feat: kubesphere 4.0 (#6115)
* feat: kubesphere 4.0 Signed-off-by: ci-bot <ci-bot@kubesphere.io> * feat: kubesphere 4.0 Signed-off-by: ci-bot <ci-bot@kubesphere.io> --------- Signed-off-by: ci-bot <ci-bot@kubesphere.io> Co-authored-by: ks-ci-bot <ks-ci-bot@example.com> Co-authored-by: joyceliu <joyceliu@yunify.com>
This commit is contained in:
KubeSphere CI Bot
committed by
GitHub
GitHub
parent
b5015ec7b9
commit
447a51f08b
48
vendor/k8s.io/kms/apis/v1beta1/api.pb.go
generated
vendored
48
vendor/k8s.io/kms/apis/v1beta1/api.pb.go
generated
vendored
@@ -15,7 +15,7 @@ limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: api.proto
|
||||
// api.proto is a deprecated file.
|
||||
|
||||
package v1beta1
|
||||
|
||||
@@ -40,6 +40,7 @@ var _ = math.Inf
|
||||
// proto package needs to be updated.
|
||||
const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
type VersionRequest struct {
|
||||
// Version of the KMS plugin API.
|
||||
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
|
||||
@@ -79,6 +80,7 @@ func (m *VersionRequest) GetVersion() string {
|
||||
return ""
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
type VersionResponse struct {
|
||||
// Version of the KMS plugin API.
|
||||
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
|
||||
@@ -136,6 +138,7 @@ func (m *VersionResponse) GetRuntimeVersion() string {
|
||||
return ""
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
type DecryptRequest struct {
|
||||
// Version of the KMS plugin API.
|
||||
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
|
||||
@@ -184,6 +187,7 @@ func (m *DecryptRequest) GetCipher() []byte {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
type DecryptResponse struct {
|
||||
// The decrypted data.
|
||||
Plain []byte `protobuf:"bytes,1,opt,name=plain,proto3" json:"plain,omitempty"`
|
||||
@@ -223,6 +227,7 @@ func (m *DecryptResponse) GetPlain() []byte {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
type EncryptRequest struct {
|
||||
// Version of the KMS plugin API.
|
||||
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
|
||||
@@ -271,6 +276,7 @@ func (m *EncryptRequest) GetPlain() []byte {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
type EncryptResponse struct {
|
||||
// The encrypted data.
|
||||
Cipher []byte `protobuf:"bytes,1,opt,name=cipher,proto3" json:"cipher,omitempty"`
|
||||
@@ -322,25 +328,27 @@ func init() {
|
||||
func init() { proto.RegisterFile("api.proto", fileDescriptor_00212fb1f9d3bf1c) }
|
||||
|
||||
var fileDescriptor_00212fb1f9d3bf1c = []byte{
|
||||
// 286 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x52, 0x4f, 0x4b, 0xc3, 0x30,
|
||||
0x14, 0x5f, 0x27, 0xae, 0xec, 0x59, 0x5a, 0x08, 0x43, 0x8b, 0x27, 0xcd, 0x65, 0xea, 0xa1, 0x30,
|
||||
0xbd, 0x8b, 0x88, 0x9e, 0x44, 0x0f, 0x15, 0xbc, 0x4a, 0x56, 0x1e, 0x1a, 0xb0, 0x69, 0x4c, 0xb3,
|
||||
0xca, 0xbe, 0xa8, 0x9f, 0x47, 0x6c, 0x5e, 0x6b, 0x3a, 0x11, 0x77, 0x7c, 0x2f, 0xef, 0xf7, 0xef,
|
||||
0xbd, 0xc0, 0x54, 0x68, 0x99, 0x69, 0x53, 0xd9, 0x8a, 0x85, 0xcd, 0x62, 0x89, 0x56, 0x2c, 0xf8,
|
||||
0x19, 0xc4, 0x4f, 0x68, 0x6a, 0x59, 0xa9, 0x1c, 0xdf, 0x57, 0x58, 0x5b, 0x96, 0x42, 0xd8, 0xb8,
|
||||
0x4e, 0x1a, 0x1c, 0x05, 0x27, 0xd3, 0xbc, 0x2b, 0xf9, 0x07, 0x24, 0xfd, 0x6c, 0xad, 0x2b, 0x55,
|
||||
0xe3, 0xdf, 0xc3, 0xec, 0x18, 0x22, 0xb3, 0x52, 0x56, 0x96, 0xf8, 0xac, 0x44, 0x89, 0xe9, 0xb8,
|
||||
0x7d, 0xde, 0xa3, 0xde, 0x83, 0x28, 0x91, 0xcd, 0x21, 0xe9, 0x46, 0x3a, 0x92, 0x9d, 0x76, 0x2a,
|
||||
0xa6, 0x36, 0xa9, 0xf1, 0x6b, 0x88, 0x6f, 0xb0, 0x30, 0x6b, 0x6d, 0xff, 0x35, 0xc9, 0xf6, 0x61,
|
||||
0x52, 0x48, 0xfd, 0x8a, 0xa6, 0x55, 0x8c, 0x72, 0xaa, 0xf8, 0x1c, 0x92, 0x9e, 0x83, 0xcc, 0xcf,
|
||||
0x60, 0x57, 0xbf, 0x09, 0xe9, 0x28, 0xa2, 0xdc, 0x15, 0xfc, 0x0a, 0xe2, 0x5b, 0xb5, 0xa5, 0x58,
|
||||
0xcf, 0x30, 0xf6, 0x19, 0x4e, 0x21, 0xe9, 0x19, 0x48, 0xea, 0xc7, 0x55, 0xe0, 0xbb, 0x3a, 0xff,
|
||||
0x0c, 0x60, 0x76, 0x87, 0xeb, 0x7b, 0xa1, 0xc4, 0x0b, 0x96, 0xa8, 0xec, 0x23, 0x9a, 0x46, 0x16,
|
||||
0xc8, 0x2e, 0x21, 0xa4, 0xf4, 0xec, 0x20, 0xa3, 0x63, 0x65, 0xc3, 0x4b, 0x1d, 0xa6, 0xbf, 0x1f,
|
||||
0x9c, 0x1c, 0x1f, 0x7d, 0xe3, 0x29, 0xae, 0x87, 0x1f, 0x2e, 0xd1, 0xc3, 0x6f, 0x6c, 0xc6, 0xe1,
|
||||
0x29, 0x83, 0x87, 0x1f, 0xee, 0xc5, 0xc3, 0x6f, 0xc4, 0xe5, 0xa3, 0xe5, 0xa4, 0xfd, 0x67, 0x17,
|
||||
0x5f, 0x01, 0x00, 0x00, 0xff, 0xff, 0x57, 0xc8, 0x65, 0x5a, 0x74, 0x02, 0x00, 0x00,
|
||||
// 314 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x52, 0xcf, 0x4a, 0xf3, 0x40,
|
||||
0x10, 0xef, 0xf6, 0xe3, 0x6b, 0xe9, 0x58, 0x12, 0x58, 0x8a, 0x0d, 0xe2, 0x41, 0xf7, 0x52, 0xf5,
|
||||
0x90, 0x52, 0xbd, 0x78, 0x12, 0x29, 0x7a, 0x12, 0x3d, 0x44, 0xf0, 0xe0, 0x45, 0xb6, 0x61, 0xd0,
|
||||
0xa5, 0x66, 0xb3, 0xee, 0x6e, 0x23, 0x7d, 0x33, 0x9f, 0xc4, 0xe7, 0x11, 0x93, 0x4d, 0xdc, 0x54,
|
||||
0x44, 0x8f, 0x33, 0xfb, 0xfb, 0x33, 0xbf, 0x99, 0x85, 0x01, 0x57, 0x22, 0x56, 0x3a, 0xb7, 0x39,
|
||||
0xed, 0x17, 0xb3, 0x05, 0x5a, 0x3e, 0x63, 0x47, 0x10, 0xdc, 0xa1, 0x36, 0x22, 0x97, 0x09, 0xbe,
|
||||
0xac, 0xd0, 0x58, 0x1a, 0x41, 0xbf, 0xa8, 0x3a, 0x11, 0xd9, 0x23, 0x07, 0x83, 0xa4, 0x2e, 0xd9,
|
||||
0x2b, 0x84, 0x0d, 0xd6, 0xa8, 0x5c, 0x1a, 0xfc, 0x19, 0x4c, 0xf7, 0x61, 0xa8, 0x57, 0xd2, 0x8a,
|
||||
0x0c, 0x1f, 0x24, 0xcf, 0x30, 0xea, 0x96, 0xcf, 0x5b, 0xae, 0x77, 0xc3, 0x33, 0xa4, 0x13, 0x08,
|
||||
0x6b, 0x48, 0x2d, 0xf2, 0xaf, 0x44, 0x05, 0xae, 0xed, 0xdc, 0xd8, 0x1c, 0x82, 0x0b, 0x4c, 0xf5,
|
||||
0x5a, 0xd9, 0x5f, 0x87, 0xa4, 0xdb, 0xd0, 0x4b, 0x85, 0x7a, 0x42, 0x5d, 0x3a, 0x0e, 0x13, 0x57,
|
||||
0xb1, 0x09, 0x84, 0x8d, 0x86, 0x1b, 0x7e, 0x04, 0xff, 0xd5, 0x33, 0x17, 0x95, 0xc4, 0x30, 0xa9,
|
||||
0x0a, 0x76, 0x0e, 0xc1, 0xa5, 0xfc, 0xa3, 0x59, 0xa3, 0xd0, 0xf5, 0x15, 0x0e, 0x21, 0x6c, 0x14,
|
||||
0x9c, 0xd5, 0xd7, 0x54, 0xc4, 0x9f, 0xea, 0xf8, 0x9d, 0xc0, 0xe8, 0x0a, 0xd7, 0xd7, 0x5c, 0xf2,
|
||||
0x47, 0xcc, 0x50, 0xda, 0x5b, 0xd4, 0x85, 0x48, 0x91, 0x9e, 0x41, 0xdf, 0xa5, 0xa7, 0xe3, 0xd8,
|
||||
0x1d, 0x2b, 0x6e, 0x5f, 0x6a, 0x27, 0xfa, 0xfe, 0x50, 0xd9, 0xb1, 0xce, 0x27, 0xdf, 0xc5, 0xf5,
|
||||
0xf8, 0xed, 0x25, 0x7a, 0xfc, 0x8d, 0xcd, 0x54, 0x7c, 0x97, 0xc1, 0xe3, 0xb7, 0xf7, 0xe2, 0xf1,
|
||||
0x37, 0xe2, 0xb2, 0xce, 0x7c, 0xf7, 0x7e, 0xbc, 0x3c, 0x35, 0xb1, 0xc8, 0xa7, 0xcb, 0xcc, 0x4c,
|
||||
0xb9, 0x12, 0x66, 0xea, 0xc0, 0x6f, 0x84, 0x2c, 0x7a, 0xe5, 0x2f, 0x3c, 0xf9, 0x08, 0x00, 0x00,
|
||||
0xff, 0xff, 0x18, 0x47, 0x93, 0xb2, 0x92, 0x02, 0x00, 0x00,
|
||||
}
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
|
||||
11
vendor/k8s.io/kms/apis/v1beta1/api.proto
generated
vendored
11
vendor/k8s.io/kms/apis/v1beta1/api.proto
generated
vendored
@@ -14,10 +14,12 @@ See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// To regenerate api.pb.go run hack/update-generated-kms.sh
|
||||
// To regenerate api.pb.go run `hack/update-codegen.sh protobindings`
|
||||
syntax = "proto3";
|
||||
|
||||
package v1beta1;
|
||||
option go_package = "k8s.io/kms/apis/v1beta1";
|
||||
option deprecated = true;
|
||||
|
||||
// This service defines the public APIs for remote KMS provider.
|
||||
service KeyManagementService {
|
||||
@@ -30,11 +32,13 @@ service KeyManagementService {
|
||||
rpc Encrypt(EncryptRequest) returns (EncryptResponse) {}
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
message VersionRequest {
|
||||
// Version of the KMS plugin API.
|
||||
string version = 1;
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
message VersionResponse {
|
||||
// Version of the KMS plugin API.
|
||||
string version = 1;
|
||||
@@ -44,6 +48,7 @@ message VersionResponse {
|
||||
string runtime_version = 3;
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
message DecryptRequest {
|
||||
// Version of the KMS plugin API.
|
||||
string version = 1;
|
||||
@@ -51,11 +56,13 @@ message DecryptRequest {
|
||||
bytes cipher = 2;
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
message DecryptResponse {
|
||||
// The decrypted data.
|
||||
bytes plain = 1;
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
message EncryptRequest {
|
||||
// Version of the KMS plugin API.
|
||||
string version = 1;
|
||||
@@ -63,8 +70,8 @@ message EncryptRequest {
|
||||
bytes plain = 2;
|
||||
}
|
||||
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
message EncryptResponse {
|
||||
// The encrypted data.
|
||||
bytes cipher = 1;
|
||||
}
|
||||
|
||||
|
||||
1
vendor/k8s.io/kms/apis/v1beta1/v1beta1.go
generated
vendored
1
vendor/k8s.io/kms/apis/v1beta1/v1beta1.go
generated
vendored
@@ -15,6 +15,7 @@ limitations under the License.
|
||||
*/
|
||||
|
||||
// Package v1beta1 contains definition of kms-plugin's gRPC service.
|
||||
// Deprecated: KMSv1 is deprecated in v1.28 and will only receive security updates going forward. Use KMSv2 instead.
|
||||
package v1beta1
|
||||
|
||||
// IsVersionCheckMethod determines whether the supplied method is a version check against kms-plugin.
|
||||
|
||||
100
vendor/k8s.io/kms/apis/v2alpha1/api.pb.go → vendor/k8s.io/kms/apis/v2/api.pb.go
generated
vendored
100
vendor/k8s.io/kms/apis/v2alpha1/api.pb.go → vendor/k8s.io/kms/apis/v2/api.pb.go
generated
vendored
@@ -17,7 +17,7 @@ limitations under the License.
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: api.proto
|
||||
|
||||
package v2alpha1
|
||||
package v2
|
||||
|
||||
import (
|
||||
context "context"
|
||||
@@ -71,11 +71,14 @@ func (m *StatusRequest) XXX_DiscardUnknown() {
|
||||
var xxx_messageInfo_StatusRequest proto.InternalMessageInfo
|
||||
|
||||
type StatusResponse struct {
|
||||
// Version of the KMS plugin API. Must match the configured .resources[].providers[].kms.apiVersion
|
||||
// Version of the KMS gRPC plugin API. Must equal v2 to v2beta1 (v2 is recommended, but both are equivalent).
|
||||
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
|
||||
// Any value other than "ok" is failing healthz. On failure, the associated API server healthz endpoint will contain this value as part of the error message.
|
||||
Healthz string `protobuf:"bytes,2,opt,name=healthz,proto3" json:"healthz,omitempty"`
|
||||
// the current write key, used to determine staleness of data updated via value.Transformer.TransformFromStorage.
|
||||
// keyID must satisfy the following constraints:
|
||||
// 1. The keyID is not empty.
|
||||
// 2. The size of keyID is less than 1 kB.
|
||||
KeyId string `protobuf:"bytes,3,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
@@ -283,13 +286,21 @@ func (m *EncryptRequest) GetUid() string {
|
||||
|
||||
type EncryptResponse struct {
|
||||
// The encrypted data.
|
||||
// ciphertext must satisfy the following constraints:
|
||||
// 1. The ciphertext is not empty.
|
||||
// 2. The ciphertext is less than 1 kB.
|
||||
Ciphertext []byte `protobuf:"bytes,1,opt,name=ciphertext,proto3" json:"ciphertext,omitempty"`
|
||||
// The KMS key ID used to encrypt the data. This must always refer to the KMS KEK and not any local KEKs that may be in use.
|
||||
// This can be used to inform staleness of data updated via value.Transformer.TransformFromStorage.
|
||||
// keyID must satisfy the following constraints:
|
||||
// 1. The keyID is not empty.
|
||||
// 2. The size of keyID is less than 1 kB.
|
||||
KeyId string `protobuf:"bytes,2,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
|
||||
// Additional metadata to be stored with the encrypted data.
|
||||
// This metadata can contain the encrypted local KEK that was used to encrypt the DEK.
|
||||
// This data is stored in plaintext in etcd. KMS plugin implementations are responsible for pre-encrypting any sensitive data.
|
||||
// Annotations must satisfy the following constraints:
|
||||
// 1. Annotation key must be a fully qualified domain name that conforms to the definition in DNS (RFC 1123).
|
||||
// 2. The size of annotations keys + values is less than 32 kB.
|
||||
Annotations map[string][]byte `protobuf:"bytes,3,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
@@ -342,45 +353,46 @@ func (m *EncryptResponse) GetAnnotations() map[string][]byte {
|
||||
}
|
||||
|
||||
func init() {
|
||||
proto.RegisterType((*StatusRequest)(nil), "v2alpha1.StatusRequest")
|
||||
proto.RegisterType((*StatusResponse)(nil), "v2alpha1.StatusResponse")
|
||||
proto.RegisterType((*DecryptRequest)(nil), "v2alpha1.DecryptRequest")
|
||||
proto.RegisterMapType((map[string][]byte)(nil), "v2alpha1.DecryptRequest.AnnotationsEntry")
|
||||
proto.RegisterType((*DecryptResponse)(nil), "v2alpha1.DecryptResponse")
|
||||
proto.RegisterType((*EncryptRequest)(nil), "v2alpha1.EncryptRequest")
|
||||
proto.RegisterType((*EncryptResponse)(nil), "v2alpha1.EncryptResponse")
|
||||
proto.RegisterMapType((map[string][]byte)(nil), "v2alpha1.EncryptResponse.AnnotationsEntry")
|
||||
proto.RegisterType((*StatusRequest)(nil), "v2.StatusRequest")
|
||||
proto.RegisterType((*StatusResponse)(nil), "v2.StatusResponse")
|
||||
proto.RegisterType((*DecryptRequest)(nil), "v2.DecryptRequest")
|
||||
proto.RegisterMapType((map[string][]byte)(nil), "v2.DecryptRequest.AnnotationsEntry")
|
||||
proto.RegisterType((*DecryptResponse)(nil), "v2.DecryptResponse")
|
||||
proto.RegisterType((*EncryptRequest)(nil), "v2.EncryptRequest")
|
||||
proto.RegisterType((*EncryptResponse)(nil), "v2.EncryptResponse")
|
||||
proto.RegisterMapType((map[string][]byte)(nil), "v2.EncryptResponse.AnnotationsEntry")
|
||||
}
|
||||
|
||||
func init() { proto.RegisterFile("api.proto", fileDescriptor_00212fb1f9d3bf1c) }
|
||||
|
||||
var fileDescriptor_00212fb1f9d3bf1c = []byte{
|
||||
// 391 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x93, 0xcf, 0x4f, 0xe2, 0x40,
|
||||
0x14, 0xc7, 0x29, 0x5d, 0x60, 0x79, 0xb0, 0x40, 0x26, 0x6c, 0xb6, 0x4b, 0x36, 0x1b, 0x32, 0x27,
|
||||
0x76, 0x0f, 0xdd, 0x2c, 0x5e, 0x8c, 0x89, 0x06, 0x13, 0x39, 0x18, 0xf4, 0x52, 0x8e, 0x1e, 0xcc,
|
||||
0x08, 0x2f, 0x76, 0x42, 0x9d, 0xd6, 0x76, 0xda, 0x58, 0xff, 0x50, 0x13, 0xff, 0x01, 0xff, 0x0e,
|
||||
0xd3, 0x76, 0xa0, 0x2d, 0x88, 0x9e, 0xbc, 0xcd, 0xfb, 0xd1, 0xef, 0xf7, 0xcd, 0x67, 0x5e, 0xa1,
|
||||
0xc9, 0x3c, 0x6e, 0x7a, 0xbe, 0x2b, 0x5d, 0xf2, 0x35, 0x1a, 0x33, 0xc7, 0xb3, 0xd9, 0x7f, 0xda,
|
||||
0x85, 0x6f, 0x73, 0xc9, 0x64, 0x18, 0x58, 0x78, 0x1f, 0x62, 0x20, 0xe9, 0x15, 0x74, 0xd6, 0x89,
|
||||
0xc0, 0x73, 0x45, 0x80, 0xc4, 0x80, 0x46, 0x84, 0x7e, 0xc0, 0x5d, 0x61, 0x68, 0x43, 0x6d, 0xd4,
|
||||
0xb4, 0xd6, 0x61, 0x52, 0xb1, 0x91, 0x39, 0xd2, 0x7e, 0x34, 0xaa, 0x59, 0x45, 0x85, 0xe4, 0x3b,
|
||||
0xd4, 0x57, 0x18, 0x5f, 0xf3, 0xa5, 0xa1, 0xa7, 0x85, 0xda, 0x0a, 0xe3, 0xf3, 0x25, 0x7d, 0xd1,
|
||||
0xa0, 0x73, 0x86, 0x0b, 0x3f, 0xf6, 0xa4, 0xf2, 0x23, 0xbf, 0x01, 0x16, 0xdc, 0xb3, 0xd1, 0x97,
|
||||
0xf8, 0x20, 0x53, 0x83, 0xb6, 0x55, 0xc8, 0x90, 0x1e, 0xe8, 0x21, 0x5f, 0x2a, 0xfd, 0xe4, 0xb8,
|
||||
0x47, 0x9b, 0xcc, 0xa0, 0xc5, 0x84, 0x70, 0x25, 0x93, 0xdc, 0x15, 0x81, 0xf1, 0x65, 0xa8, 0x8f,
|
||||
0x5a, 0xe3, 0x3f, 0xe6, 0xfa, 0xa6, 0x66, 0xd9, 0xd7, 0x3c, 0xcd, 0x7b, 0xa7, 0x42, 0xfa, 0xb1,
|
||||
0x55, 0xfc, 0x7a, 0x70, 0x02, 0xbd, 0xed, 0x86, 0x64, 0x92, 0x15, 0xc6, 0x8a, 0x41, 0x72, 0x24,
|
||||
0x7d, 0xa8, 0x45, 0xcc, 0x09, 0x31, 0x9d, 0xae, 0x6d, 0x65, 0xc1, 0x51, 0xf5, 0x50, 0xa3, 0xff,
|
||||
0xa0, 0xbb, 0xf1, 0x53, 0x18, 0x7f, 0x41, 0xd3, 0x73, 0x18, 0x17, 0x85, 0x7b, 0xe6, 0x09, 0x3a,
|
||||
0x81, 0xce, 0x54, 0x94, 0xc0, 0xbc, 0xdb, 0xbf, 0x8b, 0x85, 0x3e, 0x69, 0xd0, 0xdd, 0x48, 0x28,
|
||||
0xcf, 0x8f, 0xe0, 0xe6, 0x28, 0xab, 0x45, 0x94, 0x17, 0x65, 0x94, 0x7a, 0x8a, 0xf2, 0x6f, 0x8e,
|
||||
0x72, 0xcb, 0xe6, 0x73, 0x59, 0x8e, 0x9f, 0x35, 0xe8, 0xcf, 0x30, 0xbe, 0x64, 0x82, 0xdd, 0xe2,
|
||||
0x1d, 0x0a, 0x39, 0x47, 0x3f, 0xe2, 0x0b, 0x24, 0xc7, 0x50, 0xcf, 0x56, 0x95, 0xfc, 0xc8, 0x67,
|
||||
0x2b, 0x6d, 0xf3, 0xc0, 0xd8, 0x2d, 0x64, 0x33, 0xd3, 0x0a, 0x99, 0x40, 0x43, 0xbd, 0x11, 0x31,
|
||||
0xf6, 0xad, 0xc9, 0xe0, 0xe7, 0x1b, 0x95, 0xa2, 0x82, 0x42, 0x51, 0x54, 0x28, 0xbf, 0x63, 0x51,
|
||||
0x61, 0x8b, 0x1b, 0xad, 0xdc, 0xd4, 0xd3, 0xff, 0xf1, 0xe0, 0x35, 0x00, 0x00, 0xff, 0xff, 0xa7,
|
||||
0xdd, 0xa1, 0x79, 0x9c, 0x03, 0x00, 0x00,
|
||||
// 403 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x93, 0xcd, 0x6e, 0xda, 0x40,
|
||||
0x10, 0xc7, 0xb1, 0x5d, 0x40, 0x0c, 0x14, 0xe8, 0x96, 0x4a, 0x16, 0xaa, 0x2a, 0xb4, 0xed, 0x81,
|
||||
0x93, 0xad, 0xba, 0x3d, 0xa0, 0x1e, 0xaa, 0xb6, 0x2a, 0x95, 0xaa, 0xaa, 0x17, 0x73, 0x6b, 0x0f,
|
||||
0xd1, 0x06, 0x46, 0x61, 0x65, 0x58, 0x3b, 0xde, 0xb5, 0x15, 0xe7, 0xbd, 0xf2, 0x1e, 0x79, 0x84,
|
||||
0x3c, 0x4a, 0x64, 0x7b, 0x01, 0x1b, 0x94, 0xe4, 0x94, 0x9b, 0xe7, 0xf3, 0x3f, 0xf3, 0xdb, 0x31,
|
||||
0x74, 0x58, 0xc4, 0x9d, 0x28, 0x0e, 0x55, 0x48, 0xcc, 0xd4, 0xa3, 0x03, 0x78, 0xb9, 0x50, 0x4c,
|
||||
0x25, 0xd2, 0xc7, 0xcb, 0x04, 0xa5, 0xa2, 0xff, 0xa1, 0xbf, 0x73, 0xc8, 0x28, 0x14, 0x12, 0x89,
|
||||
0x0d, 0xed, 0x14, 0x63, 0xc9, 0x43, 0x61, 0x1b, 0x13, 0x63, 0xda, 0xf1, 0x77, 0x66, 0x1e, 0x59,
|
||||
0x23, 0xdb, 0xa8, 0xf5, 0xb5, 0x6d, 0x96, 0x11, 0x6d, 0x92, 0x37, 0xd0, 0x0a, 0x30, 0x3b, 0xe3,
|
||||
0x2b, 0xdb, 0x2a, 0x02, 0xcd, 0x00, 0xb3, 0xdf, 0x2b, 0x7a, 0x67, 0x40, 0xff, 0x27, 0x2e, 0xe3,
|
||||
0x2c, 0x52, 0x5a, 0x8f, 0xbc, 0x03, 0x58, 0xf2, 0x68, 0x8d, 0xb1, 0xc2, 0x2b, 0x55, 0x08, 0xf4,
|
||||
0xfc, 0x8a, 0x87, 0x0c, 0xc1, 0x4a, 0xf8, 0x4a, 0xf7, 0xcf, 0x3f, 0x1f, 0xe8, 0x4d, 0xe6, 0xd0,
|
||||
0x65, 0x42, 0x84, 0x8a, 0x29, 0x1e, 0x0a, 0x69, 0xbf, 0x98, 0x58, 0xd3, 0xae, 0xf7, 0xde, 0x49,
|
||||
0x3d, 0xa7, 0xae, 0xe8, 0x7c, 0x3f, 0x64, 0xcd, 0x85, 0x8a, 0x33, 0xbf, 0x5a, 0x37, 0xfe, 0x0a,
|
||||
0xc3, 0xe3, 0x84, 0x7c, 0x86, 0x00, 0x33, 0xbd, 0x7d, 0xfe, 0x49, 0x46, 0xd0, 0x4c, 0xd9, 0x26,
|
||||
0xc1, 0x62, 0xae, 0x9e, 0x5f, 0x1a, 0x5f, 0xcc, 0x99, 0x41, 0x5d, 0x18, 0xec, 0xf5, 0x34, 0xc0,
|
||||
0xb7, 0xd0, 0x89, 0x36, 0x8c, 0x8b, 0xca, 0x86, 0x07, 0x07, 0xfd, 0x06, 0xfd, 0xb9, 0xa8, 0x21,
|
||||
0x79, 0x34, 0xff, 0x14, 0x08, 0xbd, 0x35, 0x60, 0xb0, 0x6f, 0xa1, 0x35, 0x9f, 0xc2, 0x7a, 0x80,
|
||||
0x68, 0x56, 0x21, 0xfe, 0xaa, 0x43, 0xb4, 0x0a, 0x88, 0x1f, 0x72, 0x88, 0x47, 0x02, 0xcf, 0x4b,
|
||||
0xd1, 0xbb, 0x31, 0x60, 0xf4, 0x07, 0xb3, 0xbf, 0x4c, 0xb0, 0x0b, 0xdc, 0xa2, 0x50, 0x0b, 0x8c,
|
||||
0x53, 0xbe, 0x44, 0xf2, 0x11, 0x5a, 0xe5, 0x79, 0x92, 0x57, 0xf9, 0x54, 0xb5, 0xdb, 0x1d, 0x93,
|
||||
0xaa, 0xab, 0x9c, 0x93, 0x36, 0xc8, 0x67, 0x68, 0xeb, 0x17, 0x21, 0xe4, 0xf4, 0x1c, 0xc6, 0xaf,
|
||||
0x6b, 0xbe, 0x6a, 0x95, 0x5e, 0xb9, 0xac, 0xaa, 0xbf, 0x51, 0x59, 0x75, 0xc4, 0x84, 0x36, 0x7e,
|
||||
0x8c, 0xfe, 0x91, 0x60, 0x26, 0x1d, 0x1e, 0xba, 0xc1, 0x56, 0xba, 0x2c, 0xe2, 0xd2, 0x4d, 0xbd,
|
||||
0xf3, 0x56, 0xf1, 0xbf, 0x7d, 0xba, 0x0f, 0x00, 0x00, 0xff, 0xff, 0x5f, 0xf8, 0x49, 0x17, 0x7c,
|
||||
0x03, 0x00, 0x00,
|
||||
}
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
@@ -413,7 +425,7 @@ func NewKeyManagementServiceClient(cc *grpc.ClientConn) KeyManagementServiceClie
|
||||
|
||||
func (c *keyManagementServiceClient) Status(ctx context.Context, in *StatusRequest, opts ...grpc.CallOption) (*StatusResponse, error) {
|
||||
out := new(StatusResponse)
|
||||
err := c.cc.Invoke(ctx, "/v2alpha1.KeyManagementService/Status", in, out, opts...)
|
||||
err := c.cc.Invoke(ctx, "/v2.KeyManagementService/Status", in, out, opts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -422,7 +434,7 @@ func (c *keyManagementServiceClient) Status(ctx context.Context, in *StatusReque
|
||||
|
||||
func (c *keyManagementServiceClient) Decrypt(ctx context.Context, in *DecryptRequest, opts ...grpc.CallOption) (*DecryptResponse, error) {
|
||||
out := new(DecryptResponse)
|
||||
err := c.cc.Invoke(ctx, "/v2alpha1.KeyManagementService/Decrypt", in, out, opts...)
|
||||
err := c.cc.Invoke(ctx, "/v2.KeyManagementService/Decrypt", in, out, opts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -431,7 +443,7 @@ func (c *keyManagementServiceClient) Decrypt(ctx context.Context, in *DecryptReq
|
||||
|
||||
func (c *keyManagementServiceClient) Encrypt(ctx context.Context, in *EncryptRequest, opts ...grpc.CallOption) (*EncryptResponse, error) {
|
||||
out := new(EncryptResponse)
|
||||
err := c.cc.Invoke(ctx, "/v2alpha1.KeyManagementService/Encrypt", in, out, opts...)
|
||||
err := c.cc.Invoke(ctx, "/v2.KeyManagementService/Encrypt", in, out, opts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -476,7 +488,7 @@ func _KeyManagementService_Status_Handler(srv interface{}, ctx context.Context,
|
||||
}
|
||||
info := &grpc.UnaryServerInfo{
|
||||
Server: srv,
|
||||
FullMethod: "/v2alpha1.KeyManagementService/Status",
|
||||
FullMethod: "/v2.KeyManagementService/Status",
|
||||
}
|
||||
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||
return srv.(KeyManagementServiceServer).Status(ctx, req.(*StatusRequest))
|
||||
@@ -494,7 +506,7 @@ func _KeyManagementService_Decrypt_Handler(srv interface{}, ctx context.Context,
|
||||
}
|
||||
info := &grpc.UnaryServerInfo{
|
||||
Server: srv,
|
||||
FullMethod: "/v2alpha1.KeyManagementService/Decrypt",
|
||||
FullMethod: "/v2.KeyManagementService/Decrypt",
|
||||
}
|
||||
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||
return srv.(KeyManagementServiceServer).Decrypt(ctx, req.(*DecryptRequest))
|
||||
@@ -512,7 +524,7 @@ func _KeyManagementService_Encrypt_Handler(srv interface{}, ctx context.Context,
|
||||
}
|
||||
info := &grpc.UnaryServerInfo{
|
||||
Server: srv,
|
||||
FullMethod: "/v2alpha1.KeyManagementService/Encrypt",
|
||||
FullMethod: "/v2.KeyManagementService/Encrypt",
|
||||
}
|
||||
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||
return srv.(KeyManagementServiceServer).Encrypt(ctx, req.(*EncryptRequest))
|
||||
@@ -521,7 +533,7 @@ func _KeyManagementService_Encrypt_Handler(srv interface{}, ctx context.Context,
|
||||
}
|
||||
|
||||
var _KeyManagementService_serviceDesc = grpc.ServiceDesc{
|
||||
ServiceName: "v2alpha1.KeyManagementService",
|
||||
ServiceName: "v2.KeyManagementService",
|
||||
HandlerType: (*KeyManagementServiceServer)(nil),
|
||||
Methods: []grpc.MethodDesc{
|
||||
{
|
||||
20
vendor/k8s.io/kms/apis/v2alpha1/api.proto → vendor/k8s.io/kms/apis/v2/api.proto
generated
vendored
20
vendor/k8s.io/kms/apis/v2alpha1/api.proto → vendor/k8s.io/kms/apis/v2/api.proto
generated
vendored
@@ -14,10 +14,11 @@ See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// To regenerate api.pb.go run hack/update-generated-kms.sh
|
||||
// To regenerate api.pb.go run `hack/update-codegen.sh protobindings`
|
||||
syntax = "proto3";
|
||||
|
||||
package v2alpha1;
|
||||
package v2;
|
||||
option go_package = "k8s.io/kms/apis/v2";
|
||||
|
||||
// This service defines the public APIs for remote KMS provider.
|
||||
service KeyManagementService {
|
||||
@@ -33,11 +34,14 @@ service KeyManagementService {
|
||||
message StatusRequest {}
|
||||
|
||||
message StatusResponse {
|
||||
// Version of the KMS plugin API. Must match the configured .resources[].providers[].kms.apiVersion
|
||||
// Version of the KMS gRPC plugin API. Must equal v2 to v2beta1 (v2 is recommended, but both are equivalent).
|
||||
string version = 1;
|
||||
// Any value other than "ok" is failing healthz. On failure, the associated API server healthz endpoint will contain this value as part of the error message.
|
||||
string healthz = 2;
|
||||
// the current write key, used to determine staleness of data updated via value.Transformer.TransformFromStorage.
|
||||
// keyID must satisfy the following constraints:
|
||||
// 1. The keyID is not empty.
|
||||
// 2. The size of keyID is less than 1 kB.
|
||||
string key_id = 3;
|
||||
}
|
||||
|
||||
@@ -67,12 +71,20 @@ message EncryptRequest {
|
||||
|
||||
message EncryptResponse {
|
||||
// The encrypted data.
|
||||
// ciphertext must satisfy the following constraints:
|
||||
// 1. The ciphertext is not empty.
|
||||
// 2. The ciphertext is less than 1 kB.
|
||||
bytes ciphertext = 1;
|
||||
// The KMS key ID used to encrypt the data. This must always refer to the KMS KEK and not any local KEKs that may be in use.
|
||||
// This can be used to inform staleness of data updated via value.Transformer.TransformFromStorage.
|
||||
// keyID must satisfy the following constraints:
|
||||
// 1. The keyID is not empty.
|
||||
// 2. The size of keyID is less than 1 kB.
|
||||
string key_id = 2;
|
||||
// Additional metadata to be stored with the encrypted data.
|
||||
// This metadata can contain the encrypted local KEK that was used to encrypt the DEK.
|
||||
// This data is stored in plaintext in etcd. KMS plugin implementations are responsible for pre-encrypting any sensitive data.
|
||||
// Annotations must satisfy the following constraints:
|
||||
// 1. Annotation key must be a fully qualified domain name that conforms to the definition in DNS (RFC 1123).
|
||||
// 2. The size of annotations keys + values is less than 32 kB.
|
||||
map<string, bytes> annotations = 3;
|
||||
}
|
||||
4
vendor/k8s.io/kms/apis/v2alpha1/v2alpha1.go → vendor/k8s.io/kms/apis/v2/v2.go
generated
vendored
4
vendor/k8s.io/kms/apis/v2alpha1/v2alpha1.go → vendor/k8s.io/kms/apis/v2/v2.go
generated
vendored
@@ -14,5 +14,5 @@ See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Package v2alpha1 contains definition of kms-plugin's gRPC service.
|
||||
package v2alpha1
|
||||
// Package v2 contains definition of kms-plugin's gRPC service.
|
||||
package v2
|
||||
131
vendor/k8s.io/kms/pkg/service/grpc_service.go
generated
vendored
Normal file
131
vendor/k8s.io/kms/pkg/service/grpc_service.go
generated
vendored
Normal file
@@ -0,0 +1,131 @@
|
||||
/*
|
||||
Copyright 2023 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package service
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net"
|
||||
"time"
|
||||
|
||||
"google.golang.org/grpc"
|
||||
|
||||
kmsapi "k8s.io/kms/apis/v2"
|
||||
)
|
||||
|
||||
// GRPCService is a grpc server that runs the kms v2 alpha1 API.
|
||||
type GRPCService struct {
|
||||
addr string
|
||||
timeout time.Duration
|
||||
server *grpc.Server
|
||||
|
||||
kmsService Service
|
||||
}
|
||||
|
||||
var _ kmsapi.KeyManagementServiceServer = (*GRPCService)(nil)
|
||||
|
||||
// NewGRPCService creates an instance of GRPCService.
|
||||
func NewGRPCService(
|
||||
address string,
|
||||
timeout time.Duration,
|
||||
|
||||
kmsService Service,
|
||||
) *GRPCService {
|
||||
return &GRPCService{
|
||||
addr: address,
|
||||
timeout: timeout,
|
||||
kmsService: kmsService,
|
||||
}
|
||||
}
|
||||
|
||||
// ListenAndServe accepts incoming connections on a Unix socket. It is a blocking method.
|
||||
// Returns non-nil error unless Close or Shutdown is called.
|
||||
func (s *GRPCService) ListenAndServe() error {
|
||||
ln, err := net.Listen("unix", s.addr)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer ln.Close()
|
||||
|
||||
gs := grpc.NewServer(
|
||||
grpc.ConnectionTimeout(s.timeout),
|
||||
)
|
||||
s.server = gs
|
||||
|
||||
kmsapi.RegisterKeyManagementServiceServer(gs, s)
|
||||
|
||||
return gs.Serve(ln)
|
||||
}
|
||||
|
||||
// Shutdown performs a graceful shutdown. Doesn't accept new connections and
|
||||
// blocks until all pending RPCs are finished.
|
||||
func (s *GRPCService) Shutdown() {
|
||||
if s.server != nil {
|
||||
s.server.GracefulStop()
|
||||
}
|
||||
}
|
||||
|
||||
// Close stops the server by closing all connections immediately and cancels
|
||||
// all active RPCs.
|
||||
func (s *GRPCService) Close() {
|
||||
if s.server != nil {
|
||||
s.server.Stop()
|
||||
}
|
||||
}
|
||||
|
||||
// Status sends a status request to specified kms service.
|
||||
func (s *GRPCService) Status(ctx context.Context, _ *kmsapi.StatusRequest) (*kmsapi.StatusResponse, error) {
|
||||
res, err := s.kmsService.Status(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &kmsapi.StatusResponse{
|
||||
Version: res.Version,
|
||||
Healthz: res.Healthz,
|
||||
KeyId: res.KeyID,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Decrypt sends a decryption request to specified kms service.
|
||||
func (s *GRPCService) Decrypt(ctx context.Context, req *kmsapi.DecryptRequest) (*kmsapi.DecryptResponse, error) {
|
||||
plaintext, err := s.kmsService.Decrypt(ctx, req.Uid, &DecryptRequest{
|
||||
Ciphertext: req.Ciphertext,
|
||||
KeyID: req.KeyId,
|
||||
Annotations: req.Annotations,
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &kmsapi.DecryptResponse{
|
||||
Plaintext: plaintext,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Encrypt sends an encryption request to specified kms service.
|
||||
func (s *GRPCService) Encrypt(ctx context.Context, req *kmsapi.EncryptRequest) (*kmsapi.EncryptResponse, error) {
|
||||
encRes, err := s.kmsService.Encrypt(ctx, req.Uid, req.Plaintext)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &kmsapi.EncryptResponse{
|
||||
Ciphertext: encRes.Ciphertext,
|
||||
KeyId: encRes.KeyID,
|
||||
Annotations: encRes.Annotations,
|
||||
}, nil
|
||||
}
|
||||
50
vendor/k8s.io/kms/pkg/service/interface.go
generated
vendored
Normal file
50
vendor/k8s.io/kms/pkg/service/interface.go
generated
vendored
Normal file
@@ -0,0 +1,50 @@
|
||||
/*
|
||||
Copyright 2023 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package service
|
||||
|
||||
import "context"
|
||||
|
||||
// Service allows encrypting and decrypting data using an external Key Management Service.
|
||||
type Service interface {
|
||||
// Decrypt a given bytearray to obtain the original data as bytes.
|
||||
Decrypt(ctx context.Context, uid string, req *DecryptRequest) ([]byte, error)
|
||||
// Encrypt bytes to a ciphertext.
|
||||
Encrypt(ctx context.Context, uid string, data []byte) (*EncryptResponse, error)
|
||||
// Status returns the status of the KMS.
|
||||
Status(ctx context.Context) (*StatusResponse, error)
|
||||
}
|
||||
|
||||
// EncryptResponse is the response from the Envelope service when encrypting data.
|
||||
type EncryptResponse struct {
|
||||
Ciphertext []byte
|
||||
KeyID string
|
||||
Annotations map[string][]byte
|
||||
}
|
||||
|
||||
// DecryptRequest is the request to the Envelope service when decrypting data.
|
||||
type DecryptRequest struct {
|
||||
Ciphertext []byte
|
||||
KeyID string
|
||||
Annotations map[string][]byte
|
||||
}
|
||||
|
||||
// StatusResponse is the response from the Envelope service when getting the status of the service.
|
||||
type StatusResponse struct {
|
||||
Version string
|
||||
Healthz string
|
||||
KeyID string
|
||||
}
|
||||
54
vendor/k8s.io/kms/pkg/util/util.go
generated
vendored
Normal file
54
vendor/k8s.io/kms/pkg/util/util.go
generated
vendored
Normal file
@@ -0,0 +1,54 @@
|
||||
/*
|
||||
Copyright 2022 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package util
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/url"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const (
|
||||
// unixProtocol is the only supported protocol for remote KMS provider.
|
||||
unixProtocol = "unix"
|
||||
)
|
||||
|
||||
// ParseEndpoint parses the endpoint to extract schema, host or path.
|
||||
func ParseEndpoint(endpoint string) (string, error) {
|
||||
if len(endpoint) == 0 {
|
||||
return "", fmt.Errorf("remote KMS provider can't use empty string as endpoint")
|
||||
}
|
||||
|
||||
u, err := url.Parse(endpoint)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("invalid endpoint %q for remote KMS provider, error: %v", endpoint, err)
|
||||
}
|
||||
|
||||
if u.Scheme != unixProtocol {
|
||||
return "", fmt.Errorf("unsupported scheme %q for remote KMS provider", u.Scheme)
|
||||
}
|
||||
|
||||
// Linux abstract namespace socket - no physical file required
|
||||
// Warning: Linux Abstract sockets have not concept of ACL (unlike traditional file based sockets).
|
||||
// However, Linux Abstract sockets are subject to Linux networking namespace, so will only be accessible to
|
||||
// containers within the same pod (unless host networking is used).
|
||||
if strings.HasPrefix(u.Path, "/@") {
|
||||
return strings.TrimPrefix(u.Path, "/"), nil
|
||||
}
|
||||
|
||||
return u.Path, nil
|
||||
}
|
||||
Reference in New Issue
Block a user