feat(encryption): implement AWS KMS integration with encryption provider and update related configurations

2025-05-11 19:41:48 +02:00
parent 3e12b13d95
commit 457f2bd810
17 changed files with 268 additions and 48 deletions
@@ -39,3 +39,4 @@ microk8s_iac_user: "provision"

 microk8s_encryption_secret: "a13labs"
 microk8s_encryption_cfg: "/etc/microk8s_encryption.yaml"
+microk8s_encryption_kms_socket:
@@ -7,21 +7,8 @@

 - name: Create encryption configuration
  become: true
-  ansible.builtin.copy:
-    content: |
-      ---
-      apiVersion: apiserver.config.k8s.io/v1
-      kind: EncryptionConfiguration
-      resources:
-        - resources:
-          - secrets
-          - configmaps
-          providers:
-          - aescbc:
-              keys:
-              - name: k8s-crypto
-                secret: {{ microk8s_encryption_secret }}
-          - identity: {}
+  ansible.builtin.template:
+    src: encryption-provider-config.yml.j2
    dest: "{{ microk8s_encryption_cfg }}"
    mode: "0600"

@@ -0,0 +1,20 @@
+---
+apiVersion: apiserver.config.k8s.io/v1
+kind: EncryptionConfiguration
+resources:
+  - resources:
+    - secrets
+    - configmaps
+    providers:
+{% if microk8s_encryption_kms_socket is defined %}
+    - kms:
+        apiVersion: v2
+        name: aws-encryption-provider
+        endpoint: unix://{{ microk8s_encryption_kms_socket }}
+        timeout: 3s
+{% endif %}
+    - aescbc:
+        keys:
+        - name: k8s-crypto
+          secret: {{ microk8s_encryption_secret }}
+    - identity: {}