ item.name }} mount service
+After={{ key_fetch_service }}
+Requires={{ key_fetch_service }}
+Before={{ mount_service_before }}
+
+[Mount]
+What=/dev/mapper/{{ device_name }}
+Where={{ mount_point }}
+Type=ext4
+Options=defaults
+
+[Install]
+WantedBy={{ mount_service_wantedby }}
@@ -0,0 +1,6 @@
+#!/bin/bash
+# This script is used to start the encryption provider for the application.
+# Managed by Ansible.
+export AWS_ACCESS_KEY_ID={{ encryption_aws_access_key_id }}
+export AWS_SECRET_ACCESS_KEY={{ encryption_aws_secret_access_key }}
+/usr/local/bin/aws-encryption-provider --key={{ encryption_kms_arn }} --region={{ encryption_kms_region }} --listen={{ encryption_kms_socket }}