From 3933966c856bbe10cc33322dd823eec6341ae6fc Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Thu, 21 May 2026 13:42:44 +0200 Subject: [PATCH 01/12] feat(api): add SecretEncryptionStatus types and EtcdDataEncryptionUpToDate condition Add API types for tracking etcd data re-encryption after key rotation: - SecretEncryptionStatus with ActiveKey, TargetKey, and History fields - SecretEncryptionKeyStatus union type (Azure, AWS, IBMCloud, AESCBC) - Per-provider key status types (AzureKMSKeyStatus, AWSKMSKeyStatus, etc.) - EncryptionMigrationHistory and EncryptionMigrationState types - EtcdDataEncryptionUpToDate condition with 7 reason constants - SecretEncryption field added to HostedClusterStatus and HCPStatus - Deprecated backupKey fields on AWSKMSSpec, AzureKMSSpec, AESCBCSpec Signed-off-by: Mulham Raee Commit-Message-Assisted-by: Claude (via Claude Code) --- api/hypershift/v1beta1/aws.go | 19 + api/hypershift/v1beta1/azure.go | 24 ++ api/hypershift/v1beta1/hosted_controlplane.go | 4 + .../v1beta1/hostedcluster_conditions.go | 14 + api/hypershift/v1beta1/hostedcluster_types.go | 145 +++++++ api/hypershift/v1beta1/ibmcloud.go | 35 ++ .../v1beta1/zz_generated.deepcopy.go | 143 +++++++ .../AAA_ungated.yaml | 387 ++++++++++++++++++ .../ClusterUpdateAcceptRisks.yaml | 387 ++++++++++++++++++ .../ClusterVersionOperatorConfiguration.yaml | 387 ++++++++++++++++++ .../ExternalOIDC.yaml | 387 ++++++++++++++++++ ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 387 ++++++++++++++++++ .../ExternalOIDCWithUpstreamParity.yaml | 387 ++++++++++++++++++ .../GCPPlatform.yaml | 387 ++++++++++++++++++ .../HCPEtcdBackup.yaml | 387 ++++++++++++++++++ ...perShiftOnlyDynamicResourceAllocation.yaml | 387 ++++++++++++++++++ .../ImageStreamImportMode.yaml | 387 ++++++++++++++++++ .../KMSEncryptionProvider.yaml | 387 ++++++++++++++++++ .../OpenStack.yaml | 387 ++++++++++++++++++ .../TLSAdherence.yaml | 387 ++++++++++++++++++ .../AAA_ungated.yaml | 387 ++++++++++++++++++ .../ClusterUpdateAcceptRisks.yaml | 387 ++++++++++++++++++ .../ClusterVersionOperatorConfiguration.yaml | 387 ++++++++++++++++++ .../ExternalOIDC.yaml | 387 ++++++++++++++++++ ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 387 ++++++++++++++++++ .../ExternalOIDCWithUpstreamParity.yaml | 387 ++++++++++++++++++ .../GCPPlatform.yaml | 387 ++++++++++++++++++ .../HCPEtcdBackup.yaml | 387 ++++++++++++++++++ ...perShiftOnlyDynamicResourceAllocation.yaml | 387 ++++++++++++++++++ .../ImageStreamImportMode.yaml | 387 ++++++++++++++++++ .../KMSEncryptionProvider.yaml | 387 ++++++++++++++++++ .../OpenStack.yaml | 387 ++++++++++++++++++ .../TLSAdherence.yaml | 387 ++++++++++++++++++ 33 files changed, 10446 insertions(+) diff --git a/api/hypershift/v1beta1/aws.go b/api/hypershift/v1beta1/aws.go index 3f8f39ede110..a5b9c824274c 100644 --- a/api/hypershift/v1beta1/aws.go +++ b/api/hypershift/v1beta1/aws.go @@ -1018,6 +1018,9 @@ type AWSKMSSpec struct { ActiveKey AWSKMSKeyEntry `json:"activeKey"` // backupKey defines the old key during the rotation process so previously created // secrets can continue to be decrypted until they are all re-encrypted with the active key. + // + // Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + // The system automatically manages the previous key via the status field. // +optional BackupKey *AWSKMSKeyEntry `json:"backupKey,omitempty"` // auth defines metadata about the management of credentials used to interact with AWS KMS @@ -1082,6 +1085,22 @@ type AWSKMSKeyEntry struct { ARN string `json:"arn"` } +// AWSKMSKeyStatus contains identity fields for an AWS KMS key, sufficient to +// reconstruct the backup sidecar container arguments. +// +k8s:deepcopy-gen=true +type AWSKMSKeyStatus struct { + // arn is the Amazon Resource Name of the KMS key. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + ARN string `json:"arn,omitempty"` + // region is the AWS region of the KMS key. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + Region string `json:"region,omitempty"` +} + // AWSPlatformStatus contains status specific to the AWS platform type AWSPlatformStatus struct { // defaultWorkerSecurityGroupID is the ID of a security group created by diff --git a/api/hypershift/v1beta1/azure.go b/api/hypershift/v1beta1/azure.go index c95773e13bd7..71f7beea32a4 100644 --- a/api/hypershift/v1beta1/azure.go +++ b/api/hypershift/v1beta1/azure.go @@ -856,6 +856,9 @@ type AzureKMSSpec struct { ActiveKey AzureKMSKey `json:"activeKey"` // backupKey defines the old key during the rotation process so previously created // secrets can continue to be decrypted until they are all re-encrypted with the active key. + // + // Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + // The system automatically manages the previous key via the status field. // +optional BackupKey *AzureKMSKey `json:"backupKey,omitempty"` @@ -902,6 +905,27 @@ type AzureKMSKey struct { KeyVersion string `json:"keyVersion"` } +// AzureKMSKeyStatus contains identity fields for an Azure KMS key, sufficient to +// reconstruct the EncryptionConfiguration read provider. +// +k8s:deepcopy-gen=true +type AzureKMSKeyStatus struct { + // keyVaultName is the name of the Azure Key Vault. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + KeyVaultName string `json:"keyVaultName,omitempty"` + // keyName is the name of the key in the vault. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + KeyName string `json:"keyName,omitempty"` + // keyVersion is the version of the key. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + KeyVersion string `json:"keyVersion,omitempty"` +} + // AzureAuthenticationType is a discriminated union type that contains the Azure authentication configuration for an // Azure Hosted Cluster. This type is used to determine which authentication configuration is being used. Valid values // are "ManagedIdentities" and "WorkloadIdentities". diff --git a/api/hypershift/v1beta1/hosted_controlplane.go b/api/hypershift/v1beta1/hosted_controlplane.go index 8486514f0a18..05a2fa60d220 100644 --- a/api/hypershift/v1beta1/hosted_controlplane.go +++ b/api/hypershift/v1beta1/hosted_controlplane.go @@ -419,6 +419,10 @@ type HostedControlPlaneStatus struct { // configuration contains the cluster configuration status of the HostedCluster // +optional Configuration *ConfigurationStatus `json:"configuration,omitempty"` + + // secretEncryption tracks the state of secret encryption key rotation and re-encryption. + // +optional + SecretEncryption SecretEncryptionStatus `json:"secretEncryption,omitzero"` } // APIEndpoint represents a reachable Kubernetes API endpoint. diff --git a/api/hypershift/v1beta1/hostedcluster_conditions.go b/api/hypershift/v1beta1/hostedcluster_conditions.go index 9fda11a60a2c..374e52a4fefc 100644 --- a/api/hypershift/v1beta1/hostedcluster_conditions.go +++ b/api/hypershift/v1beta1/hostedcluster_conditions.go @@ -265,6 +265,12 @@ const ( PublicEndpointSharedIngressConfiguredReason = "SharedIngressConfigured" PublicEndpointTopologyPrivateReason = "TopologyPrivate" PublicEndpointConvergenceInProgressReason = "ConvergenceInProgress" + // EtcdDataEncryptionUpToDate indicates whether all etcd data is encrypted with the + // currently active encryption key. + // True: all data confirmed encrypted with the active key. + // False: re-encryption is in progress or has failed. + // Absent: encryption is not configured. + EtcdDataEncryptionUpToDate ConditionType = "EtcdDataEncryptionUpToDate" ) // Reasons. @@ -349,6 +355,14 @@ const ( AutoNodeNotConfiguredReason = "AutoNodeNotConfigured" AutoNodeProgressingReason = "AutoNodeProgressing" AutoNodeEvaluationFailedReason = "AutoNodeEvaluationFailed" + + ReadOnlyRolloutInProgressReason = "ReadOnlyRolloutInProgress" + WritePromotionInProgressReason = "WritePromotionInProgress" + ReEncryptionInProgressReason = "ReEncryptionInProgress" + ReEncryptionCompletedReason = "ReEncryptionCompleted" + ReEncryptionFailedReason = "ReEncryptionFailed" + ReEncryptionWaitingForKASReason = "ReEncryptionWaitingForKASConvergence" + ReEncryptionPersistentFailureReason = "ReEncryptionPersistentFailure" ) // Messages. diff --git a/api/hypershift/v1beta1/hostedcluster_types.go b/api/hypershift/v1beta1/hostedcluster_types.go index 74b50f24ad38..98b7c1e9ba9d 100644 --- a/api/hypershift/v1beta1/hostedcluster_types.go +++ b/api/hypershift/v1beta1/hostedcluster_types.go @@ -2073,10 +2073,151 @@ type AESCBCSpec struct { ActiveKey corev1.LocalObjectReference `json:"activeKey"` // backupKey defines the old key during the rotation process so previously created // secrets can continue to be decrypted until they are all re-encrypted with the active key. + // + // Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + // The system automatically manages the previous key via the status field. // +optional BackupKey *corev1.LocalObjectReference `json:"backupKey,omitempty"` } +// SecretEncryptionProvider identifies the encryption provider recorded in status. +// This is a separate type from KMSProvider because the KMSProvider enum does not include AESCBC. +type SecretEncryptionProvider string + +const ( + SecretEncryptionProviderAzure SecretEncryptionProvider = "Azure" + SecretEncryptionProviderAWS SecretEncryptionProvider = "AWS" + SecretEncryptionProviderIBMCloud SecretEncryptionProvider = "IBMCloud" + SecretEncryptionProviderAESCBC SecretEncryptionProvider = "AESCBC" +) + +// SecretEncryptionStatus tracks the state of secret encryption key rotation and re-encryption. +// +k8s:deepcopy-gen=true +// +kubebuilder:validation:MinProperties=1 +type SecretEncryptionStatus struct { + // activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + // Updated after successful re-encryption. + // +optional + ActiveKey SecretEncryptionKeyStatus `json:"activeKey,omitzero"` + // targetKey is the key being rolled out during an active rotation. Snapshot from + // spec.secretEncryption's active key when the rotation starts. The CPO uses this + // (not the current spec) during the rotation, so mid-rotation spec changes are + // safely queued until the current rotation completes. Cleared when rotation completes. + // +optional + TargetKey SecretEncryptionKeyStatus `json:"targetKey,omitzero"` + // history contains a list of key rotations applied to this cluster. The newest + // entry is first in the list. Entries have state Completed when re-encryption + // has finished. The current rotation phase is always history[0].state when + // history[0] is not Completed or Interrupted. + // +optional + // +listType=atomic + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=5 + History []EncryptionMigrationHistory `json:"history,omitempty"` +} + +// SecretEncryptionKeyStatus records the active key identity. Status-specific types are used +// instead of reusing the spec types directly, to decouple status serialization from spec type evolution. +// +k8s:deepcopy-gen=true +// +kubebuilder:validation:XValidation:rule="self.provider == 'Azure' ? has(self.azure) : !has(self.azure)",message="azure is required when provider is Azure, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="self.provider == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws is required when provider is AWS, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="self.provider == 'IBMCloud' ? has(self.ibmCloud) : !has(self.ibmCloud)",message="ibmCloud is required when provider is IBMCloud, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="self.provider == 'AESCBC' ? has(self.aescbc) : !has(self.aescbc)",message="aescbc is required when provider is AESCBC, and forbidden otherwise" +// +union +type SecretEncryptionKeyStatus struct { + // provider identifies the encryption provider. + // +required + // +unionDiscriminator + // +kubebuilder:validation:Enum=Azure;AWS;IBMCloud;AESCBC + Provider SecretEncryptionProvider `json:"provider,omitempty"` + // azure holds the Azure KMS key identity fields. + // +optional + // +unionMember + Azure AzureKMSKeyStatus `json:"azure,omitzero"` + // aws holds the AWS KMS key identity fields. + // +optional + // +unionMember + AWS AWSKMSKeyStatus `json:"aws,omitzero"` + // ibmCloud holds the IBM Cloud KMS key identity fields. + // +optional + // +unionMember + IBMCloud IBMCloudKMSKeyStatus `json:"ibmCloud,omitzero"` + // aescbc holds a reference to the AESCBC key secret. + // +optional + // +unionMember + AESCBC AESCBCKeyStatus `json:"aescbc,omitzero"` +} + +// AESCBCKeyStatus contains a reference to the AESCBC key secret and a SHA-256 hash +// of its contents for fingerprinting. +// +k8s:deepcopy-gen=true +type AESCBCKeyStatus struct { + // secret is a reference to the secret containing the AESCBC key. + // +required + Secret corev1.LocalObjectReference `json:"secret,omitempty"` + // dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + // at the time re-encryption completed. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=64 + DataHash string `json:"dataHash,omitempty"` +} + +// EncryptionKeyReference identifies an encryption key by its provider and fingerprint. +// +k8s:deepcopy-gen=true +type EncryptionKeyReference struct { + // provider identifies the encryption provider. + // +required + // +kubebuilder:validation:Enum=Azure;AWS;IBMCloud;AESCBC + Provider SecretEncryptionProvider `json:"provider,omitempty"` + // fingerprint is the hex-encoded SHA-256 hash of the key's identity fields. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=64 + Fingerprint string `json:"fingerprint,omitempty"` +} + +// EncryptionMigrationState tracks the lifecycle of a key rotation. +// +kubebuilder:validation:Enum=ReadOnlyDeploy;WritePromote;Migrating;Completed;Interrupted +type EncryptionMigrationState string + +const ( + // EncryptionMigrationStateReadOnlyDeploy means the new key is being deployed as a read-only + // provider. The old key remains the write provider. + EncryptionMigrationStateReadOnlyDeploy EncryptionMigrationState = "ReadOnlyDeploy" + // EncryptionMigrationStateWritePromote means the new key is being promoted to write provider. + // The old key becomes read-only. + EncryptionMigrationStateWritePromote EncryptionMigrationState = "WritePromote" + // EncryptionMigrationStateMigrating means all KAS replicas have converged on the new write + // provider and re-encryption (StorageVersionMigration) is in progress. + EncryptionMigrationStateMigrating EncryptionMigrationState = "Migrating" + // EncryptionMigrationStateCompleted means all data was successfully re-encrypted with the target key. + EncryptionMigrationStateCompleted EncryptionMigrationState = "Completed" + // EncryptionMigrationStateInterrupted means the rotation was abandoned before data was encrypted + // with the target key (e.g., targetKey replaced during ReadOnlyDeploy). + EncryptionMigrationStateInterrupted EncryptionMigrationState = "Interrupted" +) + +// EncryptionMigrationHistory records a key rotation, including in-progress rotations. +// +k8s:deepcopy-gen=true +type EncryptionMigrationHistory struct { + // from is the key that data was migrated from (the previous active key). + // +required + From EncryptionKeyReference `json:"from,omitzero"` + // to is the key that data was migrated to (the target key). + // +required + To EncryptionKeyReference `json:"to,omitzero"` + // state tracks the current phase of this rotation. + // +required + State EncryptionMigrationState `json:"state,omitempty"` + // startedTime is when the rotation was initiated. + // +required + StartedTime metav1.Time `json:"startedTime,omitempty"` + // completionTime is when the rotation finished. Not set while the rotation is in progress. + // +optional + CompletionTime *metav1.Time `json:"completionTime,omitempty"` +} + type PayloadArchType string const ( @@ -2190,6 +2331,10 @@ type HostedClusterStatus struct { // +kubebuilder:validation:MaxLength=2048 // +kubebuilder:validation:XValidation:rule="self.matches('^(https|s3)://.*')",message="lastSuccessfulEtcdBackupURL must be a valid URL with scheme https or s3" LastSuccessfulEtcdBackupURL string `json:"lastSuccessfulEtcdBackupURL,omitempty"` + + // secretEncryption tracks the state of secret encryption key rotation and re-encryption. + // +optional + SecretEncryption SecretEncryptionStatus `json:"secretEncryption,omitzero"` } // AutoNodeStatus contains the observed state of the AutoNode provisioner. diff --git a/api/hypershift/v1beta1/ibmcloud.go b/api/hypershift/v1beta1/ibmcloud.go index 0f824883e300..bad0e9c3c1c0 100644 --- a/api/hypershift/v1beta1/ibmcloud.go +++ b/api/hypershift/v1beta1/ibmcloud.go @@ -44,6 +44,41 @@ type IBMCloudKMSKeyEntry struct { KeyVersion int `json:"keyVersion"` } +// IBMCloudKMSKeyStatus contains identity fields for an IBM Cloud KMS key list entry, +// sufficient to reconstruct the KP_DATA_JSON entry for the backup key. +// +k8s:deepcopy-gen=true +type IBMCloudKMSKeyStatus struct { + // crkID is the Customer Root Key ID. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + CRKID string `json:"crkID,omitempty"` + // instanceID is the KMS instance ID. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + InstanceID string `json:"instanceID,omitempty"` + // keyVersion is the key version number. + // +required + // +kubebuilder:validation:Minimum=0 + KeyVersion int32 `json:"keyVersion,omitempty"` + // region is the IBM Cloud region. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + Region string `json:"region,omitempty"` + // correlationID is the correlation ID for the key. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + CorrelationID string `json:"correlationID,omitempty"` + // url is the KMS endpoint URL. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + URL string `json:"url,omitempty"` +} + // IBMCloudKMSAuthSpec defines metadata for how authentication is done with IBM Cloud KMS type IBMCloudKMSAuthSpec struct { // type defines the IBM Cloud KMS authentication strategy diff --git a/api/hypershift/v1beta1/zz_generated.deepcopy.go b/api/hypershift/v1beta1/zz_generated.deepcopy.go index 454f86378499..33601892dd28 100644 --- a/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -29,6 +29,22 @@ import ( "k8s.io/apimachinery/pkg/util/intstr" ) +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AESCBCKeyStatus) DeepCopyInto(out *AESCBCKeyStatus) { + *out = *in + out.Secret = in.Secret +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AESCBCKeyStatus. +func (in *AESCBCKeyStatus) DeepCopy() *AESCBCKeyStatus { + if in == nil { + return nil + } + out := new(AESCBCKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AESCBCSpec) DeepCopyInto(out *AESCBCSpec) { *out = *in @@ -256,6 +272,21 @@ func (in *AWSKMSKeyEntry) DeepCopy() *AWSKMSKeyEntry { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AWSKMSKeyStatus) DeepCopyInto(out *AWSKMSKeyStatus) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSKMSKeyStatus. +func (in *AWSKMSKeyStatus) DeepCopy() *AWSKMSKeyStatus { + if in == nil { + return nil + } + out := new(AWSKMSKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AWSKMSSpec) DeepCopyInto(out *AWSKMSSpec) { *out = *in @@ -641,6 +672,21 @@ func (in *AzureKMSKey) DeepCopy() *AzureKMSKey { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AzureKMSKeyStatus) DeepCopyInto(out *AzureKMSKeyStatus) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AzureKMSKeyStatus. +func (in *AzureKMSKeyStatus) DeepCopy() *AzureKMSKeyStatus { + if in == nil { + return nil + } + out := new(AzureKMSKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AzureKMSSpec) DeepCopyInto(out *AzureKMSSpec) { *out = *in @@ -1615,6 +1661,43 @@ func (in *Diagnostics) DeepCopy() *Diagnostics { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *EncryptionKeyReference) DeepCopyInto(out *EncryptionKeyReference) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionKeyReference. +func (in *EncryptionKeyReference) DeepCopy() *EncryptionKeyReference { + if in == nil { + return nil + } + out := new(EncryptionKeyReference) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *EncryptionMigrationHistory) DeepCopyInto(out *EncryptionMigrationHistory) { + *out = *in + out.From = in.From + out.To = in.To + in.StartedTime.DeepCopyInto(&out.StartedTime) + if in.CompletionTime != nil { + in, out := &in.CompletionTime, &out.CompletionTime + *out = (*in).DeepCopy() + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionMigrationHistory. +func (in *EncryptionMigrationHistory) DeepCopy() *EncryptionMigrationHistory { + if in == nil { + return nil + } + out := new(EncryptionMigrationHistory) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *EtcdSpec) DeepCopyInto(out *EtcdSpec) { *out = *in @@ -2461,6 +2544,7 @@ func (in *HostedClusterStatus) DeepCopyInto(out *HostedClusterStatus) { *out = new(ConfigurationStatus) (*in).DeepCopyInto(*out) } + in.SecretEncryption.DeepCopyInto(&out.SecretEncryption) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostedClusterStatus. @@ -2697,6 +2781,7 @@ func (in *HostedControlPlaneStatus) DeepCopyInto(out *HostedControlPlaneStatus) *out = new(ConfigurationStatus) (*in).DeepCopyInto(*out) } + in.SecretEncryption.DeepCopyInto(&out.SecretEncryption) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostedControlPlaneStatus. @@ -2749,6 +2834,21 @@ func (in *IBMCloudKMSKeyEntry) DeepCopy() *IBMCloudKMSKeyEntry { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IBMCloudKMSKeyStatus) DeepCopyInto(out *IBMCloudKMSKeyStatus) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IBMCloudKMSKeyStatus. +func (in *IBMCloudKMSKeyStatus) DeepCopy() *IBMCloudKMSKeyStatus { + if in == nil { + return nil + } + out := new(IBMCloudKMSKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *IBMCloudKMSManagedAuthSpec) DeepCopyInto(out *IBMCloudKMSManagedAuthSpec) { *out = *in @@ -4423,6 +4523,25 @@ func (in *ScaleDownConfig) DeepCopy() *ScaleDownConfig { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SecretEncryptionKeyStatus) DeepCopyInto(out *SecretEncryptionKeyStatus) { + *out = *in + out.Azure = in.Azure + out.AWS = in.AWS + out.IBMCloud = in.IBMCloud + out.AESCBC = in.AESCBC +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretEncryptionKeyStatus. +func (in *SecretEncryptionKeyStatus) DeepCopy() *SecretEncryptionKeyStatus { + if in == nil { + return nil + } + out := new(SecretEncryptionKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretEncryptionSpec) DeepCopyInto(out *SecretEncryptionSpec) { *out = *in @@ -4448,6 +4567,30 @@ func (in *SecretEncryptionSpec) DeepCopy() *SecretEncryptionSpec { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SecretEncryptionStatus) DeepCopyInto(out *SecretEncryptionStatus) { + *out = *in + out.ActiveKey = in.ActiveKey + out.TargetKey = in.TargetKey + if in.History != nil { + in, out := &in.History, &out.History + *out = make([]EncryptionMigrationHistory, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretEncryptionStatus. +func (in *SecretEncryptionStatus) DeepCopy() *SecretEncryptionStatus { + if in == nil { + return nil + } + out := new(SecretEncryptionStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretReference) DeepCopyInto(out *SecretReference) { *out = *in diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml index 4ed2391e13e2..9550a6992ce2 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml @@ -6022,6 +6022,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6079,6 +6082,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6133,6 +6139,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7004,6 +7013,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index 9185fb00d932..fea5196ecf83 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -6005,6 +6005,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6062,6 +6065,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6116,6 +6122,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -6987,6 +6996,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index 2269797a21d4..16ad0192fc0e 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -6025,6 +6025,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6082,6 +6085,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6136,6 +6142,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7007,6 +7016,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml index 0a1a136fa308..c3b19174d9d0 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml @@ -6337,6 +6337,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6394,6 +6397,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6448,6 +6454,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7484,6 +7493,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index cebc53316acf..cec6736ddbb4 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -6477,6 +6477,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6534,6 +6537,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6588,6 +6594,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7624,6 +7633,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index 1270fd8cb1fb..c62dd3d18d83 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -6468,6 +6468,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6525,6 +6528,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6579,6 +6585,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7450,6 +7459,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml index f7170ecada7a..a47c6e4f7458 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml @@ -6451,6 +6451,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6508,6 +6511,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6562,6 +6568,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7433,6 +7442,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml index fd458cb1f13b..3ca56744ebd3 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -6070,6 +6070,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6127,6 +6130,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6181,6 +6187,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7064,6 +7073,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index 461ae7dc7982..cfdd95d57a99 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -6027,6 +6027,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6084,6 +6087,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6138,6 +6144,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7009,6 +7018,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml index f741a117e78b..4504461be66a 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -6023,6 +6023,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6080,6 +6083,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6134,6 +6140,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7016,6 +7025,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml index 33c70e1bc312..daf3aac48042 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -6081,6 +6081,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6138,6 +6141,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6192,6 +6198,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7063,6 +7072,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml index bdb6610a9248..ab1ff8ad45c5 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml @@ -6556,6 +6556,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6613,6 +6616,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6667,6 +6673,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7538,6 +7547,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml index 517516cd2f4a..d8b3291b5a15 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml @@ -6045,6 +6045,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6102,6 +6105,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6156,6 +6162,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7027,6 +7036,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml index 7faf853bd178..b5b5eb86392a 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml @@ -5877,6 +5877,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -5934,6 +5937,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -5988,6 +5994,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -6836,6 +6845,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index 927f2b9ffc23..97f443cb0d21 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -5860,6 +5860,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -5917,6 +5920,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -5971,6 +5977,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -6819,6 +6828,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index ad6e7742c0ec..d1f563f98d7b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -5880,6 +5880,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -5937,6 +5940,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -5991,6 +5997,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -6839,6 +6848,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml index 1b9da7de5255..5a0a3088891e 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml @@ -6192,6 +6192,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6249,6 +6252,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6303,6 +6309,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7316,6 +7325,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index 3cd3503473be..4c1d71b72f76 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -6332,6 +6332,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6389,6 +6392,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6443,6 +6449,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7456,6 +7465,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index 9d7a73cb3bf0..7e7a23418f13 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -6323,6 +6323,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6380,6 +6383,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6434,6 +6440,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7282,6 +7291,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml index 1527b355549f..034333cd3535 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml @@ -6306,6 +6306,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6363,6 +6366,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6417,6 +6423,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7265,6 +7274,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml index 36a11500968d..26fe90e75e63 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -5925,6 +5925,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -5982,6 +5985,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6036,6 +6042,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -6884,6 +6893,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index 5ea38844b584..7d5de94eecd4 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -5882,6 +5882,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -5939,6 +5942,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -5993,6 +5999,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -6841,6 +6850,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml index 9de4ad90ead5..4327a332bc93 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -5878,6 +5878,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -5935,6 +5938,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -5989,6 +5995,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -6848,6 +6857,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml index db3f3840a8c2..fae5de3d2ce0 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -5936,6 +5936,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -5993,6 +5996,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6047,6 +6053,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -6895,6 +6904,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml index c3c0b64fcf23..63879512e486 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml @@ -6411,6 +6411,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6468,6 +6471,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6522,6 +6528,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7370,6 +7379,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml index e52cbe485e19..68fe67fe532d 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml @@ -5900,6 +5900,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -5957,6 +5960,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6011,6 +6017,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -6859,6 +6868,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by From 40ac0a0b184ad25d361ef233937863c752f5dc41 Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Thu, 21 May 2026 13:42:52 +0200 Subject: [PATCH 02/12] chore(api): regenerate CRDs, clients, deepcopy, and vendor Auto-generated output from make update after API type changes. Includes vendored library-go migrators and kube-storage-version-migrator informer/lister packages required by the HCCO re-encryption controller. Signed-off-by: Mulham Raee Commit-Message-Assisted-by: Claude (via Claude Code) --- .../hypershift/v1beta1/aescbckeystatus.go | 51 +++ .../hypershift/v1beta1/awskmskeystatus.go | 47 +++ .../hypershift/v1beta1/azurekmskeystatus.go | 56 +++ .../v1beta1/encryptionkeyreference.go | 51 +++ .../v1beta1/encryptionmigrationhistory.go | 79 ++++ .../hypershift/v1beta1/hostedclusterstatus.go | 9 + .../v1beta1/hostedcontrolplanestatus.go | 9 + .../v1beta1/ibmcloudkmskeystatus.go | 83 ++++ .../v1beta1/secretencryptionkeystatus.go | 78 ++++ .../v1beta1/secretencryptionstatus.go | 61 +++ client/applyconfiguration/utils.go | 16 + ...usters-Hypershift-CustomNoUpgrade.crd.yaml | 387 ++++++++++++++++++ ...hostedclusters-Hypershift-Default.crd.yaml | 387 ++++++++++++++++++ ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 387 ++++++++++++++++++ ...planes-Hypershift-CustomNoUpgrade.crd.yaml | 387 ++++++++++++++++++ ...dcontrolplanes-Hypershift-Default.crd.yaml | 387 ++++++++++++++++++ ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 387 ++++++++++++++++++ go.mod | 2 +- .../hypershift/api/hypershift/v1beta1/aws.go | 19 + .../api/hypershift/v1beta1/azure.go | 24 ++ 20 files changed, 2906 insertions(+), 1 deletion(-) create mode 100644 client/applyconfiguration/hypershift/v1beta1/aescbckeystatus.go create mode 100644 client/applyconfiguration/hypershift/v1beta1/awskmskeystatus.go create mode 100644 client/applyconfiguration/hypershift/v1beta1/azurekmskeystatus.go create mode 100644 client/applyconfiguration/hypershift/v1beta1/encryptionkeyreference.go create mode 100644 client/applyconfiguration/hypershift/v1beta1/encryptionmigrationhistory.go create mode 100644 client/applyconfiguration/hypershift/v1beta1/ibmcloudkmskeystatus.go create mode 100644 client/applyconfiguration/hypershift/v1beta1/secretencryptionkeystatus.go create mode 100644 client/applyconfiguration/hypershift/v1beta1/secretencryptionstatus.go diff --git a/client/applyconfiguration/hypershift/v1beta1/aescbckeystatus.go b/client/applyconfiguration/hypershift/v1beta1/aescbckeystatus.go new file mode 100644 index 000000000000..414a0f19836e --- /dev/null +++ b/client/applyconfiguration/hypershift/v1beta1/aescbckeystatus.go @@ -0,0 +1,51 @@ +/* + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1beta1 + +import ( + v1 "k8s.io/api/core/v1" +) + +// AESCBCKeyStatusApplyConfiguration represents a declarative configuration of the AESCBCKeyStatus type for use +// with apply. +type AESCBCKeyStatusApplyConfiguration struct { + Secret *v1.LocalObjectReference `json:"secret,omitempty"` + DataHash *string `json:"dataHash,omitempty"` +} + +// AESCBCKeyStatusApplyConfiguration constructs a declarative configuration of the AESCBCKeyStatus type for use with +// apply. +func AESCBCKeyStatus() *AESCBCKeyStatusApplyConfiguration { + return &AESCBCKeyStatusApplyConfiguration{} +} + +// WithSecret sets the Secret field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Secret field is set to the value of the last call. +func (b *AESCBCKeyStatusApplyConfiguration) WithSecret(value v1.LocalObjectReference) *AESCBCKeyStatusApplyConfiguration { + b.Secret = &value + return b +} + +// WithDataHash sets the DataHash field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the DataHash field is set to the value of the last call. +func (b *AESCBCKeyStatusApplyConfiguration) WithDataHash(value string) *AESCBCKeyStatusApplyConfiguration { + b.DataHash = &value + return b +} diff --git a/client/applyconfiguration/hypershift/v1beta1/awskmskeystatus.go b/client/applyconfiguration/hypershift/v1beta1/awskmskeystatus.go new file mode 100644 index 000000000000..337edbc9ea75 --- /dev/null +++ b/client/applyconfiguration/hypershift/v1beta1/awskmskeystatus.go @@ -0,0 +1,47 @@ +/* + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1beta1 + +// AWSKMSKeyStatusApplyConfiguration represents a declarative configuration of the AWSKMSKeyStatus type for use +// with apply. +type AWSKMSKeyStatusApplyConfiguration struct { + ARN *string `json:"arn,omitempty"` + Region *string `json:"region,omitempty"` +} + +// AWSKMSKeyStatusApplyConfiguration constructs a declarative configuration of the AWSKMSKeyStatus type for use with +// apply. +func AWSKMSKeyStatus() *AWSKMSKeyStatusApplyConfiguration { + return &AWSKMSKeyStatusApplyConfiguration{} +} + +// WithARN sets the ARN field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ARN field is set to the value of the last call. +func (b *AWSKMSKeyStatusApplyConfiguration) WithARN(value string) *AWSKMSKeyStatusApplyConfiguration { + b.ARN = &value + return b +} + +// WithRegion sets the Region field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Region field is set to the value of the last call. +func (b *AWSKMSKeyStatusApplyConfiguration) WithRegion(value string) *AWSKMSKeyStatusApplyConfiguration { + b.Region = &value + return b +} diff --git a/client/applyconfiguration/hypershift/v1beta1/azurekmskeystatus.go b/client/applyconfiguration/hypershift/v1beta1/azurekmskeystatus.go new file mode 100644 index 000000000000..29c942b8c66a --- /dev/null +++ b/client/applyconfiguration/hypershift/v1beta1/azurekmskeystatus.go @@ -0,0 +1,56 @@ +/* + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1beta1 + +// AzureKMSKeyStatusApplyConfiguration represents a declarative configuration of the AzureKMSKeyStatus type for use +// with apply. +type AzureKMSKeyStatusApplyConfiguration struct { + KeyVaultName *string `json:"keyVaultName,omitempty"` + KeyName *string `json:"keyName,omitempty"` + KeyVersion *string `json:"keyVersion,omitempty"` +} + +// AzureKMSKeyStatusApplyConfiguration constructs a declarative configuration of the AzureKMSKeyStatus type for use with +// apply. +func AzureKMSKeyStatus() *AzureKMSKeyStatusApplyConfiguration { + return &AzureKMSKeyStatusApplyConfiguration{} +} + +// WithKeyVaultName sets the KeyVaultName field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the KeyVaultName field is set to the value of the last call. +func (b *AzureKMSKeyStatusApplyConfiguration) WithKeyVaultName(value string) *AzureKMSKeyStatusApplyConfiguration { + b.KeyVaultName = &value + return b +} + +// WithKeyName sets the KeyName field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the KeyName field is set to the value of the last call. +func (b *AzureKMSKeyStatusApplyConfiguration) WithKeyName(value string) *AzureKMSKeyStatusApplyConfiguration { + b.KeyName = &value + return b +} + +// WithKeyVersion sets the KeyVersion field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the KeyVersion field is set to the value of the last call. +func (b *AzureKMSKeyStatusApplyConfiguration) WithKeyVersion(value string) *AzureKMSKeyStatusApplyConfiguration { + b.KeyVersion = &value + return b +} diff --git a/client/applyconfiguration/hypershift/v1beta1/encryptionkeyreference.go b/client/applyconfiguration/hypershift/v1beta1/encryptionkeyreference.go new file mode 100644 index 000000000000..4d5cfb3a0803 --- /dev/null +++ b/client/applyconfiguration/hypershift/v1beta1/encryptionkeyreference.go @@ -0,0 +1,51 @@ +/* + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1beta1 + +import ( + hypershiftv1beta1 "github.com/openshift/hypershift/api/hypershift/v1beta1" +) + +// EncryptionKeyReferenceApplyConfiguration represents a declarative configuration of the EncryptionKeyReference type for use +// with apply. +type EncryptionKeyReferenceApplyConfiguration struct { + Provider *hypershiftv1beta1.SecretEncryptionProvider `json:"provider,omitempty"` + Fingerprint *string `json:"fingerprint,omitempty"` +} + +// EncryptionKeyReferenceApplyConfiguration constructs a declarative configuration of the EncryptionKeyReference type for use with +// apply. +func EncryptionKeyReference() *EncryptionKeyReferenceApplyConfiguration { + return &EncryptionKeyReferenceApplyConfiguration{} +} + +// WithProvider sets the Provider field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Provider field is set to the value of the last call. +func (b *EncryptionKeyReferenceApplyConfiguration) WithProvider(value hypershiftv1beta1.SecretEncryptionProvider) *EncryptionKeyReferenceApplyConfiguration { + b.Provider = &value + return b +} + +// WithFingerprint sets the Fingerprint field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Fingerprint field is set to the value of the last call. +func (b *EncryptionKeyReferenceApplyConfiguration) WithFingerprint(value string) *EncryptionKeyReferenceApplyConfiguration { + b.Fingerprint = &value + return b +} diff --git a/client/applyconfiguration/hypershift/v1beta1/encryptionmigrationhistory.go b/client/applyconfiguration/hypershift/v1beta1/encryptionmigrationhistory.go new file mode 100644 index 000000000000..7399882773f6 --- /dev/null +++ b/client/applyconfiguration/hypershift/v1beta1/encryptionmigrationhistory.go @@ -0,0 +1,79 @@ +/* + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1beta1 + +import ( + hypershiftv1beta1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// EncryptionMigrationHistoryApplyConfiguration represents a declarative configuration of the EncryptionMigrationHistory type for use +// with apply. +type EncryptionMigrationHistoryApplyConfiguration struct { + From *EncryptionKeyReferenceApplyConfiguration `json:"from,omitempty"` + To *EncryptionKeyReferenceApplyConfiguration `json:"to,omitempty"` + State *hypershiftv1beta1.EncryptionMigrationState `json:"state,omitempty"` + StartedTime *v1.Time `json:"startedTime,omitempty"` + CompletionTime *v1.Time `json:"completionTime,omitempty"` +} + +// EncryptionMigrationHistoryApplyConfiguration constructs a declarative configuration of the EncryptionMigrationHistory type for use with +// apply. +func EncryptionMigrationHistory() *EncryptionMigrationHistoryApplyConfiguration { + return &EncryptionMigrationHistoryApplyConfiguration{} +} + +// WithFrom sets the From field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the From field is set to the value of the last call. +func (b *EncryptionMigrationHistoryApplyConfiguration) WithFrom(value *EncryptionKeyReferenceApplyConfiguration) *EncryptionMigrationHistoryApplyConfiguration { + b.From = value + return b +} + +// WithTo sets the To field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the To field is set to the value of the last call. +func (b *EncryptionMigrationHistoryApplyConfiguration) WithTo(value *EncryptionKeyReferenceApplyConfiguration) *EncryptionMigrationHistoryApplyConfiguration { + b.To = value + return b +} + +// WithState sets the State field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the State field is set to the value of the last call. +func (b *EncryptionMigrationHistoryApplyConfiguration) WithState(value hypershiftv1beta1.EncryptionMigrationState) *EncryptionMigrationHistoryApplyConfiguration { + b.State = &value + return b +} + +// WithStartedTime sets the StartedTime field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the StartedTime field is set to the value of the last call. +func (b *EncryptionMigrationHistoryApplyConfiguration) WithStartedTime(value v1.Time) *EncryptionMigrationHistoryApplyConfiguration { + b.StartedTime = &value + return b +} + +// WithCompletionTime sets the CompletionTime field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the CompletionTime field is set to the value of the last call. +func (b *EncryptionMigrationHistoryApplyConfiguration) WithCompletionTime(value v1.Time) *EncryptionMigrationHistoryApplyConfiguration { + b.CompletionTime = &value + return b +} diff --git a/client/applyconfiguration/hypershift/v1beta1/hostedclusterstatus.go b/client/applyconfiguration/hypershift/v1beta1/hostedclusterstatus.go index 4ca327284e20..3f0658004684 100644 --- a/client/applyconfiguration/hypershift/v1beta1/hostedclusterstatus.go +++ b/client/applyconfiguration/hypershift/v1beta1/hostedclusterstatus.go @@ -40,6 +40,7 @@ type HostedClusterStatusApplyConfiguration struct { AutoNode *AutoNodeStatusApplyConfiguration `json:"autoNode,omitempty"` Configuration *ConfigurationStatusApplyConfiguration `json:"configuration,omitempty"` LastSuccessfulEtcdBackupURL *string `json:"lastSuccessfulEtcdBackupURL,omitempty"` + SecretEncryption *SecretEncryptionStatusApplyConfiguration `json:"secretEncryption,omitempty"` } // HostedClusterStatusApplyConfiguration constructs a declarative configuration of the HostedClusterStatus type for use with @@ -164,3 +165,11 @@ func (b *HostedClusterStatusApplyConfiguration) WithLastSuccessfulEtcdBackupURL( b.LastSuccessfulEtcdBackupURL = &value return b } + +// WithSecretEncryption sets the SecretEncryption field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the SecretEncryption field is set to the value of the last call. +func (b *HostedClusterStatusApplyConfiguration) WithSecretEncryption(value *SecretEncryptionStatusApplyConfiguration) *HostedClusterStatusApplyConfiguration { + b.SecretEncryption = value + return b +} diff --git a/client/applyconfiguration/hypershift/v1beta1/hostedcontrolplanestatus.go b/client/applyconfiguration/hypershift/v1beta1/hostedcontrolplanestatus.go index 3921f0dd7d99..eb7967bf4494 100644 --- a/client/applyconfiguration/hypershift/v1beta1/hostedcontrolplanestatus.go +++ b/client/applyconfiguration/hypershift/v1beta1/hostedcontrolplanestatus.go @@ -44,6 +44,7 @@ type HostedControlPlaneStatusApplyConfiguration struct { NodeCount *int `json:"nodeCount,omitempty"` AutoNode *AutoNodeStatusApplyConfiguration `json:"autoNode,omitempty"` Configuration *ConfigurationStatusApplyConfiguration `json:"configuration,omitempty"` + SecretEncryption *SecretEncryptionStatusApplyConfiguration `json:"secretEncryption,omitempty"` } // HostedControlPlaneStatusApplyConfiguration constructs a declarative configuration of the HostedControlPlaneStatus type for use with @@ -200,3 +201,11 @@ func (b *HostedControlPlaneStatusApplyConfiguration) WithConfiguration(value *Co b.Configuration = value return b } + +// WithSecretEncryption sets the SecretEncryption field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the SecretEncryption field is set to the value of the last call. +func (b *HostedControlPlaneStatusApplyConfiguration) WithSecretEncryption(value *SecretEncryptionStatusApplyConfiguration) *HostedControlPlaneStatusApplyConfiguration { + b.SecretEncryption = value + return b +} diff --git a/client/applyconfiguration/hypershift/v1beta1/ibmcloudkmskeystatus.go b/client/applyconfiguration/hypershift/v1beta1/ibmcloudkmskeystatus.go new file mode 100644 index 000000000000..8c865d62888c --- /dev/null +++ b/client/applyconfiguration/hypershift/v1beta1/ibmcloudkmskeystatus.go @@ -0,0 +1,83 @@ +/* + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1beta1 + +// IBMCloudKMSKeyStatusApplyConfiguration represents a declarative configuration of the IBMCloudKMSKeyStatus type for use +// with apply. +type IBMCloudKMSKeyStatusApplyConfiguration struct { + CRKID *string `json:"crkID,omitempty"` + InstanceID *string `json:"instanceID,omitempty"` + KeyVersion *int32 `json:"keyVersion,omitempty"` + Region *string `json:"region,omitempty"` + CorrelationID *string `json:"correlationID,omitempty"` + URL *string `json:"url,omitempty"` +} + +// IBMCloudKMSKeyStatusApplyConfiguration constructs a declarative configuration of the IBMCloudKMSKeyStatus type for use with +// apply. +func IBMCloudKMSKeyStatus() *IBMCloudKMSKeyStatusApplyConfiguration { + return &IBMCloudKMSKeyStatusApplyConfiguration{} +} + +// WithCRKID sets the CRKID field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the CRKID field is set to the value of the last call. +func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithCRKID(value string) *IBMCloudKMSKeyStatusApplyConfiguration { + b.CRKID = &value + return b +} + +// WithInstanceID sets the InstanceID field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the InstanceID field is set to the value of the last call. +func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithInstanceID(value string) *IBMCloudKMSKeyStatusApplyConfiguration { + b.InstanceID = &value + return b +} + +// WithKeyVersion sets the KeyVersion field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the KeyVersion field is set to the value of the last call. +func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithKeyVersion(value int32) *IBMCloudKMSKeyStatusApplyConfiguration { + b.KeyVersion = &value + return b +} + +// WithRegion sets the Region field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Region field is set to the value of the last call. +func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithRegion(value string) *IBMCloudKMSKeyStatusApplyConfiguration { + b.Region = &value + return b +} + +// WithCorrelationID sets the CorrelationID field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the CorrelationID field is set to the value of the last call. +func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithCorrelationID(value string) *IBMCloudKMSKeyStatusApplyConfiguration { + b.CorrelationID = &value + return b +} + +// WithURL sets the URL field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the URL field is set to the value of the last call. +func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithURL(value string) *IBMCloudKMSKeyStatusApplyConfiguration { + b.URL = &value + return b +} diff --git a/client/applyconfiguration/hypershift/v1beta1/secretencryptionkeystatus.go b/client/applyconfiguration/hypershift/v1beta1/secretencryptionkeystatus.go new file mode 100644 index 000000000000..21174a8ce320 --- /dev/null +++ b/client/applyconfiguration/hypershift/v1beta1/secretencryptionkeystatus.go @@ -0,0 +1,78 @@ +/* + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1beta1 + +import ( + hypershiftv1beta1 "github.com/openshift/hypershift/api/hypershift/v1beta1" +) + +// SecretEncryptionKeyStatusApplyConfiguration represents a declarative configuration of the SecretEncryptionKeyStatus type for use +// with apply. +type SecretEncryptionKeyStatusApplyConfiguration struct { + Provider *hypershiftv1beta1.SecretEncryptionProvider `json:"provider,omitempty"` + Azure *AzureKMSKeyStatusApplyConfiguration `json:"azure,omitempty"` + AWS *AWSKMSKeyStatusApplyConfiguration `json:"aws,omitempty"` + IBMCloud *IBMCloudKMSKeyStatusApplyConfiguration `json:"ibmCloud,omitempty"` + AESCBC *AESCBCKeyStatusApplyConfiguration `json:"aescbc,omitempty"` +} + +// SecretEncryptionKeyStatusApplyConfiguration constructs a declarative configuration of the SecretEncryptionKeyStatus type for use with +// apply. +func SecretEncryptionKeyStatus() *SecretEncryptionKeyStatusApplyConfiguration { + return &SecretEncryptionKeyStatusApplyConfiguration{} +} + +// WithProvider sets the Provider field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Provider field is set to the value of the last call. +func (b *SecretEncryptionKeyStatusApplyConfiguration) WithProvider(value hypershiftv1beta1.SecretEncryptionProvider) *SecretEncryptionKeyStatusApplyConfiguration { + b.Provider = &value + return b +} + +// WithAzure sets the Azure field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Azure field is set to the value of the last call. +func (b *SecretEncryptionKeyStatusApplyConfiguration) WithAzure(value *AzureKMSKeyStatusApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { + b.Azure = value + return b +} + +// WithAWS sets the AWS field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the AWS field is set to the value of the last call. +func (b *SecretEncryptionKeyStatusApplyConfiguration) WithAWS(value *AWSKMSKeyStatusApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { + b.AWS = value + return b +} + +// WithIBMCloud sets the IBMCloud field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the IBMCloud field is set to the value of the last call. +func (b *SecretEncryptionKeyStatusApplyConfiguration) WithIBMCloud(value *IBMCloudKMSKeyStatusApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { + b.IBMCloud = value + return b +} + +// WithAESCBC sets the AESCBC field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the AESCBC field is set to the value of the last call. +func (b *SecretEncryptionKeyStatusApplyConfiguration) WithAESCBC(value *AESCBCKeyStatusApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { + b.AESCBC = value + return b +} diff --git a/client/applyconfiguration/hypershift/v1beta1/secretencryptionstatus.go b/client/applyconfiguration/hypershift/v1beta1/secretencryptionstatus.go new file mode 100644 index 000000000000..1f318e71f7b1 --- /dev/null +++ b/client/applyconfiguration/hypershift/v1beta1/secretencryptionstatus.go @@ -0,0 +1,61 @@ +/* + + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1beta1 + +// SecretEncryptionStatusApplyConfiguration represents a declarative configuration of the SecretEncryptionStatus type for use +// with apply. +type SecretEncryptionStatusApplyConfiguration struct { + ActiveKey *SecretEncryptionKeyStatusApplyConfiguration `json:"activeKey,omitempty"` + TargetKey *SecretEncryptionKeyStatusApplyConfiguration `json:"targetKey,omitempty"` + History []EncryptionMigrationHistoryApplyConfiguration `json:"history,omitempty"` +} + +// SecretEncryptionStatusApplyConfiguration constructs a declarative configuration of the SecretEncryptionStatus type for use with +// apply. +func SecretEncryptionStatus() *SecretEncryptionStatusApplyConfiguration { + return &SecretEncryptionStatusApplyConfiguration{} +} + +// WithActiveKey sets the ActiveKey field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ActiveKey field is set to the value of the last call. +func (b *SecretEncryptionStatusApplyConfiguration) WithActiveKey(value *SecretEncryptionKeyStatusApplyConfiguration) *SecretEncryptionStatusApplyConfiguration { + b.ActiveKey = value + return b +} + +// WithTargetKey sets the TargetKey field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TargetKey field is set to the value of the last call. +func (b *SecretEncryptionStatusApplyConfiguration) WithTargetKey(value *SecretEncryptionKeyStatusApplyConfiguration) *SecretEncryptionStatusApplyConfiguration { + b.TargetKey = value + return b +} + +// WithHistory adds the given value to the History field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the History field. +func (b *SecretEncryptionStatusApplyConfiguration) WithHistory(values ...*EncryptionMigrationHistoryApplyConfiguration) *SecretEncryptionStatusApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithHistory") + } + b.History = append(b.History, *values[i]) + } + return b +} diff --git a/client/applyconfiguration/utils.go b/client/applyconfiguration/utils.go index 5464e88f8024..e2d56550593a 100644 --- a/client/applyconfiguration/utils.go +++ b/client/applyconfiguration/utils.go @@ -65,6 +65,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} { // Group=hypershift.openshift.io, Version=v1beta1 case v1beta1.SchemeGroupVersion.WithKind("AddressPair"): return &hypershiftv1beta1.AddressPairApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("AESCBCKeyStatus"): + return &hypershiftv1beta1.AESCBCKeyStatusApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AESCBCSpec"): return &hypershiftv1beta1.AESCBCSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AgentNodePoolPlatform"): @@ -87,6 +89,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.AWSKMSAuthSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AWSKMSKeyEntry"): return &hypershiftv1beta1.AWSKMSKeyEntryApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("AWSKMSKeyStatus"): + return &hypershiftv1beta1.AWSKMSKeyStatusApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AWSKMSSpec"): return &hypershiftv1beta1.AWSKMSSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AWSNodePoolPlatform"): @@ -111,6 +115,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.AzureAuthenticationConfigurationApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AzureKMSKey"): return &hypershiftv1beta1.AzureKMSKeyApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("AzureKMSKeyStatus"): + return &hypershiftv1beta1.AzureKMSKeyStatusApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AzureKMSSpec"): return &hypershiftv1beta1.AzureKMSSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AzureMarketplaceImage"): @@ -175,6 +181,10 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.DNSSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("DNSZoneStatus"): return &hypershiftv1beta1.DNSZoneStatusApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("EncryptionKeyReference"): + return &hypershiftv1beta1.EncryptionKeyReferenceApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("EncryptionMigrationHistory"): + return &hypershiftv1beta1.EncryptionMigrationHistoryApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("EtcdSpec"): return &hypershiftv1beta1.EtcdSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("EtcdTLSConfig"): @@ -249,6 +259,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.IBMCloudKMSAuthSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("IBMCloudKMSKeyEntry"): return &hypershiftv1beta1.IBMCloudKMSKeyEntryApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("IBMCloudKMSKeyStatus"): + return &hypershiftv1beta1.IBMCloudKMSKeyStatusApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("IBMCloudKMSSpec"): return &hypershiftv1beta1.IBMCloudKMSSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("IBMCloudKMSUnmanagedAuthSpec"): @@ -389,8 +401,12 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.RouterParamApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("ScaleDownConfig"): return &hypershiftv1beta1.ScaleDownConfigApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("SecretEncryptionKeyStatus"): + return &hypershiftv1beta1.SecretEncryptionKeyStatusApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("SecretEncryptionSpec"): return &hypershiftv1beta1.SecretEncryptionSpecApplyConfiguration{} + case v1beta1.SchemeGroupVersion.WithKind("SecretEncryptionStatus"): + return &hypershiftv1beta1.SecretEncryptionStatusApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("SecretReference"): return &hypershiftv1beta1.SecretReferenceApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("ServiceNetworkEntry"): diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml index d406b89a759f..43da88bcb60f 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml @@ -7843,6 +7843,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -7900,6 +7903,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -7954,6 +7960,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -9013,6 +9022,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml index bbafc3f882a8..e3e13d9085f6 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml @@ -6514,6 +6514,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6571,6 +6574,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6625,6 +6631,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7661,6 +7670,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml index 30d17382b0f8..396e8eebb4ac 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -7714,6 +7714,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -7771,6 +7774,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -7825,6 +7831,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -8873,6 +8882,384 @@ spec: type: string type: object type: object + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the status of the release version applied to the diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml index 798d4f0664f8..23dee0c4929a 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml @@ -7698,6 +7698,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -7755,6 +7758,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -7809,6 +7815,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -8833,6 +8842,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml index 5fd583a45ffa..d9f699d90075 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml @@ -6369,6 +6369,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -6426,6 +6429,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -6480,6 +6486,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -7493,6 +7502,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml index 25068f5cf7f6..8b87154523da 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -7569,6 +7569,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: name: default: "" @@ -7626,6 +7629,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: arn: description: arn is the Amazon Resource Name for the @@ -7680,6 +7686,9 @@ spec: description: |- backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key. + + Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + The system automatically manages the previous key via the status field. properties: keyName: description: keyName is the name of the keyvault key @@ -8693,6 +8702,384 @@ spec: Deprecated: Use versionStatus.desired.image instead. maxLength: 255 type: string + secretEncryption: + description: secretEncryption tracks the state of secret encryption + key rotation and re-encryption. + minProperties: 1 + properties: + activeKey: + description: |- + activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + Updated after successful re-encryption. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + history: + description: |- + history contains a list of key rotations applied to this cluster. The newest + entry is first in the list. Entries have state Completed when re-encryption + has finished. The current rotation phase is always history[0].state when + history[0] is not Completed or Interrupted. + items: + description: EncryptionMigrationHistory records a key rotation, + including in-progress rotations. + properties: + completionTime: + description: completionTime is when the rotation finished. + Not set while the rotation is in progress. + format: date-time + type: string + from: + description: from is the key that data was migrated from + (the previous active key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + startedTime: + description: startedTime is when the rotation was initiated. + format: date-time + type: string + state: + description: state tracks the current phase of this rotation. + enum: + - ReadOnlyDeploy + - WritePromote + - Migrating + - Completed + - Interrupted + type: string + to: + description: to is the key that data was migrated to (the + target key). + properties: + fingerprint: + description: fingerprint is the hex-encoded SHA-256 + hash of the key's identity fields. + maxLength: 64 + minLength: 1 + type: string + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - fingerprint + - provider + type: object + required: + - from + - startedTime + - state + - to + type: object + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + targetKey: + description: |- + targetKey is the key being rolled out during an active rotation. Snapshot from + spec.secretEncryption's active key when the rotation starts. The CPO uses this + (not the current spec) during the rotation, so mid-rotation spec changes are + safely queued until the current rotation completes. Cleared when rotation completes. + properties: + aescbc: + description: aescbc holds a reference to the AESCBC key secret. + properties: + dataHash: + description: |- + dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + at the time re-encryption completed. + maxLength: 64 + minLength: 1 + type: string + secret: + description: secret is a reference to the secret containing + the AESCBC key. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + required: + - dataHash + - secret + type: object + aws: + description: aws holds the AWS KMS key identity fields. + properties: + arn: + description: arn is the Amazon Resource Name of the KMS + key. + maxLength: 2048 + minLength: 1 + type: string + region: + description: region is the AWS region of the KMS key. + maxLength: 255 + minLength: 1 + type: string + required: + - arn + - region + type: object + azure: + description: azure holds the Azure KMS key identity fields. + properties: + keyName: + description: keyName is the name of the key in the vault. + maxLength: 255 + minLength: 1 + type: string + keyVaultName: + description: keyVaultName is the name of the Azure Key + Vault. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the version of the key. + maxLength: 255 + minLength: 1 + type: string + required: + - keyName + - keyVaultName + - keyVersion + type: object + ibmCloud: + description: ibmCloud holds the IBM Cloud KMS key identity + fields. + properties: + correlationID: + description: correlationID is the correlation ID for the + key. + maxLength: 255 + minLength: 1 + type: string + crkID: + description: crkID is the Customer Root Key ID. + maxLength: 255 + minLength: 1 + type: string + instanceID: + description: instanceID is the KMS instance ID. + maxLength: 255 + minLength: 1 + type: string + keyVersion: + description: keyVersion is the key version number. + format: int32 + minimum: 0 + type: integer + region: + description: region is the IBM Cloud region. + maxLength: 255 + minLength: 1 + type: string + url: + description: url is the KMS endpoint URL. + maxLength: 2048 + minLength: 1 + type: string + required: + - correlationID + - crkID + - instanceID + - keyVersion + - region + - url + type: object + provider: + description: provider identifies the encryption provider. + enum: + - Azure + - AWS + - IBMCloud + - AESCBC + type: string + required: + - provider + type: object + x-kubernetes-validations: + - message: azure is required when provider is Azure, and forbidden + otherwise + rule: 'self.provider == ''Azure'' ? has(self.azure) : !has(self.azure)' + - message: aws is required when provider is AWS, and forbidden + otherwise + rule: 'self.provider == ''AWS'' ? has(self.aws) : !has(self.aws)' + - message: ibmCloud is required when provider is IBMCloud, and + forbidden otherwise + rule: 'self.provider == ''IBMCloud'' ? has(self.ibmCloud) : + !has(self.ibmCloud)' + - message: aescbc is required when provider is AESCBC, and forbidden + otherwise + rule: 'self.provider == ''AESCBC'' ? has(self.aescbc) : !has(self.aescbc)' + type: object version: description: |- version is the semantic version of the release applied by diff --git a/go.mod b/go.mod index 9f6766e6c333..4842a8107675 100644 --- a/go.mod +++ b/go.mod @@ -125,6 +125,7 @@ require ( sigs.k8s.io/cluster-api-provider-openstack v0.13.3 sigs.k8s.io/controller-runtime v0.22.4 sigs.k8s.io/karpenter v1.9.0 + sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 sigs.k8s.io/secrets-store-csi-driver v1.4.8 sigs.k8s.io/structured-merge-diff/v6 v6.3.2 sigs.k8s.io/yaml v1.6.0 @@ -305,7 +306,6 @@ require ( kubevirt.io/controller-lifecycle-operator-sdk/api v0.2.4 // indirect sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect - sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 // indirect sigs.k8s.io/kustomize/api v0.21.0 // indirect sigs.k8s.io/kustomize/kyaml v0.21.0 // indirect sigs.k8s.io/randfill v1.0.0 // indirect diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go index 3f8f39ede110..a5b9c824274c 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go @@ -1018,6 +1018,9 @@ type AWSKMSSpec struct { ActiveKey AWSKMSKeyEntry `json:"activeKey"` // backupKey defines the old key during the rotation process so previously created // secrets can continue to be decrypted until they are all re-encrypted with the active key. + // + // Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + // The system automatically manages the previous key via the status field. // +optional BackupKey *AWSKMSKeyEntry `json:"backupKey,omitempty"` // auth defines metadata about the management of credentials used to interact with AWS KMS @@ -1082,6 +1085,22 @@ type AWSKMSKeyEntry struct { ARN string `json:"arn"` } +// AWSKMSKeyStatus contains identity fields for an AWS KMS key, sufficient to +// reconstruct the backup sidecar container arguments. +// +k8s:deepcopy-gen=true +type AWSKMSKeyStatus struct { + // arn is the Amazon Resource Name of the KMS key. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + ARN string `json:"arn,omitempty"` + // region is the AWS region of the KMS key. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + Region string `json:"region,omitempty"` +} + // AWSPlatformStatus contains status specific to the AWS platform type AWSPlatformStatus struct { // defaultWorkerSecurityGroupID is the ID of a security group created by diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go index c95773e13bd7..71f7beea32a4 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go @@ -856,6 +856,9 @@ type AzureKMSSpec struct { ActiveKey AzureKMSKey `json:"activeKey"` // backupKey defines the old key during the rotation process so previously created // secrets can continue to be decrypted until they are all re-encrypted with the active key. + // + // Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + // The system automatically manages the previous key via the status field. // +optional BackupKey *AzureKMSKey `json:"backupKey,omitempty"` @@ -902,6 +905,27 @@ type AzureKMSKey struct { KeyVersion string `json:"keyVersion"` } +// AzureKMSKeyStatus contains identity fields for an Azure KMS key, sufficient to +// reconstruct the EncryptionConfiguration read provider. +// +k8s:deepcopy-gen=true +type AzureKMSKeyStatus struct { + // keyVaultName is the name of the Azure Key Vault. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + KeyVaultName string `json:"keyVaultName,omitempty"` + // keyName is the name of the key in the vault. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + KeyName string `json:"keyName,omitempty"` + // keyVersion is the version of the key. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + KeyVersion string `json:"keyVersion,omitempty"` +} + // AzureAuthenticationType is a discriminated union type that contains the Azure authentication configuration for an // Azure Hosted Cluster. This type is used to determine which authentication configuration is being used. Valid values // are "ManagedIdentities" and "WorkloadIdentities". From c9878b4589bc6a7974b90091329a13ba57584b4a Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Thu, 21 May 2026 13:43:08 +0200 Subject: [PATCH 03/12] feat(hypershift-operator): add re-encryption utilities, status bubble-up, and rotation guard VAP - Add support/secretencryption/ package with fingerprint computation, key status construction, and EncryptionConfiguration parsing - Copy EtcdDataEncryptionUpToDate condition from HCP to HostedCluster using the copy-if-present pattern - Copy SecretEncryption status from HCP to HostedCluster - Deploy ValidatingAdmissionPolicy that blocks active key changes while re-encryption is in progress (EtcdDataEncryptionUpToDate=False) Signed-off-by: Mulham Raee Commit-Message-Assisted-by: Claude (via Claude Code) --- .../hostedcluster/hostedcluster_controller.go | 20 +- hypershift-operator/main.go | 73 ++++++ support/config/kms.go | 17 ++ support/secretencryption/encryptionconfig.go | 114 +++++++++ .../secretencryption/encryptionconfig_test.go | 232 ++++++++++++++++++ support/secretencryption/fingerprint.go | 82 +++++++ support/secretencryption/fingerprint_test.go | 131 ++++++++++ support/secretencryption/keystatus.go | 106 ++++++++ support/secretencryption/keystatus_test.go | 85 +++++++ 9 files changed, 857 insertions(+), 3 deletions(-) create mode 100644 support/secretencryption/encryptionconfig.go create mode 100644 support/secretencryption/encryptionconfig_test.go create mode 100644 support/secretencryption/fingerprint.go create mode 100644 support/secretencryption/fingerprint_test.go create mode 100644 support/secretencryption/keystatus.go create mode 100644 support/secretencryption/keystatus_test.go diff --git a/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go b/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go index f7c2deac532f..1a655d07c5d3 100644 --- a/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go +++ b/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go @@ -876,6 +876,11 @@ func (r *HostedClusterReconciler) reconcile(ctx context.Context, req ctrl.Reques hcluster.Status.AutoNode = hcp.Status.AutoNode } + // Copy the secret encryption status from the hostedcontrolplane + if hcp != nil { + hcp.Status.SecretEncryption.DeepCopyInto(&hcluster.Status.SecretEncryption) + } + // Copy the control plane version status from the hostedcontrolplane propagateControlPlaneVersion(hcluster, hcp) @@ -910,6 +915,15 @@ func (r *HostedClusterReconciler) reconcile(ctx context.Context, req ctrl.Reques } } + // Copy the EtcdDataEncryptionUpToDate condition from the HostedControlPlane + if hcp != nil { + encryptionCond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + if encryptionCond != nil { + encryptionCond.ObservedGeneration = hcluster.Generation + meta.SetStatusCondition(&hcluster.Status.Conditions, *encryptionCond) + } + } + // Reconcile unmanaged etcd client tls secret validation error status. Note only update status on validation error case to // provide clear status to the user on the resource without having to look at operator logs. { @@ -1580,10 +1594,10 @@ func (r *HostedClusterReconciler) reconcile(ctx context.Context, req ctrl.Reques if err != nil { return ctrl.Result{}, fmt.Errorf("failed reconciling aescbc active key: %w", err) } - if hcluster.Spec.SecretEncryption.AESCBC.BackupKey != nil && len(hcluster.Spec.SecretEncryption.AESCBC.BackupKey.Name) > 0 { + if hcluster.Spec.SecretEncryption.AESCBC.BackupKey != nil && len(hcluster.Spec.SecretEncryption.AESCBC.BackupKey.Name) > 0 { //nolint:staticcheck var src corev1.Secret - if err := r.Client.Get(ctx, client.ObjectKey{Namespace: hcluster.GetNamespace(), Name: hcluster.Spec.SecretEncryption.AESCBC.BackupKey.Name}, &src); err != nil { - return ctrl.Result{}, fmt.Errorf("failed to get backup aescbc secret %s: %w", hcluster.Spec.SecretEncryption.AESCBC.BackupKey.Name, err) + if err := r.Client.Get(ctx, client.ObjectKey{Namespace: hcluster.GetNamespace(), Name: hcluster.Spec.SecretEncryption.AESCBC.BackupKey.Name}, &src); err != nil { //nolint:staticcheck + return ctrl.Result{}, fmt.Errorf("failed to get backup aescbc secret %s: %w", hcluster.Spec.SecretEncryption.AESCBC.BackupKey.Name, err) //nolint:staticcheck } if err := ensureReferencedResourceAnnotation(ctx, r.Client, hcluster.Name, &src); err != nil { return ctrl.Result{}, fmt.Errorf("failed to set referenced resource annotation: %w", err) diff --git a/hypershift-operator/main.go b/hypershift-operator/main.go index a663242bf0f8..07eb365b6ee2 100644 --- a/hypershift-operator/main.go +++ b/hypershift-operator/main.go @@ -285,6 +285,11 @@ func run(ctx context.Context, opts *StartOptions, log logr.Logger) error { return fmt.Errorf("failed to reconcile deprecation ValidatingAdmissionPolicy: %w", err) } + // Reconcile encryption rotation guard ValidatingAdmissionPolicy if supported + if err := reconcileEncryptionRotationGuardVAP(ctx, apiReadingClient, mgmtClusterCaps, log); err != nil { + return fmt.Errorf("failed to reconcile encryption rotation guard ValidatingAdmissionPolicy: %w", err) + } + registryProvider, err := globalconfig.NewCommonRegistryProvider(ctx, mgmtClusterCaps, apiReadingClient, opts.RegistryOverrides) if err != nil { return fmt.Errorf("failed to create registry provider: %w", err) @@ -1013,3 +1018,71 @@ func reconcileDeprecationValidatingAdmissionPolicy(ctx context.Context, client c log.Info("Successfully reconciled deprecation ValidatingAdmissionPolicy") return nil } + +// reconcileEncryptionRotationGuardVAP reconciles a ValidatingAdmissionPolicy that blocks +// encryption key rotation while re-encryption is in progress (EtcdDataEncryptionUpToDate=False). +func reconcileEncryptionRotationGuardVAP(ctx context.Context, client crclient.Client, mgmtClusterCaps *capabilities.ManagementClusterCapabilities, log logr.Logger) error { + if !mgmtClusterCaps.Has(capabilities.CapabilityValidatingAdmissionPolicy) { + log.Info("ValidatingAdmissionPolicy not supported, skipping encryption rotation guard policy reconciliation") + return nil + } + + log.Info("Reconciling encryption rotation guard ValidatingAdmissionPolicy") + + policy := &admissionregistrationv1.ValidatingAdmissionPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: "hostedcluster-block-key-rotation-during-reencryption", + }, + } + if _, err := controllerutil.CreateOrUpdate(ctx, client, policy, func() error { + policy.Spec.FailurePolicy = ptr.To(admissionregistrationv1.Ignore) + if policy.Spec.MatchConstraints == nil { + policy.Spec.MatchConstraints = &admissionregistrationv1.MatchResources{} + } + policy.Spec.MatchConstraints.ResourceRules = []admissionregistrationv1.NamedRuleWithOperations{ + { + RuleWithOperations: admissionregistrationv1.RuleWithOperations{ + Operations: []admissionregistrationv1.OperationType{ + admissionregistrationv1.Update, + }, + Rule: admissionregistrationv1.Rule{ + APIGroups: []string{"hypershift.openshift.io"}, + APIVersions: []string{"v1beta1"}, + Resources: []string{"hostedclusters"}, + }, + }, + }, + } + // Allow the update if any of: + // 1. No conditions exist yet (new cluster) + // 2. EtcdDataEncryptionUpToDate is not False (no re-encryption in progress) + // 3. secretEncryption spec is unchanged between old and new object + policy.Spec.Validations = []admissionregistrationv1.Validation{ + { + Expression: `!has(object.status.conditions) || !object.status.conditions.exists(c, c.type == 'EtcdDataEncryptionUpToDate' && c.status == 'False') || (!has(object.spec.secretEncryption) && !has(oldObject.spec.secretEncryption)) || (has(object.spec.secretEncryption) && has(oldObject.spec.secretEncryption) && object.spec.secretEncryption == oldObject.spec.secretEncryption)`, + Message: "Cannot change the active encryption key while re-encryption is in progress (EtcdDataEncryptionUpToDate=False). Wait for re-encryption to complete before rotating again.", + }, + } + return nil + }); err != nil { + return fmt.Errorf("failed to reconcile encryption rotation guard ValidatingAdmissionPolicy: %w", err) + } + + binding := &admissionregistrationv1.ValidatingAdmissionPolicyBinding{ + ObjectMeta: metav1.ObjectMeta{ + Name: policy.Name, + }, + } + if _, err := controllerutil.CreateOrUpdate(ctx, client, binding, func() error { + binding.Spec.PolicyName = policy.Name + binding.Spec.ValidationActions = []admissionregistrationv1.ValidationAction{ + admissionregistrationv1.Deny, + } + return nil + }); err != nil { + return fmt.Errorf("failed to reconcile encryption rotation guard ValidatingAdmissionPolicyBinding: %w", err) + } + + log.Info("Successfully reconciled encryption rotation guard ValidatingAdmissionPolicy") + return nil +} diff --git a/support/config/kms.go b/support/config/kms.go index 44d51da9f202..50ee2bac676c 100644 --- a/support/config/kms.go +++ b/support/config/kms.go @@ -1,5 +1,10 @@ package config +// KMSEncryptedObjects returns the resources declared in the KAS EncryptionConfiguration. +// TODO(https://github.com/openshift/enhancements/pull/1969#discussion_r3192690488): +// routes, oauthaccesstokens, and oauthauthorizetokens are listed here but are +// not actually encrypted today because the OpenShift API servers lack KMS +// sidecars. func KMSEncryptedObjects() []string { return []string{ "secrets", @@ -9,3 +14,15 @@ func KMSEncryptedObjects() []string { "oauthauthorizetokens.oauth.openshift.io", } } + +// AESCBCEncryptedObjects returns the resources declared in the KAS EncryptionConfiguration +// for AESCBC encryption. +// TODO(https://github.com/openshift/enhancements/pull/1969#discussion_r3192690488): +// AESCBC currently only encrypts secrets; configmaps are not covered. This +// should be expanded to match the full set of sensitive resources once the +// encryption scope is broadened. +func AESCBCEncryptedObjects() []string { + return []string{ + "secrets", + } +} diff --git a/support/secretencryption/encryptionconfig.go b/support/secretencryption/encryptionconfig.go new file mode 100644 index 000000000000..b7bd57e45c02 --- /dev/null +++ b/support/secretencryption/encryptionconfig.go @@ -0,0 +1,114 @@ +package secretencryption + +import ( + "fmt" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/serializer/json" + apiserverv1 "k8s.io/apiserver/pkg/apis/apiserver/v1" +) + +const ( + // EncryptionConfigurationKey is the data key used in the Secret that holds the EncryptionConfiguration YAML. + EncryptionConfigurationKey = "config.yaml" + + // EncryptionConfigurationKind is the Kind used in EncryptionConfiguration manifests. + EncryptionConfigurationKind = "EncryptionConfiguration" +) + +var ( + encScheme = runtime.NewScheme() + yamlDecoder runtime.Decoder +) + +func init() { + _ = apiserverv1.AddToScheme(encScheme) + yamlDecoder = json.NewSerializerWithOptions(json.DefaultMetaFactory, encScheme, encScheme, json.SerializerOptions{Yaml: true}) +} + +// DecodeEncryptionConfiguration parses raw YAML bytes into an EncryptionConfiguration. +func DecodeEncryptionConfiguration(data []byte) (*apiserverv1.EncryptionConfiguration, error) { + cfg := &apiserverv1.EncryptionConfiguration{} + gvks, _, err := encScheme.ObjectKinds(cfg) + if err != nil || len(gvks) == 0 { + return nil, fmt.Errorf("cannot determine gvk: %w", err) + } + if _, _, err := yamlDecoder.Decode(data, &gvks[0], cfg); err != nil { + return nil, fmt.Errorf("cannot decode EncryptionConfiguration: %w", err) + } + return cfg, nil +} + +// TargetKeyRole represents where the target key appears in the EncryptionConfiguration. +type TargetKeyRole int + +const ( + TargetKeyAbsent TargetKeyRole = iota // target key not in config + TargetKeyReadOnly // target key is a read-only provider (not first) + TargetKeyWrite // target key is the write provider (first) +) + +// FindKeyRole locates the target key name in the EncryptionConfiguration and +// returns its role. For KMS, each key is a separate provider entry; the first +// KMS provider is the write key. For AESCBC, keys are entries inside a single +// AESCBC provider; the first key is the write key. +func FindKeyRole(cfg *apiserverv1.EncryptionConfiguration, targetName string, encType hyperv1.SecretEncryptionType) TargetKeyRole { + if cfg == nil || len(cfg.Resources) == 0 { + return TargetKeyAbsent + } + providers := cfg.Resources[0].Providers + + switch encType { + case hyperv1.KMS: + kmsIndex := -1 + firstKMSIndex := -1 + for i, p := range providers { + if p.KMS != nil { + if firstKMSIndex == -1 { + firstKMSIndex = i + } + if p.KMS.Name == targetName { + kmsIndex = i + break + } + } + } + if kmsIndex == -1 { + return TargetKeyAbsent + } + if kmsIndex == firstKMSIndex { + return TargetKeyWrite + } + return TargetKeyReadOnly + + case hyperv1.AESCBC: + for _, p := range providers { + if p.AESCBC != nil { + for j, key := range p.AESCBC.Keys { + if key.Name == targetName { + if j == 0 { + return TargetKeyWrite + } + return TargetKeyReadOnly + } + } + } + } + return TargetKeyAbsent + } + + return TargetKeyAbsent +} + +// ShouldPromoteTargetKey determines whether the target key should be promoted +// to write provider based on the current EncryptionConfiguration and KAS +// convergence state. +// +// Returns true when the target key should be the write key (WritePromote/Migrating stage). +// Returns false when the old key should remain the write key (ReadOnlyDeploy stage). +func ShouldPromoteTargetKey(cfg *apiserverv1.EncryptionConfiguration, targetName string, encType hyperv1.SecretEncryptionType, kasConverged bool) bool { + role := FindKeyRole(cfg, targetName, encType) + return role == TargetKeyWrite || (role == TargetKeyReadOnly && kasConverged) +} diff --git a/support/secretencryption/encryptionconfig_test.go b/support/secretencryption/encryptionconfig_test.go new file mode 100644 index 000000000000..6d631f7f3ef2 --- /dev/null +++ b/support/secretencryption/encryptionconfig_test.go @@ -0,0 +1,232 @@ +package secretencryption + +import ( + "testing" + + . "github.com/onsi/gomega" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + + apiserverv1 "k8s.io/apiserver/pkg/apis/apiserver/v1" +) + +func kmsConfig(providers ...apiserverv1.ProviderConfiguration) *apiserverv1.EncryptionConfiguration { + return &apiserverv1.EncryptionConfiguration{ + Resources: []apiserverv1.ResourceConfiguration{ + {Providers: providers}, + }, + } +} + +func kmsProvider(name string) apiserverv1.ProviderConfiguration { + return apiserverv1.ProviderConfiguration{ + KMS: &apiserverv1.KMSConfiguration{Name: name, APIVersion: "v2"}, + } +} + +func identityProvider() apiserverv1.ProviderConfiguration { + return apiserverv1.ProviderConfiguration{ + Identity: &apiserverv1.IdentityConfiguration{}, + } +} + +func aescbcProvider(keys ...apiserverv1.Key) apiserverv1.ProviderConfiguration { + return apiserverv1.ProviderConfiguration{ + AESCBC: &apiserverv1.AESConfiguration{Keys: keys}, + } +} + +func aescbcKey(name string) apiserverv1.Key { + return apiserverv1.Key{Name: name, Secret: "dW51c2Vk"} +} + +func TestFindKeyRole(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + cfg *apiserverv1.EncryptionConfiguration + targetName string + encType hyperv1.SecretEncryptionType + expected TargetKeyRole + }{ + { + name: "When config is nil it should return TargetKeyAbsent", + cfg: nil, + targetName: "target", + encType: hyperv1.KMS, + expected: TargetKeyAbsent, + }, + { + name: "When config has no resources it should return TargetKeyAbsent", + cfg: &apiserverv1.EncryptionConfiguration{}, + targetName: "target", + encType: hyperv1.KMS, + expected: TargetKeyAbsent, + }, + { + name: "When KMS target key is the first provider it should return TargetKeyWrite", + cfg: kmsConfig(kmsProvider("target-key"), kmsProvider("old-key"), identityProvider()), + targetName: "target-key", + encType: hyperv1.KMS, + expected: TargetKeyWrite, + }, + { + name: "When KMS target key is the second provider it should return TargetKeyReadOnly", + cfg: kmsConfig(kmsProvider("old-key"), kmsProvider("target-key"), identityProvider()), + targetName: "target-key", + encType: hyperv1.KMS, + expected: TargetKeyReadOnly, + }, + { + name: "When KMS target key is not in config it should return TargetKeyAbsent", + cfg: kmsConfig(kmsProvider("old-key"), identityProvider()), + targetName: "target-key", + encType: hyperv1.KMS, + expected: TargetKeyAbsent, + }, + { + name: "When KMS target key is the only provider it should return TargetKeyWrite", + cfg: kmsConfig(kmsProvider("target-key"), identityProvider()), + targetName: "target-key", + encType: hyperv1.KMS, + expected: TargetKeyWrite, + }, + { + name: "When KMS has identity before KMS providers it should still find write correctly", + cfg: kmsConfig(identityProvider(), kmsProvider("target-key"), kmsProvider("old-key")), + targetName: "target-key", + encType: hyperv1.KMS, + expected: TargetKeyWrite, + }, + { + name: "When AESCBC target key is the first key it should return TargetKeyWrite", + cfg: kmsConfig(aescbcProvider(aescbcKey("target-key"), aescbcKey("old-key")), identityProvider()), + targetName: "target-key", + encType: hyperv1.AESCBC, + expected: TargetKeyWrite, + }, + { + name: "When AESCBC target key is the second key it should return TargetKeyReadOnly", + cfg: kmsConfig(aescbcProvider(aescbcKey("old-key"), aescbcKey("target-key")), identityProvider()), + targetName: "target-key", + encType: hyperv1.AESCBC, + expected: TargetKeyReadOnly, + }, + { + name: "When AESCBC target key is not present it should return TargetKeyAbsent", + cfg: kmsConfig(aescbcProvider(aescbcKey("old-key")), identityProvider()), + targetName: "target-key", + encType: hyperv1.AESCBC, + expected: TargetKeyAbsent, + }, + { + name: "When AESCBC target key is the only key it should return TargetKeyWrite", + cfg: kmsConfig(aescbcProvider(aescbcKey("target-key")), identityProvider()), + targetName: "target-key", + encType: hyperv1.AESCBC, + expected: TargetKeyWrite, + }, + { + name: "When encryption type is unrecognized it should return TargetKeyAbsent", + cfg: kmsConfig(kmsProvider("target-key")), + targetName: "target-key", + encType: hyperv1.SecretEncryptionType("unknown"), + expected: TargetKeyAbsent, + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + g := NewWithT(t) + g.Expect(FindKeyRole(tc.cfg, tc.targetName, tc.encType)).To(Equal(tc.expected)) + }) + } +} + +func TestShouldPromoteTargetKey(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + cfg *apiserverv1.EncryptionConfiguration + targetName string + encType hyperv1.SecretEncryptionType + kasConverged bool + expected bool + }{ + { + name: "When target key is absent it should not promote", + cfg: kmsConfig(kmsProvider("old-key"), identityProvider()), + targetName: "target-key", + encType: hyperv1.KMS, + kasConverged: true, + expected: false, + }, + { + name: "When target key is already write it should promote regardless of convergence", + cfg: kmsConfig(kmsProvider("target-key"), kmsProvider("old-key"), identityProvider()), + targetName: "target-key", + encType: hyperv1.KMS, + kasConverged: false, + expected: true, + }, + { + name: "When target key is read-only and KAS is converged it should promote", + cfg: kmsConfig(kmsProvider("old-key"), kmsProvider("target-key"), identityProvider()), + targetName: "target-key", + encType: hyperv1.KMS, + kasConverged: true, + expected: true, + }, + { + name: "When target key is read-only and KAS is not converged it should not promote", + cfg: kmsConfig(kmsProvider("old-key"), kmsProvider("target-key"), identityProvider()), + targetName: "target-key", + encType: hyperv1.KMS, + kasConverged: false, + expected: false, + }, + { + name: "When config is nil it should not promote", + cfg: nil, + targetName: "target-key", + encType: hyperv1.KMS, + kasConverged: true, + expected: false, + }, + { + name: "When AESCBC target key is write it should promote", + cfg: kmsConfig(aescbcProvider(aescbcKey("target-key"), aescbcKey("old-key")), identityProvider()), + targetName: "target-key", + encType: hyperv1.AESCBC, + kasConverged: false, + expected: true, + }, + { + name: "When AESCBC target key is read-only and KAS converged it should promote", + cfg: kmsConfig(aescbcProvider(aescbcKey("old-key"), aescbcKey("target-key")), identityProvider()), + targetName: "target-key", + encType: hyperv1.AESCBC, + kasConverged: true, + expected: true, + }, + { + name: "When AESCBC target key is read-only and KAS not converged it should not promote", + cfg: kmsConfig(aescbcProvider(aescbcKey("old-key"), aescbcKey("target-key")), identityProvider()), + targetName: "target-key", + encType: hyperv1.AESCBC, + kasConverged: false, + expected: false, + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + g := NewWithT(t) + g.Expect(ShouldPromoteTargetKey(tc.cfg, tc.targetName, tc.encType, tc.kasConverged)).To(Equal(tc.expected)) + }) + } +} diff --git a/support/secretencryption/fingerprint.go b/support/secretencryption/fingerprint.go new file mode 100644 index 000000000000..a8fff49955fa --- /dev/null +++ b/support/secretencryption/fingerprint.go @@ -0,0 +1,82 @@ +package secretencryption + +import ( + "crypto/sha256" + "fmt" + "strings" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" +) + +// DataHash computes the hex-encoded SHA-256 hash of raw data. +func DataHash(data []byte) string { + h := sha256.Sum256(data) + return fmt.Sprintf("%x", h) +} + +// FingerprintAzureKMSKey computes the SHA-256 fingerprint for an Azure KMS key. +func FingerprintAzureKMSKey(key hyperv1.AzureKMSKey) string { + return DataHash([]byte(key.KeyVaultName + "/" + key.KeyName + "/" + key.KeyVersion)) +} + +// FingerprintAWSKMSKey computes the SHA-256 fingerprint for an AWS KMS key. +func FingerprintAWSKMSKey(arn string) string { + return DataHash([]byte(arn)) +} + +// FingerprintIBMCloudKMSKeyList computes the SHA-256 fingerprint for an IBM Cloud KMS key list. +// Only identity-relevant fields are included; CorrelationID and URL are excluded. +func FingerprintIBMCloudKMSKeyList(entries []hyperv1.IBMCloudKMSKeyEntry) string { + parts := make([]string, len(entries)) + for i, e := range entries { + parts[i] = e.CRKID + "/" + e.InstanceID + "/" + fmt.Sprintf("%d", e.KeyVersion) + } + return DataHash([]byte(strings.Join(parts, ";"))) +} + +// FingerprintAESCBCKey computes the SHA-256 fingerprint for an AESCBC key. +// The dataHash parameter should be the hex-encoded SHA-256 of the secret's "key" data field. +func FingerprintAESCBCKey(secretName string, dataHash string) string { + return DataHash([]byte(secretName + "/" + dataHash)) +} + +// FingerprintFromKeyStatus computes the fingerprint from a SecretEncryptionKeyStatus. +func FingerprintFromKeyStatus(status *hyperv1.SecretEncryptionKeyStatus) string { + if status == nil { + return "" + } + switch status.Provider { + case hyperv1.SecretEncryptionProviderAzure: + if status.Azure.KeyVaultName == "" { + return "" + } + return FingerprintAzureKMSKey(hyperv1.AzureKMSKey{ + KeyVaultName: status.Azure.KeyVaultName, + KeyName: status.Azure.KeyName, + KeyVersion: status.Azure.KeyVersion, + }) + case hyperv1.SecretEncryptionProviderAWS: + if status.AWS.ARN == "" { + return "" + } + return FingerprintAWSKMSKey(status.AWS.ARN) + case hyperv1.SecretEncryptionProviderIBMCloud: + if status.IBMCloud.CRKID == "" { + return "" + } + return FingerprintIBMCloudKMSKeyList([]hyperv1.IBMCloudKMSKeyEntry{ + { + CRKID: status.IBMCloud.CRKID, + InstanceID: status.IBMCloud.InstanceID, + KeyVersion: int(status.IBMCloud.KeyVersion), + }, + }) + case hyperv1.SecretEncryptionProviderAESCBC: + if status.AESCBC.DataHash == "" { + return "" + } + return FingerprintAESCBCKey(status.AESCBC.Secret.Name, status.AESCBC.DataHash) + default: + return "" + } +} diff --git a/support/secretencryption/fingerprint_test.go b/support/secretencryption/fingerprint_test.go new file mode 100644 index 000000000000..ae1bbc109439 --- /dev/null +++ b/support/secretencryption/fingerprint_test.go @@ -0,0 +1,131 @@ +package secretencryption + +import ( + "testing" + + . "github.com/onsi/gomega" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" +) + +func TestFingerprintAzureKMSKey(t *testing.T) { + t.Parallel() + t.Run("When computing Azure KMS fingerprint it should be deterministic", func(t *testing.T) { + g := NewWithT(t) + key := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"} + fp1 := FingerprintAzureKMSKey(key) + fp2 := FingerprintAzureKMSKey(key) + g.Expect(fp1).To(Equal(fp2)) + g.Expect(fp1).ToNot(BeEmpty()) + }) + + t.Run("When Azure KMS key version changes it should produce a different fingerprint", func(t *testing.T) { + g := NewWithT(t) + key1 := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"} + key2 := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"} + g.Expect(FingerprintAzureKMSKey(key1)).ToNot(Equal(FingerprintAzureKMSKey(key2))) + }) +} + +func TestFingerprintAWSKMSKey(t *testing.T) { + t.Parallel() + t.Run("When computing AWS KMS fingerprint it should hash the ARN", func(t *testing.T) { + g := NewWithT(t) + fp := FingerprintAWSKMSKey("arn:aws:kms:us-east-1:123456789:key/test-key") + g.Expect(fp).ToNot(BeEmpty()) + g.Expect(fp).To(Equal(FingerprintAWSKMSKey("arn:aws:kms:us-east-1:123456789:key/test-key"))) + }) + + t.Run("When AWS KMS ARN changes it should produce a different fingerprint", func(t *testing.T) { + g := NewWithT(t) + fp1 := FingerprintAWSKMSKey("arn:aws:kms:us-east-1:123456789:key/key-1") + fp2 := FingerprintAWSKMSKey("arn:aws:kms:us-east-1:123456789:key/key-2") + g.Expect(fp1).ToNot(Equal(fp2)) + }) +} + +func TestFingerprintIBMCloudKMSKeyList(t *testing.T) { + t.Parallel() + t.Run("When computing IBM Cloud fingerprint it should use CRK ID, instance ID, and key version", func(t *testing.T) { + g := NewWithT(t) + entries := []hyperv1.IBMCloudKMSKeyEntry{ + {CRKID: "crk1", InstanceID: "inst1", KeyVersion: 1, CorrelationID: "corr1", URL: "https://kms.example.com"}, + } + fp := FingerprintIBMCloudKMSKeyList(entries) + g.Expect(fp).ToNot(BeEmpty()) + }) + + t.Run("When IBM Cloud metadata changes but identity stays same it should produce same fingerprint", func(t *testing.T) { + g := NewWithT(t) + entries1 := []hyperv1.IBMCloudKMSKeyEntry{ + {CRKID: "crk1", InstanceID: "inst1", KeyVersion: 1, CorrelationID: "corr1", URL: "https://url1.com"}, + } + entries2 := []hyperv1.IBMCloudKMSKeyEntry{ + {CRKID: "crk1", InstanceID: "inst1", KeyVersion: 1, CorrelationID: "corr2", URL: "https://url2.com"}, + } + g.Expect(FingerprintIBMCloudKMSKeyList(entries1)).To(Equal(FingerprintIBMCloudKMSKeyList(entries2))) + }) + + t.Run("When IBM Cloud key version changes it should produce a different fingerprint", func(t *testing.T) { + g := NewWithT(t) + entries1 := []hyperv1.IBMCloudKMSKeyEntry{ + {CRKID: "crk1", InstanceID: "inst1", KeyVersion: 1}, + } + entries2 := []hyperv1.IBMCloudKMSKeyEntry{ + {CRKID: "crk1", InstanceID: "inst1", KeyVersion: 2}, + } + g.Expect(FingerprintIBMCloudKMSKeyList(entries1)).ToNot(Equal(FingerprintIBMCloudKMSKeyList(entries2))) + }) +} + +func TestFingerprintAESCBCKey(t *testing.T) { + t.Parallel() + t.Run("When computing AESCBC fingerprint it should combine secret name and data hash", func(t *testing.T) { + g := NewWithT(t) + fp := FingerprintAESCBCKey("my-secret", "abc123") + g.Expect(fp).ToNot(BeEmpty()) + g.Expect(fp).To(Equal(FingerprintAESCBCKey("my-secret", "abc123"))) + }) + + t.Run("When AESCBC secret name changes it should produce a different fingerprint", func(t *testing.T) { + g := NewWithT(t) + fp1 := FingerprintAESCBCKey("secret-1", "abc123") + fp2 := FingerprintAESCBCKey("secret-2", "abc123") + g.Expect(fp1).ToNot(Equal(fp2)) + }) + + t.Run("When AESCBC data hash changes it should produce a different fingerprint", func(t *testing.T) { + g := NewWithT(t) + fp1 := FingerprintAESCBCKey("my-secret", "hash1") + fp2 := FingerprintAESCBCKey("my-secret", "hash2") + g.Expect(fp1).ToNot(Equal(fp2)) + }) +} + +func TestFingerprintFromKeyStatus(t *testing.T) { + t.Parallel() + t.Run("When status is nil it should return empty string", func(t *testing.T) { + g := NewWithT(t) + g.Expect(FingerprintFromKeyStatus(nil)).To(BeEmpty()) + }) + + t.Run("When Azure status is provided it should match spec fingerprint", func(t *testing.T) { + g := NewWithT(t) + key := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"} + status := &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKeyStatus{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, + } + g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintAzureKMSKey(key))) + }) + + t.Run("When AWS status is provided it should match spec fingerprint", func(t *testing.T) { + g := NewWithT(t) + arn := "arn:aws:kms:us-east-1:123:key/test" + status := &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAWS, + AWS: hyperv1.AWSKMSKeyStatus{ARN: arn, Region: "us-east-1"}, + } + g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintAWSKMSKey(arn))) + }) +} diff --git a/support/secretencryption/keystatus.go b/support/secretencryption/keystatus.go new file mode 100644 index 000000000000..661fa741ebec --- /dev/null +++ b/support/secretencryption/keystatus.go @@ -0,0 +1,106 @@ +package secretencryption + +import ( + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + + corev1 "k8s.io/api/core/v1" +) + +// KeyStatusFromAzureSpec creates a SecretEncryptionKeyStatus from an Azure KMS key spec. +func KeyStatusFromAzureSpec(key hyperv1.AzureKMSKey) *hyperv1.SecretEncryptionKeyStatus { + return &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKeyStatus(key), + } +} + +// KeyStatusFromAWSSpec creates a SecretEncryptionKeyStatus from an AWS KMS key spec. +func KeyStatusFromAWSSpec(key hyperv1.AWSKMSKeyEntry, region string) *hyperv1.SecretEncryptionKeyStatus { + return &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAWS, + AWS: hyperv1.AWSKMSKeyStatus{ + ARN: key.ARN, + Region: region, + }, + } +} + +// KeyStatusFromIBMCloudSpec creates a SecretEncryptionKeyStatus from IBM Cloud KMS key entries. +// Uses the first entry in the key list as the representative key. +func KeyStatusFromIBMCloudSpec(entries []hyperv1.IBMCloudKMSKeyEntry, region string) *hyperv1.SecretEncryptionKeyStatus { + if len(entries) == 0 { + return nil + } + e := entries[0] + return &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderIBMCloud, + IBMCloud: hyperv1.IBMCloudKMSKeyStatus{ + CRKID: e.CRKID, + InstanceID: e.InstanceID, + KeyVersion: int32(e.KeyVersion), + Region: region, + CorrelationID: e.CorrelationID, + URL: e.URL, + }, + } +} + +// KeyStatusFromAESCBCSpec creates a SecretEncryptionKeyStatus from an AESCBC spec. +func KeyStatusFromAESCBCSpec(secretRef corev1.LocalObjectReference, dataHash string) *hyperv1.SecretEncryptionKeyStatus { + return &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAESCBC, + AESCBC: hyperv1.AESCBCKeyStatus{ + Secret: secretRef, + DataHash: dataHash, + }, + } +} + +// KeyStatusFromSpec creates a SecretEncryptionKeyStatus from a SecretEncryptionSpec. +// For AESCBC, the caller must provide the dataHash (SHA-256 of the secret's "key" data field). +func KeyStatusFromSpec(spec *hyperv1.SecretEncryptionSpec, aescbcDataHash string) *hyperv1.SecretEncryptionKeyStatus { + if spec == nil { + return nil + } + switch spec.Type { + case hyperv1.KMS: + if spec.KMS == nil { + return nil + } + switch spec.KMS.Provider { + case hyperv1.AZURE: + if spec.KMS.Azure == nil { + return nil + } + return KeyStatusFromAzureSpec(spec.KMS.Azure.ActiveKey) + case hyperv1.AWS: + if spec.KMS.AWS == nil { + return nil + } + return KeyStatusFromAWSSpec(spec.KMS.AWS.ActiveKey, spec.KMS.AWS.Region) + case hyperv1.IBMCloud: + if spec.KMS.IBMCloud == nil { + return nil + } + return KeyStatusFromIBMCloudSpec(spec.KMS.IBMCloud.KeyList, spec.KMS.IBMCloud.Region) + } + case hyperv1.AESCBC: + if spec.AESCBC == nil { + return nil + } + return KeyStatusFromAESCBCSpec(spec.AESCBC.ActiveKey, aescbcDataHash) + } + return nil +} + +// KeyReferenceFromStatus extracts an EncryptionKeyReference from a SecretEncryptionKeyStatus. +func KeyReferenceFromStatus(status *hyperv1.SecretEncryptionKeyStatus) hyperv1.EncryptionKeyReference { + if status == nil { + return hyperv1.EncryptionKeyReference{} + } + fp := FingerprintFromKeyStatus(status) + return hyperv1.EncryptionKeyReference{ + Provider: status.Provider, + Fingerprint: fp, + } +} diff --git a/support/secretencryption/keystatus_test.go b/support/secretencryption/keystatus_test.go new file mode 100644 index 000000000000..9827f3a14ed7 --- /dev/null +++ b/support/secretencryption/keystatus_test.go @@ -0,0 +1,85 @@ +package secretencryption + +import ( + "testing" + + . "github.com/onsi/gomega" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + + corev1 "k8s.io/api/core/v1" +) + +func TestKeyStatusFromAzureSpec(t *testing.T) { + t.Parallel() + t.Run("When creating key status from Azure spec it should populate all fields", func(t *testing.T) { + g := NewWithT(t) + key := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"} + status := KeyStatusFromAzureSpec(key) + g.Expect(status.Provider).To(Equal(hyperv1.SecretEncryptionProviderAzure)) + g.Expect(status.Azure).ToNot(BeNil()) + g.Expect(status.Azure.KeyVaultName).To(Equal("vault")) + g.Expect(status.Azure.KeyName).To(Equal("key")) + g.Expect(status.Azure.KeyVersion).To(Equal("v1")) + }) +} + +func TestKeyStatusFromSpec(t *testing.T) { + t.Parallel() + t.Run("When spec is nil it should return nil", func(t *testing.T) { + g := NewWithT(t) + g.Expect(KeyStatusFromSpec(nil, "")).To(BeNil()) + }) + + t.Run("When spec is Azure KMS it should create Azure key status", func(t *testing.T) { + g := NewWithT(t) + spec := &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.KMS, + KMS: &hyperv1.KMSSpec{ + Provider: hyperv1.AZURE, + Azure: &hyperv1.AzureKMSSpec{ + ActiveKey: hyperv1.AzureKMSKey{KeyVaultName: "v", KeyName: "k", KeyVersion: "1"}, + }, + }, + } + status := KeyStatusFromSpec(spec, "") + g.Expect(status).ToNot(BeNil()) + g.Expect(status.Provider).To(Equal(hyperv1.SecretEncryptionProviderAzure)) + }) + + t.Run("When spec is AESCBC it should create AESCBC key status with data hash", func(t *testing.T) { + g := NewWithT(t) + spec := &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.AESCBC, + AESCBC: &hyperv1.AESCBCSpec{ + ActiveKey: corev1.LocalObjectReference{Name: "my-secret"}, + }, + } + status := KeyStatusFromSpec(spec, "deadbeef") + g.Expect(status).ToNot(BeNil()) + g.Expect(status.Provider).To(Equal(hyperv1.SecretEncryptionProviderAESCBC)) + g.Expect(status.AESCBC.Secret.Name).To(Equal("my-secret")) + g.Expect(status.AESCBC.DataHash).To(Equal("deadbeef")) + }) +} + +func TestKeyReferenceFromStatus(t *testing.T) { + t.Parallel() + t.Run("When status is nil it should return empty reference", func(t *testing.T) { + g := NewWithT(t) + ref := KeyReferenceFromStatus(nil) + g.Expect(ref.Provider).To(BeEmpty()) + g.Expect(ref.Fingerprint).To(BeEmpty()) + }) + + t.Run("When status is Azure it should return correct provider and fingerprint", func(t *testing.T) { + g := NewWithT(t) + status := &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKeyStatus{KeyVaultName: "v", KeyName: "k", KeyVersion: "1"}, + } + ref := KeyReferenceFromStatus(status) + g.Expect(ref.Provider).To(Equal(hyperv1.SecretEncryptionProviderAzure)) + g.Expect(ref.Fingerprint).ToNot(BeEmpty()) + }) +} From 96c1fc4e65be07900713000e0538afada5218d0f Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Thu, 21 May 2026 13:52:25 +0200 Subject: [PATCH 04/12] feat(control-plane-operator): implement two-stage encryption key rollout and deploy migrator Two-stage KAS encryption key rollout: - Rewrite adaptSecretEncryptionConfig to derive write/read key assignment from HCP status and live EncryptionConfiguration - ReadOnlyDeploy: old key writes, new key read-only - WritePromote: new key writes once in config and KAS converged - Extract AWSKMSProviderName, AzureKMSProviderName, AESCBCKeyName as shared functions for provider name computation - Add --encryption-provider-config-automatic-reload=false for Azure KMS Control plane kube-storage-version-migrator: - New CPOv2 component with platform predicate (skip IBM/PowerVS) - Add data-plane migrator deployments to CVO resourcesToRemove Signed-off-by: Mulham Raee Commit-Message-Assisted-by: Claude (via Claude Code) --- .../hostedcontrolplane_controller.go | 2 + ...s_cluster_version_operator_deployment.yaml | 18 + ...s_cluster_version_operator_deployment.yaml | 18 + ...s_cluster_version_operator_deployment.yaml | 18 + ...s_cluster_version_operator_deployment.yaml | 18 + ...eComponents_kube_apiserver_deployment.yaml | 1 + ...ersion_migrator_controlplanecomponent.yaml | 20 ++ ...e_storage_version_migrator_deployment.yaml | 117 +++++++ ...ersion_migrator_controlplanecomponent.yaml | 20 ++ ...e_storage_version_migrator_deployment.yaml | 118 +++++++ ...ersion_migrator_controlplanecomponent.yaml | 20 ++ ...e_storage_version_migrator_deployment.yaml | 117 +++++++ ...ersion_migrator_controlplanecomponent.yaml | 20 ++ ...e_storage_version_migrator_deployment.yaml | 117 +++++++ ...ersion_migrator_controlplanecomponent.yaml | 20 ++ ...e_storage_version_migrator_deployment.yaml | 117 +++++++ .../deployment.yaml | 56 +++ .../hostedcontrolplane/v2/cvo/deployment.go | 2 + .../hostedcontrolplane/v2/kas/aescbc.go | 25 +- .../hostedcontrolplane/v2/kas/deployment.go | 18 +- .../hostedcontrolplane/v2/kas/kms.go | 154 ++++++++- .../hostedcontrolplane/v2/kas/kms/aws.go | 32 +- .../hostedcontrolplane/v2/kas/kms/aws_test.go | 161 ++++----- .../hostedcontrolplane/v2/kas/kms/azure.go | 37 +- .../v2/kas/kms/azure_test.go | 48 +-- .../hostedcontrolplane/v2/kas/kms/ibmcloud.go | 10 +- .../hostedcontrolplane/v2/kas/kms/kms.go | 4 +- .../hostedcontrolplane/v2/kas/kms_test.go | 176 ++++++++++ .../v2/kas/secretencryption.go | 198 +++++++---- .../v2/kas/secretencryption_test.go | 320 +++++++++++++++++- .../component.go | 43 +++ 31 files changed, 1837 insertions(+), 208 deletions(-) create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/AROSwift/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/AROSwift/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/GCP/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/GCP/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-storage-version-migrator/deployment.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/kube_storage_version_migrator/component.go diff --git a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go index 5861a1fda10d..068c4d90c16f 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go +++ b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go @@ -52,6 +52,7 @@ import ( kcmv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/kcm" konnectivityv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/konnectivity_agent" schedulerv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler" + kubestorageversionmigratorv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/kube_storage_version_migrator" machineapproverv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/machine_approver" metricsproxyv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/metrics_proxy" ntov2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/nto" @@ -276,6 +277,7 @@ func (r *HostedControlPlaneReconciler) registerComponents(hcp *hyperv1.HostedCon ignitionproxyv2.NewComponent(r.DefaultIngressDomain), endpointresolverv2.NewComponent(), metricsproxyv2.NewComponent(r.DefaultIngressDomain), + kubestorageversionmigratorv2.NewComponent(), ) r.components = append(r.components, olmv2.NewComponents(r.ManagementClusterCapabilities.Has(capabilities.CapabilityImageStream))..., diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml index 2d9b1f3026d5..fbcfa41bcd8f 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml @@ -284,6 +284,24 @@ spec: annotations: include.release.openshift.io/ibm-cloud-managed: "true" release.openshift.io/delete: "true" + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: kube-storage-version-migrator-operator + namespace: openshift-kube-storage-version-migrator-operator + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + release.openshift.io/delete: "true" + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: migrator + namespace: openshift-kube-storage-version-migrator + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + release.openshift.io/delete: "true" EOF command: - /bin/bash diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml index 1b3c7f44f78c..6014b1053971 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml @@ -295,6 +295,24 @@ spec: annotations: include.release.openshift.io/ibm-cloud-managed: "true" release.openshift.io/delete: "true" + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: kube-storage-version-migrator-operator + namespace: openshift-kube-storage-version-migrator-operator + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + release.openshift.io/delete: "true" + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: migrator + namespace: openshift-kube-storage-version-migrator + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + release.openshift.io/delete: "true" EOF command: - /bin/bash diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml index e1230b097c4a..3e1780f62a72 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml @@ -284,6 +284,24 @@ spec: annotations: include.release.openshift.io/ibm-cloud-managed: "true" release.openshift.io/delete: "true" + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: kube-storage-version-migrator-operator + namespace: openshift-kube-storage-version-migrator-operator + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + release.openshift.io/delete: "true" + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: migrator + namespace: openshift-kube-storage-version-migrator + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + release.openshift.io/delete: "true" EOF command: - /bin/bash diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml index 2d9b1f3026d5..fbcfa41bcd8f 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml @@ -284,6 +284,24 @@ spec: annotations: include.release.openshift.io/ibm-cloud-managed: "true" release.openshift.io/delete: "true" + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: kube-storage-version-migrator-operator + namespace: openshift-kube-storage-version-migrator-operator + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + release.openshift.io/delete: "true" + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: migrator + namespace: openshift-kube-storage-version-migrator + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + release.openshift.io/delete: "true" EOF command: - /bin/bash diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml index 7008c8048b57..1d6ec0b4cf15 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml @@ -84,6 +84,7 @@ spec: - --openshift-config=/etc/kubernetes/config/config.json - --v=2 - --encryption-provider-config=/etc/kubernetes/secret-encryption/config.yaml + - --encryption-provider-config-automatic-reload=false command: - hyperkube env: diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/AROSwift/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/AROSwift/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml new file mode 100644 index 000000000000..3bca5b47ade3 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/AROSwift/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml @@ -0,0 +1,20 @@ +apiVersion: hypershift.openshift.io/v1beta1 +kind: ControlPlaneComponent +metadata: + name: kube-storage-version-migrator + namespace: hcp-namespace + resourceVersion: "1" +spec: {} +status: + conditions: + - lastTransitionTime: null + message: kube-storage-version-migrator Deployment Available condition not found + reason: NotFound + status: "False" + type: Available + - lastTransitionTime: null + message: 'Waiting for deployment kube-storage-version-migrator rollout to finish: + 0 out of 1 new replicas have been updated' + reason: WaitingForRolloutComplete + status: "False" + type: RolloutComplete diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/AROSwift/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/AROSwift/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml new file mode 100644 index 000000000000..56e4c5277e49 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/AROSwift/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml @@ -0,0 +1,117 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + hypershift.openshift.io/managed-by: control-plane-operator + name: kube-storage-version-migrator + namespace: hcp-namespace + ownerReferences: + - apiVersion: hypershift.openshift.io/v1beta1 + blockOwnerDeletion: true + controller: true + kind: HostedControlPlane + name: hcp + uid: "" + resourceVersion: "1" +spec: + replicas: 1 + revisionHistoryLimit: 2 + selector: + matchLabels: + app: kube-storage-version-migrator + strategy: {} + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir + component.hypershift.openshift.io/config-hash: "" + hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64 + labels: + app: kube-storage-version-migrator + hypershift.openshift.io/control-plane-component: kube-storage-version-migrator + hypershift.openshift.io/hosted-control-plane: hcp-namespace + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: hypershift.openshift.io/control-plane + operator: In + values: + - "true" + weight: 50 + - preference: + matchExpressions: + - key: hypershift.openshift.io/cluster + operator: In + values: + - hcp-namespace + weight: 100 + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + hypershift.openshift.io/hosted-control-plane: hcp-namespace + topologyKey: kubernetes.io/hostname + weight: 100 + automountServiceAccountToken: false + containers: + - args: + - --alsologtostderr + - --v=2 + - --kubeconfig=/etc/kubernetes/kubeconfig + command: + - migrator + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: kube-storage-version-migrator + imagePullPolicy: IfNotPresent + name: migrator + resources: + requests: + cpu: 10m + memory: 200Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /etc/kubernetes + name: kubeconfig + readOnly: true + - mountPath: /tmp + name: tmp-dir + priorityClassName: hypershift-control-plane + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + tolerations: + - effect: NoSchedule + key: hypershift.openshift.io/control-plane + operator: Equal + value: "true" + - effect: NoSchedule + key: hypershift.openshift.io/cluster + operator: Equal + value: hcp-namespace + volumes: + - name: kubeconfig + secret: + defaultMode: 416 + secretName: service-network-admin-kubeconfig + - emptyDir: {} + name: tmp-dir +status: {} diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/GCP/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/GCP/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml new file mode 100644 index 000000000000..3bca5b47ade3 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/GCP/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml @@ -0,0 +1,20 @@ +apiVersion: hypershift.openshift.io/v1beta1 +kind: ControlPlaneComponent +metadata: + name: kube-storage-version-migrator + namespace: hcp-namespace + resourceVersion: "1" +spec: {} +status: + conditions: + - lastTransitionTime: null + message: kube-storage-version-migrator Deployment Available condition not found + reason: NotFound + status: "False" + type: Available + - lastTransitionTime: null + message: 'Waiting for deployment kube-storage-version-migrator rollout to finish: + 0 out of 1 new replicas have been updated' + reason: WaitingForRolloutComplete + status: "False" + type: RolloutComplete diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/GCP/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/GCP/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml new file mode 100644 index 000000000000..5c751997562f --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/GCP/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml @@ -0,0 +1,118 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + hypershift.openshift.io/managed-by: control-plane-operator + name: kube-storage-version-migrator + namespace: hcp-namespace + ownerReferences: + - apiVersion: hypershift.openshift.io/v1beta1 + blockOwnerDeletion: true + controller: true + kind: HostedControlPlane + name: hcp + uid: "" + resourceVersion: "1" +spec: + replicas: 1 + revisionHistoryLimit: 2 + selector: + matchLabels: + app: kube-storage-version-migrator + strategy: {} + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir + component.hypershift.openshift.io/config-hash: "" + hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64 + labels: + app: kube-storage-version-migrator + hypershift.openshift.io/control-plane-component: kube-storage-version-migrator + hypershift.openshift.io/hosted-control-plane: hcp-namespace + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: hypershift.openshift.io/control-plane + operator: In + values: + - "true" + weight: 50 + - preference: + matchExpressions: + - key: hypershift.openshift.io/cluster + operator: In + values: + - hcp-namespace + weight: 100 + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + hypershift.openshift.io/hosted-control-plane: hcp-namespace + topologyKey: kubernetes.io/hostname + weight: 100 + automountServiceAccountToken: false + containers: + - args: + - --alsologtostderr + - --v=2 + - --kubeconfig=/etc/kubernetes/kubeconfig + command: + - migrator + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: kube-storage-version-migrator + imagePullPolicy: IfNotPresent + name: migrator + resources: + requests: + cpu: 10m + memory: 200Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /etc/kubernetes + name: kubeconfig + readOnly: true + - mountPath: /tmp + name: tmp-dir + priorityClassName: hypershift-control-plane + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + tolerations: + - effect: NoSchedule + key: hypershift.openshift.io/control-plane + operator: Equal + value: "true" + - effect: NoSchedule + key: hypershift.openshift.io/cluster + operator: Equal + value: hcp-namespace + volumes: + - name: kubeconfig + secret: + defaultMode: 416 + secretName: service-network-admin-kubeconfig + - emptyDir: {} + name: tmp-dir +status: {} diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml new file mode 100644 index 000000000000..3bca5b47ade3 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml @@ -0,0 +1,20 @@ +apiVersion: hypershift.openshift.io/v1beta1 +kind: ControlPlaneComponent +metadata: + name: kube-storage-version-migrator + namespace: hcp-namespace + resourceVersion: "1" +spec: {} +status: + conditions: + - lastTransitionTime: null + message: kube-storage-version-migrator Deployment Available condition not found + reason: NotFound + status: "False" + type: Available + - lastTransitionTime: null + message: 'Waiting for deployment kube-storage-version-migrator rollout to finish: + 0 out of 1 new replicas have been updated' + reason: WaitingForRolloutComplete + status: "False" + type: RolloutComplete diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml new file mode 100644 index 000000000000..56e4c5277e49 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml @@ -0,0 +1,117 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + hypershift.openshift.io/managed-by: control-plane-operator + name: kube-storage-version-migrator + namespace: hcp-namespace + ownerReferences: + - apiVersion: hypershift.openshift.io/v1beta1 + blockOwnerDeletion: true + controller: true + kind: HostedControlPlane + name: hcp + uid: "" + resourceVersion: "1" +spec: + replicas: 1 + revisionHistoryLimit: 2 + selector: + matchLabels: + app: kube-storage-version-migrator + strategy: {} + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir + component.hypershift.openshift.io/config-hash: "" + hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64 + labels: + app: kube-storage-version-migrator + hypershift.openshift.io/control-plane-component: kube-storage-version-migrator + hypershift.openshift.io/hosted-control-plane: hcp-namespace + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: hypershift.openshift.io/control-plane + operator: In + values: + - "true" + weight: 50 + - preference: + matchExpressions: + - key: hypershift.openshift.io/cluster + operator: In + values: + - hcp-namespace + weight: 100 + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + hypershift.openshift.io/hosted-control-plane: hcp-namespace + topologyKey: kubernetes.io/hostname + weight: 100 + automountServiceAccountToken: false + containers: + - args: + - --alsologtostderr + - --v=2 + - --kubeconfig=/etc/kubernetes/kubeconfig + command: + - migrator + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: kube-storage-version-migrator + imagePullPolicy: IfNotPresent + name: migrator + resources: + requests: + cpu: 10m + memory: 200Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /etc/kubernetes + name: kubeconfig + readOnly: true + - mountPath: /tmp + name: tmp-dir + priorityClassName: hypershift-control-plane + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + tolerations: + - effect: NoSchedule + key: hypershift.openshift.io/control-plane + operator: Equal + value: "true" + - effect: NoSchedule + key: hypershift.openshift.io/cluster + operator: Equal + value: hcp-namespace + volumes: + - name: kubeconfig + secret: + defaultMode: 416 + secretName: service-network-admin-kubeconfig + - emptyDir: {} + name: tmp-dir +status: {} diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml new file mode 100644 index 000000000000..3bca5b47ade3 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml @@ -0,0 +1,20 @@ +apiVersion: hypershift.openshift.io/v1beta1 +kind: ControlPlaneComponent +metadata: + name: kube-storage-version-migrator + namespace: hcp-namespace + resourceVersion: "1" +spec: {} +status: + conditions: + - lastTransitionTime: null + message: kube-storage-version-migrator Deployment Available condition not found + reason: NotFound + status: "False" + type: Available + - lastTransitionTime: null + message: 'Waiting for deployment kube-storage-version-migrator rollout to finish: + 0 out of 1 new replicas have been updated' + reason: WaitingForRolloutComplete + status: "False" + type: RolloutComplete diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml new file mode 100644 index 000000000000..56e4c5277e49 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml @@ -0,0 +1,117 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + hypershift.openshift.io/managed-by: control-plane-operator + name: kube-storage-version-migrator + namespace: hcp-namespace + ownerReferences: + - apiVersion: hypershift.openshift.io/v1beta1 + blockOwnerDeletion: true + controller: true + kind: HostedControlPlane + name: hcp + uid: "" + resourceVersion: "1" +spec: + replicas: 1 + revisionHistoryLimit: 2 + selector: + matchLabels: + app: kube-storage-version-migrator + strategy: {} + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir + component.hypershift.openshift.io/config-hash: "" + hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64 + labels: + app: kube-storage-version-migrator + hypershift.openshift.io/control-plane-component: kube-storage-version-migrator + hypershift.openshift.io/hosted-control-plane: hcp-namespace + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: hypershift.openshift.io/control-plane + operator: In + values: + - "true" + weight: 50 + - preference: + matchExpressions: + - key: hypershift.openshift.io/cluster + operator: In + values: + - hcp-namespace + weight: 100 + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + hypershift.openshift.io/hosted-control-plane: hcp-namespace + topologyKey: kubernetes.io/hostname + weight: 100 + automountServiceAccountToken: false + containers: + - args: + - --alsologtostderr + - --v=2 + - --kubeconfig=/etc/kubernetes/kubeconfig + command: + - migrator + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: kube-storage-version-migrator + imagePullPolicy: IfNotPresent + name: migrator + resources: + requests: + cpu: 10m + memory: 200Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /etc/kubernetes + name: kubeconfig + readOnly: true + - mountPath: /tmp + name: tmp-dir + priorityClassName: hypershift-control-plane + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + tolerations: + - effect: NoSchedule + key: hypershift.openshift.io/control-plane + operator: Equal + value: "true" + - effect: NoSchedule + key: hypershift.openshift.io/cluster + operator: Equal + value: hcp-namespace + volumes: + - name: kubeconfig + secret: + defaultMode: 416 + secretName: service-network-admin-kubeconfig + - emptyDir: {} + name: tmp-dir +status: {} diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml new file mode 100644 index 000000000000..3bca5b47ade3 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_controlplanecomponent.yaml @@ -0,0 +1,20 @@ +apiVersion: hypershift.openshift.io/v1beta1 +kind: ControlPlaneComponent +metadata: + name: kube-storage-version-migrator + namespace: hcp-namespace + resourceVersion: "1" +spec: {} +status: + conditions: + - lastTransitionTime: null + message: kube-storage-version-migrator Deployment Available condition not found + reason: NotFound + status: "False" + type: Available + - lastTransitionTime: null + message: 'Waiting for deployment kube-storage-version-migrator rollout to finish: + 0 out of 1 new replicas have been updated' + reason: WaitingForRolloutComplete + status: "False" + type: RolloutComplete diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml new file mode 100644 index 000000000000..56e4c5277e49 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-storage-version-migrator/zz_fixture_TestControlPlaneComponents_kube_storage_version_migrator_deployment.yaml @@ -0,0 +1,117 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + hypershift.openshift.io/managed-by: control-plane-operator + name: kube-storage-version-migrator + namespace: hcp-namespace + ownerReferences: + - apiVersion: hypershift.openshift.io/v1beta1 + blockOwnerDeletion: true + controller: true + kind: HostedControlPlane + name: hcp + uid: "" + resourceVersion: "1" +spec: + replicas: 1 + revisionHistoryLimit: 2 + selector: + matchLabels: + app: kube-storage-version-migrator + strategy: {} + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir + component.hypershift.openshift.io/config-hash: "" + hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64 + labels: + app: kube-storage-version-migrator + hypershift.openshift.io/control-plane-component: kube-storage-version-migrator + hypershift.openshift.io/hosted-control-plane: hcp-namespace + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: hypershift.openshift.io/control-plane + operator: In + values: + - "true" + weight: 50 + - preference: + matchExpressions: + - key: hypershift.openshift.io/cluster + operator: In + values: + - hcp-namespace + weight: 100 + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + hypershift.openshift.io/hosted-control-plane: hcp-namespace + topologyKey: kubernetes.io/hostname + weight: 100 + automountServiceAccountToken: false + containers: + - args: + - --alsologtostderr + - --v=2 + - --kubeconfig=/etc/kubernetes/kubeconfig + command: + - migrator + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: kube-storage-version-migrator + imagePullPolicy: IfNotPresent + name: migrator + resources: + requests: + cpu: 10m + memory: 200Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /etc/kubernetes + name: kubeconfig + readOnly: true + - mountPath: /tmp + name: tmp-dir + priorityClassName: hypershift-control-plane + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + tolerations: + - effect: NoSchedule + key: hypershift.openshift.io/control-plane + operator: Equal + value: "true" + - effect: NoSchedule + key: hypershift.openshift.io/cluster + operator: Equal + value: hcp-namespace + volumes: + - name: kubeconfig + secret: + defaultMode: 416 + secretName: service-network-admin-kubeconfig + - emptyDir: {} + name: tmp-dir +status: {} diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-storage-version-migrator/deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-storage-version-migrator/deployment.yaml new file mode 100644 index 000000000000..53d6c702f3f9 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-storage-version-migrator/deployment.yaml @@ -0,0 +1,56 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: kube-storage-version-migrator +spec: + replicas: 1 + revisionHistoryLimit: 2 + selector: + matchLabels: + app: kube-storage-version-migrator + template: + metadata: + labels: + app: kube-storage-version-migrator + spec: + automountServiceAccountToken: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumes: + - name: kubeconfig + secret: + secretName: service-network-admin-kubeconfig + containers: + - name: migrator + image: kube-storage-version-migrator + command: + - migrator + args: + - '--alsologtostderr' + - '--v=2' + - '--kubeconfig=/etc/kubernetes/kubeconfig' + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + volumeMounts: + - name: kubeconfig + mountPath: /etc/kubernetes + readOnly: true + terminationMessagePolicy: FallbackToLogsOnError + resources: + requests: + cpu: 10m + memory: 200Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/cvo/deployment.go b/control-plane-operator/controllers/hostedcontrolplane/v2/cvo/deployment.go index 0e337423a6a6..00d4ab524f5a 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/cvo/deployment.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/cvo/deployment.go @@ -284,6 +284,8 @@ func resourcesToRemove(platformType hyperv1.PlatformType) []client.Object { &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "aws-ebs-csi-driver-operator", Namespace: "openshift-cluster-csi-drivers"}}, &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "aws-ebs-csi-driver-controller", Namespace: "openshift-cluster-csi-drivers"}}, &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "csi-snapshot-controller", Namespace: "openshift-cluster-storage-operator"}}, + &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "kube-storage-version-migrator-operator", Namespace: "openshift-kube-storage-version-migrator-operator"}}, + &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "migrator", Namespace: "openshift-kube-storage-version-migrator"}}, } } } diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/aescbc.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/aescbc.go index 0575f2f5b047..f29f2bee3243 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/aescbc.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/aescbc.go @@ -7,6 +7,7 @@ import ( "hash/fnv" "github.com/openshift/hypershift/support/api" + "github.com/openshift/hypershift/support/config" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" v1 "k8s.io/apiserver/pkg/apis/apiserver/v1" @@ -14,29 +15,36 @@ import ( const aescbcKeyNamePrefix = "key" +// AESCBCKeyName computes the EncryptionConfiguration key name for an AESCBC key. +func AESCBCKeyName(keyData []byte) (string, error) { + hasher := fnv.New32() + if _, err := hasher.Write(keyData); err != nil { + return "", fmt.Errorf("failed to hash AESCBC key: %w", err) + } + return fmt.Sprintf("%s-%d", aescbcKeyNamePrefix, hasher.Sum32()), nil +} + func generateAESCBCEncryptionConfig(activeKey []byte, backupKey []byte) ([]byte, error) { var providerConfiguration []v1.ProviderConfiguration var keyList []v1.Key if len(activeKey) == 0 { return nil, fmt.Errorf("active key is empty") } - hasher := fnv.New32() - _, err := hasher.Write(activeKey) + activeKeyName, err := AESCBCKeyName(activeKey) if err != nil { return nil, err } keyList = append(keyList, v1.Key{ - Name: fmt.Sprintf("%s-%d", aescbcKeyNamePrefix, hasher.Sum32()), + Name: activeKeyName, Secret: base64.StdEncoding.EncodeToString(activeKey), }) if len(backupKey) > 0 { - hasher = fnv.New32() - _, err := hasher.Write(backupKey) + backupKeyName, err := AESCBCKeyName(backupKey) if err != nil { return nil, err } keyList = append(keyList, v1.Key{ - Name: fmt.Sprintf("%s-%d", aescbcKeyNamePrefix, hasher.Sum32()), + Name: backupKeyName, Secret: base64.StdEncoding.EncodeToString(backupKey), }) } @@ -55,14 +63,13 @@ func generateAESCBCEncryptionConfig(activeKey []byte, backupKey []byte) ([]byte, }, Resources: []v1.ResourceConfiguration{ { - Resources: []string{"secrets"}, + Resources: config.AESCBCEncryptedObjects(), Providers: providerConfiguration, }, }, } bufferInstance := bytes.NewBuffer([]byte{}) - err = api.YamlSerializer.Encode(&encryptionConfig, bufferInstance) - if err != nil { + if err := api.YamlSerializer.Encode(&encryptionConfig, bufferInstance); err != nil { return nil, err } return bufferInstance.Bytes(), nil diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment.go index d0ecc5523bcc..ff637fa525e5 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment.go @@ -127,7 +127,16 @@ func adaptDeployment(cpContext component.WorkloadContext, deployment *appsv1.Dep applyGenericSecretEncryptionConfig(&deployment.Spec.Template.Spec) switch secretEncryption.Type { case hyperv1.KMS: - if err := applyKMSConfig(&deployment.Spec.Template.Spec, secretEncryption, newKMSImages(hcp), hcp); err != nil { + encConfigSecret := manifests.KASSecretEncryptionConfigFile(hcp.Namespace) + currentConfig, err := readCurrentEncryptionConfig(cpContext, encConfigSecret) + if err != nil { + return fmt.Errorf("failed to read current encryption config: %w", err) + } + kasReady, err := isKASConverged(cpContext) + if err != nil { + return fmt.Errorf("failed to check KAS convergence: %w", err) + } + if err := applyKMSConfig(&deployment.Spec.Template.Spec, secretEncryption, &hcp.Status.SecretEncryption, currentConfig, kasReady, newKMSImages(hcp), hcp); err != nil { return err } } @@ -213,7 +222,7 @@ func updateMainContainer(podSpec *corev1.PodSpec, hcp *hyperv1.HostedControlPlan if hcp.Spec.SecretEncryption.KMS.AWS != nil { // Always will have an active key totalProviderInstances = 1 - if hcp.Spec.SecretEncryption.KMS.AWS.BackupKey != nil && len(hcp.Spec.SecretEncryption.KMS.AWS.BackupKey.ARN) > 0 { + if hcp.Spec.SecretEncryption.KMS.AWS.BackupKey != nil && len(hcp.Spec.SecretEncryption.KMS.AWS.BackupKey.ARN) > 0 { //nolint:staticcheck totalProviderInstances++ } } @@ -257,7 +266,10 @@ func applyGenericSecretEncryptionConfig(podSpec *corev1.PodSpec) { podSpec.Volumes = append(podSpec.Volumes, buildVolumeSecretEncryptionConfigFile()) podspec.UpdateContainer(ComponentName, podSpec.Containers, func(c *corev1.Container) { - c.Args = append(c.Args, fmt.Sprintf("--encryption-provider-config=%s/%s", genericSecretEncryptionConfigFileVolumeMount.Path(ComponentName, secretEncryptionConfigFileVolumeName), secretEncryptionConfigurationKey)) + c.Args = append(c.Args, + fmt.Sprintf("--encryption-provider-config=%s/%s", genericSecretEncryptionConfigFileVolumeMount.Path(ComponentName, secretEncryptionConfigFileVolumeName), secretEncryptionConfigurationKey), + "--encryption-provider-config-automatic-reload=false", + ) c.VolumeMounts = append(c.VolumeMounts, genericSecretEncryptionConfigFileVolumeMount.ContainerMounts(ComponentName)...) }) diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms.go index 993e3976836a..50f073497aa2 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms.go @@ -9,16 +9,22 @@ import ( "github.com/openshift/hypershift/support/api" "github.com/openshift/hypershift/support/azureutil" "github.com/openshift/hypershift/support/podspec" + "github.com/openshift/hypershift/support/secretencryption" corev1 "k8s.io/api/core/v1" + apiserverv1 "k8s.io/apiserver/pkg/apis/apiserver/v1" ) -func applyKMSConfig(podSpec *corev1.PodSpec, secretEncryptionData *hyperv1.SecretEncryptionSpec, images kmsImages, hcp *hyperv1.HostedControlPlane) error { +func applyKMSConfig(podSpec *corev1.PodSpec, secretEncryptionData *hyperv1.SecretEncryptionSpec, encStatus *hyperv1.SecretEncryptionStatus, currentConfig *apiserverv1.EncryptionConfiguration, kasConverged bool, images kmsImages, hcp *hyperv1.HostedControlPlane) error { if secretEncryptionData.KMS == nil { return fmt.Errorf("kms metadata not specified") } - provider, err := getKMSProvider(secretEncryptionData.KMS, images, hcp) + keys, err := deriveKMSKeys(secretEncryptionData.KMS, encStatus, currentConfig, kasConverged) + if err != nil { + return fmt.Errorf("failed to derive KMS keys: %w", err) + } + provider, err := getKMSProvider(secretEncryptionData.KMS, keys, images, hcp) if err != nil { return err } @@ -34,8 +40,12 @@ func applyKMSConfig(podSpec *corev1.PodSpec, secretEncryptionData *hyperv1.Secre return nil } -func generateKMSEncryptionConfig(kmsSpec *hyperv1.KMSSpec, apiVersion string) ([]byte, error) { - provider, err := getKMSProvider(kmsSpec, kmsImages{}, nil) +func generateKMSEncryptionConfig(kmsSpec *hyperv1.KMSSpec, encStatus *hyperv1.SecretEncryptionStatus, currentConfig *apiserverv1.EncryptionConfiguration, kasConverged bool, apiVersion string) ([]byte, error) { + keys, err := deriveKMSKeys(kmsSpec, encStatus, currentConfig, kasConverged) + if err != nil { + return nil, fmt.Errorf("failed to derive KMS keys: %w", err) + } + provider, err := getKMSProvider(kmsSpec, keys, kmsImages{}, nil) if err != nil { return nil, err } @@ -46,34 +56,150 @@ func generateKMSEncryptionConfig(kmsSpec *hyperv1.KMSSpec, apiVersion string) ([ } bufferInstance := bytes.NewBuffer([]byte{}) - err = api.YamlSerializer.Encode(encryptionConfig, bufferInstance) - if err != nil { + if err := api.YamlSerializer.Encode(encryptionConfig, bufferInstance); err != nil { return nil, err } return bufferInstance.Bytes(), nil } +// kmsWriteReadKeys holds the provider-specific write and read key assignments +// derived from the HCP status and current EncryptionConfiguration. +type kmsWriteReadKeys struct { + awsWrite *hyperv1.AWSKMSKeyEntry + awsRead *hyperv1.AWSKMSKeyEntry + azureWrite *hyperv1.AzureKMSKey + azureRead *hyperv1.AzureKMSKey +} + +// deriveKMSKeys determines the write and read KMS keys using the two-stage +// rollout pattern. It inspects the current EncryptionConfiguration and KAS +// convergence to determine the correct stage: +// +// - No targetKey: no rotation, spec.activeKey is the sole write key. +// - targetKey set, not yet in config or present as read-only and KAS not +// converged: ReadOnlyDeploy stage — old key (status.activeKey) writes, +// new key (status.targetKey) reads. +// - targetKey present as read-only and KAS converged, or targetKey is +// already write provider: WritePromote/Migrating — new key +// (status.targetKey) writes, old key (status.activeKey) reads. +// - status has no active key (upgrade transition): fall back to spec.backupKey. +func deriveKMSKeys(kmsSpec *hyperv1.KMSSpec, encStatus *hyperv1.SecretEncryptionStatus, currentConfig *apiserverv1.EncryptionConfiguration, kasConverged bool) (kmsWriteReadKeys, error) { + keys := kmsWriteReadKeys{} + + switch kmsSpec.Provider { + case hyperv1.AWS: + if kmsSpec.AWS == nil { + return keys, nil + } + + if encStatus == nil || encStatus.ActiveKey.Provider == "" { + // Upgrade transition or initial setup: use spec keys with deprecated backupKey fallback. + keys.awsWrite = &kmsSpec.AWS.ActiveKey + if kmsSpec.AWS.BackupKey != nil { //nolint:staticcheck + keys.awsRead = kmsSpec.AWS.BackupKey //nolint:staticcheck + } + return keys, nil + } + + if encStatus.TargetKey.Provider == "" || encStatus.TargetKey.AWS.ARN == "" || encStatus.ActiveKey.AWS.ARN == "" { + keys.awsWrite = &kmsSpec.AWS.ActiveKey + return keys, nil + } + + // Rotation in progress. Determine the stage from the current config. + targetKey := &hyperv1.AWSKMSKeyEntry{ARN: encStatus.TargetKey.AWS.ARN} + oldKey := &hyperv1.AWSKMSKeyEntry{ARN: encStatus.ActiveKey.AWS.ARN} + targetName, err := kms.AWSKMSProviderName(targetKey.ARN) + if err != nil { + return keys, err + } + + if secretencryption.ShouldPromoteTargetKey(currentConfig, targetName, hyperv1.KMS, kasConverged) { + keys.awsWrite = targetKey + keys.awsRead = oldKey + } else { + keys.awsWrite = oldKey + keys.awsRead = targetKey + } + + case hyperv1.AZURE: + if kmsSpec.Azure == nil { + return keys, nil + } + + if encStatus == nil || encStatus.ActiveKey.Provider == "" { + keys.azureWrite = &kmsSpec.Azure.ActiveKey + if kmsSpec.Azure.BackupKey != nil { //nolint:staticcheck + keys.azureRead = kmsSpec.Azure.BackupKey //nolint:staticcheck + } + return keys, nil + } + + if encStatus.TargetKey.Provider == "" || encStatus.TargetKey.Azure.KeyVaultName == "" || encStatus.ActiveKey.Azure.KeyVaultName == "" { + keys.azureWrite = &kmsSpec.Azure.ActiveKey + return keys, nil + } + + targetKey := &hyperv1.AzureKMSKey{ + KeyVaultName: encStatus.TargetKey.Azure.KeyVaultName, + KeyName: encStatus.TargetKey.Azure.KeyName, + KeyVersion: encStatus.TargetKey.Azure.KeyVersion, + } + oldKey := &hyperv1.AzureKMSKey{ + KeyVaultName: encStatus.ActiveKey.Azure.KeyVaultName, + KeyName: encStatus.ActiveKey.Azure.KeyName, + KeyVersion: encStatus.ActiveKey.Azure.KeyVersion, + } + targetName, err := kms.AzureKMSProviderName(*targetKey) + if err != nil { + return keys, err + } + + if secretencryption.ShouldPromoteTargetKey(currentConfig, targetName, hyperv1.KMS, kasConverged) { + keys.azureWrite = targetKey + keys.azureRead = oldKey + } else { + keys.azureWrite = oldKey + keys.azureRead = targetKey + } + + case hyperv1.IBMCloud: + // IBM Cloud uses a single KMS provider with a fixed name; the sidecar + // handles key versioning internally via KP_DATA_JSON. No write/read + // key derivation is needed. + } + + return keys, nil +} + // getKMSProvider returns a KMS provider for the given spec. When hcp is nil (called from // generateKMSEncryptionConfig), the provider is always created as "managed" because encryption // config generation only produces the EncryptionConfiguration resource and does not need // platform-specific pod/volume configuration. -func getKMSProvider(kmsSpec *hyperv1.KMSSpec, images kmsImages, hcp *hyperv1.HostedControlPlane) (kms.KMSProvider, error) { +func getKMSProvider(kmsSpec *hyperv1.KMSSpec, keys kmsWriteReadKeys, images kmsImages, hcp *hyperv1.HostedControlPlane) (kms.KMSProvider, error) { switch kmsSpec.Provider { case hyperv1.IBMCloud: return kms.NewIBMCloudKMSProvider(kmsSpec.IBMCloud, images.IBMCloudKMS) case hyperv1.AWS: - return kms.NewAWSKMSProvider(kmsSpec.AWS, images.AWSKMS, images.TokenMinterImage) + if kmsSpec.AWS == nil { + return nil, fmt.Errorf("AWS kms metadata not specified") + } + return kms.NewAWSKMSProvider(*keys.awsWrite, keys.awsRead, kmsSpec.AWS.Region, images.AWSKMS, images.TokenMinterImage) case hyperv1.AZURE: - isSelfManaged := hcp != nil && azureutil.IsSelfManagedAzure(hcp.Spec.Platform.Type) + if kmsSpec.Azure == nil { + return nil, fmt.Errorf("azure kms metadata not specified") + } opts := kms.AzureKMSProviderOptions{ - IsSelfManaged: isSelfManaged, TokenMinterImage: images.TokenMinterImage, } - if isSelfManaged && kmsSpec.Azure.WorkloadIdentity.ClientID != "" { - opts.KMSClientID = string(kmsSpec.Azure.WorkloadIdentity.ClientID) - opts.TenantID = hcp.Spec.Platform.Azure.TenantID + if hcp != nil { + opts.IsSelfManaged = azureutil.IsSelfManagedAzure(hcp.Spec.Platform.Type) + if opts.IsSelfManaged && kmsSpec.Azure.WorkloadIdentity.ClientID != "" { + opts.KMSClientID = string(kmsSpec.Azure.WorkloadIdentity.ClientID) + opts.TenantID = hcp.Spec.Platform.Azure.TenantID + } } - return kms.NewAzureKMSProvider(kmsSpec.Azure, images.AzureKMS, opts) + return kms.NewAzureKMSProvider(*keys.azureWrite, keys.azureRead, kmsSpec.Azure, images.AzureKMS, opts) default: return nil, fmt.Errorf("unrecognized kms provider %s", kmsSpec.Provider) } diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/aws.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/aws.go index 40725bc04ea4..546557f757b5 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/aws.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/aws.go @@ -29,6 +29,15 @@ const ( kmsAPIVersionV1 = "v1" ) +// AWSKMSProviderName computes the EncryptionConfiguration KMS provider name for an AWS KMS key ARN. +func AWSKMSProviderName(arn string) (string, error) { + hasher := fnv.New32() + if _, err := hasher.Write([]byte(arn)); err != nil { + return "", fmt.Errorf("failed to hash AWS KMS ARN: %w", err) + } + return fmt.Sprintf("%s-%d", awsKeyNamePrefix, hasher.Sum32()), nil +} + var ( awsKMSVolumeMounts = podspec.VolumeMounts{ KasMainContainerName: { @@ -64,14 +73,14 @@ type awsKMSProvider struct { tokenMinterImage string } -func NewAWSKMSProvider(kmsSpec *hyperv1.AWSKMSSpec, kmsImage, tokenMinterImage string) (*awsKMSProvider, error) { - if kmsSpec == nil { - return nil, fmt.Errorf("AWS kms metadata not specified") +func NewAWSKMSProvider(writeKey hyperv1.AWSKMSKeyEntry, readKey *hyperv1.AWSKMSKeyEntry, region string, kmsImage, tokenMinterImage string) (*awsKMSProvider, error) { + if len(writeKey.ARN) == 0 { + return nil, fmt.Errorf("AWS KMS write key ARN is empty") } return &awsKMSProvider{ - activeKey: kmsSpec.ActiveKey, - backupKey: kmsSpec.BackupKey, - awsRegion: kmsSpec.Region, + activeKey: writeKey, + backupKey: readKey, + awsRegion: region, kmsImage: kmsImage, tokenMinterImage: tokenMinterImage, }, nil @@ -82,29 +91,27 @@ func (p *awsKMSProvider) GenerateKMSEncryptionConfig(apiVersion string) (*v1.Enc if len(p.activeKey.ARN) == 0 { return nil, fmt.Errorf("active key metadata is nil") } - hasher := fnv.New32() - _, err := hasher.Write([]byte(p.activeKey.ARN)) + activeKeyName, err := AWSKMSProviderName(p.activeKey.ARN) if err != nil { return nil, err } providerConfiguration = append(providerConfiguration, v1.ProviderConfiguration{ KMS: &v1.KMSConfiguration{ APIVersion: apiVersion, - Name: fmt.Sprintf("%s-%d", awsKeyNamePrefix, hasher.Sum32()), + Name: activeKeyName, Endpoint: activeAWSKMSUnixSocket, Timeout: &metav1.Duration{Duration: 35 * time.Second}, }, }) if p.backupKey != nil && len(p.backupKey.ARN) > 0 { - hasher = fnv.New32() - _, err := hasher.Write([]byte(p.backupKey.ARN)) + backupKeyName, err := AWSKMSProviderName(p.backupKey.ARN) if err != nil { return nil, err } providerConfiguration = append(providerConfiguration, v1.ProviderConfiguration{ KMS: &v1.KMSConfiguration{ APIVersion: apiVersion, - Name: fmt.Sprintf("%s-%d", awsKeyNamePrefix, hasher.Sum32()), + Name: backupKeyName, Endpoint: backupAWSKMSUnixSocket, Timeout: &metav1.Duration{Duration: 35 * time.Second}, }, @@ -155,7 +162,6 @@ func (p *awsKMSProvider) GenerateKMSPodConfig() (*KMSPodConfig, error) { podConfig.KASContainerMutate = func(c *corev1.Container) { c.VolumeMounts = append(c.VolumeMounts, awsKMSVolumeMounts.ContainerMounts(KasMainContainerName)...) - c.Args = append(c.Args, "--encryption-provider-config-automatic-reload=false") } return podConfig, nil diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/aws_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/aws_test.go index 5a0b4a6ea519..0d415cd57bc2 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/aws_test.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/aws_test.go @@ -19,22 +19,23 @@ func TestNewAWSKMSProvider(t *testing.T) { tests := []struct { name string - kmsSpec *hyperv1.AWSKMSSpec + writeKey hyperv1.AWSKMSKeyEntry + readKey *hyperv1.AWSKMSKeyEntry + region string kmsImage string tokenMinterImage string expectError bool }{ { - name: "When kmsSpec is nil, it should return an error", - kmsSpec: nil, + name: "When write key ARN is empty, it should return an error", + writeKey: hyperv1.AWSKMSKeyEntry{ARN: ""}, + region: "us-east-1", expectError: true, }, { - name: "When kmsSpec is valid, it should return a provider with the correct fields", - kmsSpec: &hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, - Region: "us-east-1", - }, + name: "When write key is valid, it should return a provider with the correct fields", + writeKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, + region: "us-east-1", kmsImage: "quay.io/test/kms:latest", tokenMinterImage: "quay.io/test/token-minter:latest", expectError: false, @@ -46,7 +47,7 @@ func TestNewAWSKMSProvider(t *testing.T) { t.Parallel() g := NewWithT(t) - provider, err := NewAWSKMSProvider(tc.kmsSpec, tc.kmsImage, tc.tokenMinterImage) + provider, err := NewAWSKMSProvider(tc.writeKey, tc.readKey, tc.region, tc.kmsImage, tc.tokenMinterImage) if tc.expectError { g.Expect(err).To(HaveOccurred()) g.Expect(provider).To(BeNil()) @@ -55,9 +56,9 @@ func TestNewAWSKMSProvider(t *testing.T) { g.Expect(err).ToNot(HaveOccurred()) g.Expect(provider).ToNot(BeNil()) - g.Expect(provider.activeKey).To(Equal(tc.kmsSpec.ActiveKey)) - g.Expect(provider.backupKey).To(Equal(tc.kmsSpec.BackupKey)) - g.Expect(provider.awsRegion).To(Equal(tc.kmsSpec.Region)) + g.Expect(provider.activeKey).To(Equal(tc.writeKey)) + g.Expect(provider.backupKey).To(Equal(tc.readKey)) + g.Expect(provider.awsRegion).To(Equal(tc.region)) g.Expect(provider.kmsImage).To(Equal(tc.kmsImage)) g.Expect(provider.tokenMinterImage).To(Equal(tc.tokenMinterImage)) }) @@ -76,10 +77,10 @@ func TestGenerateKMSEncryptionConfig(t *testing.T) { { name: "When active key ARN is empty, it should return an error", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: ""}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: ""}, + nil, "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, apiVersion: "v2", validate: func(g Gomega, config *v1.EncryptionConfiguration, err error) { @@ -88,12 +89,12 @@ func TestGenerateKMSEncryptionConfig(t *testing.T) { }, }, { - name: "When only active key is provided, it should generate config with 2 providers (KMS + identity)", + name: "When only write key is provided, it should generate config with 2 providers (KMS + identity)", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, + nil, "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, apiVersion: "v2", validate: func(g Gomega, config *v1.EncryptionConfiguration, err error) { @@ -105,13 +106,13 @@ func TestGenerateKMSEncryptionConfig(t *testing.T) { }, }, { - name: "When active and backup keys are provided, it should generate config with 3 providers (active KMS + backup KMS + identity)", + name: "When write and read keys are provided, it should generate config with 3 providers (write KMS + read KMS + identity)", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/active-key"}, - BackupKey: &hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/backup-key"}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/active-key"}, + &hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/backup-key"}, + "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, apiVersion: "v2", validate: func(g Gomega, config *v1.EncryptionConfiguration, err error) { @@ -124,13 +125,13 @@ func TestGenerateKMSEncryptionConfig(t *testing.T) { }, }, { - name: "When backup key ARN is empty, it should only include active KMS provider", + name: "When read key ARN is empty, it should only include write KMS provider", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, - BackupKey: &hyperv1.AWSKMSKeyEntry{ARN: ""}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, + &hyperv1.AWSKMSKeyEntry{ARN: ""}, + "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, apiVersion: "v2", validate: func(g Gomega, config *v1.EncryptionConfiguration, err error) { @@ -144,10 +145,10 @@ func TestGenerateKMSEncryptionConfig(t *testing.T) { { name: "When called, it should set the correct API version on the encryption config", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, + nil, "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, apiVersion: "v2", validate: func(g Gomega, config *v1.EncryptionConfiguration, err error) { @@ -159,11 +160,11 @@ func TestGenerateKMSEncryptionConfig(t *testing.T) { { name: "When called, it should set timeout to 35 seconds on KMS providers", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/active-key"}, - BackupKey: &hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/backup-key"}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/active-key"}, + &hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/backup-key"}, + "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, apiVersion: "v2", validate: func(g Gomega, config *v1.EncryptionConfiguration, err error) { @@ -179,10 +180,10 @@ func TestGenerateKMSEncryptionConfig(t *testing.T) { { name: "When called, the KMS provider name should be based on a hash of the ARN", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, + nil, "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, apiVersion: "v2", validate: func(g Gomega, config *v1.EncryptionConfiguration, err error) { @@ -206,7 +207,11 @@ func TestGenerateKMSEncryptionConfig(t *testing.T) { g := NewWithT(t) provider, err := tc.provider() - g.Expect(err).ToNot(HaveOccurred()) + if err != nil { + // Constructor-level validation error (e.g., empty write key ARN). + tc.validate(g, nil, err) + return + } config, err := provider.GenerateKMSEncryptionConfig(tc.apiVersion) tc.validate(g, config, err) @@ -223,12 +228,12 @@ func TestGenerateKMSPodConfig(t *testing.T) { validate func(g Gomega, podConfig *KMSPodConfig, err error) }{ { - name: "When active key ARN is empty, it should return an error", + name: "When write key ARN is empty, it should return an error", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: ""}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: ""}, + nil, "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, validate: func(g Gomega, podConfig *KMSPodConfig, err error) { g.Expect(err).To(HaveOccurred()) @@ -238,10 +243,10 @@ func TestGenerateKMSPodConfig(t *testing.T) { { name: "When kms image is empty, it should return an error", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, - Region: "us-east-1", - }, "", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, + nil, "us-east-1", + "", "quay.io/test/token-minter:latest") }, validate: func(g Gomega, podConfig *KMSPodConfig, err error) { g.Expect(err).To(HaveOccurred()) @@ -249,12 +254,12 @@ func TestGenerateKMSPodConfig(t *testing.T) { }, }, { - name: "When valid config is provided without backup key, it should return 2 containers (token-minter + active)", + name: "When valid config is provided without read key, it should return 2 containers (token-minter + active)", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, + nil, "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, validate: func(g Gomega, podConfig *KMSPodConfig, err error) { g.Expect(err).ToNot(HaveOccurred()) @@ -264,13 +269,13 @@ func TestGenerateKMSPodConfig(t *testing.T) { }, }, { - name: "When valid config is provided with backup key, it should return 3 containers (token-minter + active + backup)", + name: "When valid config is provided with read key, it should return 3 containers (token-minter + active + backup)", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/active-key"}, - BackupKey: &hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/backup-key"}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/active-key"}, + &hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/backup-key"}, + "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, validate: func(g Gomega, podConfig *KMSPodConfig, err error) { g.Expect(err).ToNot(HaveOccurred()) @@ -283,10 +288,10 @@ func TestGenerateKMSPodConfig(t *testing.T) { { name: "When valid config is provided, it should return 3 volumes", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, + nil, "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, validate: func(g Gomega, podConfig *KMSPodConfig, err error) { g.Expect(err).ToNot(HaveOccurred()) @@ -299,10 +304,10 @@ func TestGenerateKMSPodConfig(t *testing.T) { { name: "When valid config is provided, it should set KASContainerMutate function", provider: func() (*awsKMSProvider, error) { - return NewAWSKMSProvider(&hyperv1.AWSKMSSpec{ - ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, - Region: "us-east-1", - }, "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") + return NewAWSKMSProvider( + hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/test-key-id"}, + nil, "us-east-1", + "quay.io/test/kms:latest", "quay.io/test/token-minter:latest") }, validate: func(g Gomega, podConfig *KMSPodConfig, err error) { g.Expect(err).ToNot(HaveOccurred()) @@ -317,7 +322,11 @@ func TestGenerateKMSPodConfig(t *testing.T) { g := NewWithT(t) provider, err := tc.provider() - g.Expect(err).ToNot(HaveOccurred()) + if err != nil { + // Constructor-level validation error (e.g., empty write key ARN). + tc.validate(g, nil, err) + return + } podConfig, err := provider.GenerateKMSPodConfig() tc.validate(g, podConfig, err) diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go index 8f9cbb83539e..242950545543 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go @@ -37,6 +37,15 @@ const ( azureProviderConfigNamePrefix = "azure" ) +// AzureKMSProviderName computes the EncryptionConfiguration KMS provider name for an Azure KMS key. +func AzureKMSProviderName(key hyperv1.AzureKMSKey) (string, error) { + h, err := util.HashStruct(key) + if err != nil { + return "", err + } + return fmt.Sprintf("%s-%s", azureProviderConfigNamePrefix, h), nil +} + var ( azureKMSVolumeMounts = podspec.VolumeMounts{ KasMainContainerName: { @@ -59,6 +68,8 @@ var ( var _ KMSProvider = &azureKMSProvider{} type azureKMSProvider struct { + writeKey hyperv1.AzureKMSKey + readKey *hyperv1.AzureKMSKey kmsSpec *hyperv1.AzureKMSSpec kmsImage string isSelfManaged bool @@ -75,7 +86,7 @@ type AzureKMSProviderOptions struct { TokenMinterImage string } -func NewAzureKMSProvider(kmsSpec *hyperv1.AzureKMSSpec, image string, opts AzureKMSProviderOptions) (*azureKMSProvider, error) { +func NewAzureKMSProvider(writeKey hyperv1.AzureKMSKey, readKey *hyperv1.AzureKMSKey, kmsSpec *hyperv1.AzureKMSSpec, image string, opts AzureKMSProviderOptions) (*azureKMSProvider, error) { if kmsSpec == nil { return nil, fmt.Errorf("azure kms metadata not specified") } @@ -88,6 +99,8 @@ func NewAzureKMSProvider(kmsSpec *hyperv1.AzureKMSSpec, image string, opts Azure } } return &azureKMSProvider{ + writeKey: writeKey, + readKey: readKey, kmsSpec: kmsSpec, kmsImage: image, isSelfManaged: opts.IsSelfManaged, @@ -100,26 +113,26 @@ func NewAzureKMSProvider(kmsSpec *hyperv1.AzureKMSSpec, image string, opts Azure func (p *azureKMSProvider) GenerateKMSEncryptionConfig(apiVersion string) (*v1.EncryptionConfiguration, error) { var providerConfiguration []v1.ProviderConfiguration - activeKeyHash, err := util.HashStruct(p.kmsSpec.ActiveKey) + writeKeyName, err := AzureKMSProviderName(p.writeKey) if err != nil { return nil, err } providerConfiguration = append(providerConfiguration, v1.ProviderConfiguration{ KMS: &v1.KMSConfiguration{ - Name: fmt.Sprintf("%s-%s", azureProviderConfigNamePrefix, activeKeyHash), + Name: writeKeyName, APIVersion: apiVersion, Endpoint: azureActiveKMSUnixSocket, Timeout: &metav1.Duration{Duration: 35 * time.Second}, }, }) - if p.kmsSpec.BackupKey != nil { - backupKeyHash, err := util.HashStruct(p.kmsSpec.BackupKey) + if p.readKey != nil { + readKeyName, err := AzureKMSProviderName(*p.readKey) if err != nil { return nil, err } providerConfiguration = append(providerConfiguration, v1.ProviderConfiguration{ KMS: &v1.KMSConfiguration{ - Name: fmt.Sprintf("%s-%s", azureProviderConfigNamePrefix, backupKeyHash), + Name: readKeyName, APIVersion: apiVersion, Endpoint: azureBackupKMSUnixSocket, Timeout: &metav1.Duration{Duration: 35 * time.Second}, @@ -166,13 +179,19 @@ func (p *azureKMSProvider) GenerateKMSPodConfig() (*KMSPodConfig, error) { podConfig.Containers = append(podConfig.Containers, podspec.BuildContainer( kasContainerAzureKMSActive(), - p.buildKASContainerAzureKMS(p.kmsSpec.ActiveKey, azureActiveKMSUnixSocket, azureActiveKMSHealthPort, azureActiveKMSMetricsAddr)), + p.buildKASContainerAzureKMS(p.writeKey, azureActiveKMSUnixSocket, azureActiveKMSHealthPort, azureActiveKMSMetricsAddr)), ) - if p.kmsSpec.BackupKey != nil { + if p.readKey != nil { podConfig.Containers = append(podConfig.Containers, podspec.BuildContainer( kasContainerAzureKMSBackup(), - p.buildKASContainerAzureKMS(*p.kmsSpec.BackupKey, azureBackupKMSUnixSocket, azureBackupKMSHealthPort, azureBackupKMSMetricsAddr)), + p.buildKASContainerAzureKMS(*p.readKey, azureBackupKMSUnixSocket, azureBackupKMSHealthPort, azureBackupKMSMetricsAddr)), + ) + } + + if p.isSelfManaged { + podConfig.Containers = append(podConfig.Containers, + podspec.BuildContainer(kasContainerAzureKMSTokenMinter(), p.buildKASContainerAzureKMSTokenMinter()), ) } diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure_test.go index 0b2bc35ec58c..f4f26bd64c20 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure_test.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure_test.go @@ -33,7 +33,7 @@ func validAzureKMSSpec() *hyperv1.AzureKMSSpec { func validAzureKMSSpecWithBackup() *hyperv1.AzureKMSSpec { spec := validAzureKMSSpec() - spec.BackupKey = &hyperv1.AzureKMSKey{ + spec.BackupKey = &hyperv1.AzureKMSKey{ //nolint:staticcheck KeyVaultName: "test-vault", KeyName: "backup-key", KeyVersion: "1", @@ -41,6 +41,16 @@ func validAzureKMSSpecWithBackup() *hyperv1.AzureKMSSpec { return spec } +func newTestAzureKMSProvider(spec *hyperv1.AzureKMSSpec, image string, opts AzureKMSProviderOptions) (*azureKMSProvider, error) { + var writeKey hyperv1.AzureKMSKey + var readKey *hyperv1.AzureKMSKey + if spec != nil { + writeKey = spec.ActiveKey + readKey = spec.BackupKey //nolint:staticcheck + } + return NewAzureKMSProvider(writeKey, readKey, spec, image, opts) +} + func TestNewAzureKMSProvider(t *testing.T) { tests := []struct { name string @@ -122,7 +132,7 @@ func TestNewAzureKMSProvider(t *testing.T) { t.Run(tc.name, func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(tc.kmsSpec, tc.image, tc.opts) + provider, err := newTestAzureKMSProvider(tc.kmsSpec, tc.image, tc.opts) if tc.expectError { g.Expect(err).To(HaveOccurred()) g.Expect(err.Error()).To(ContainSubstring(tc.errContains)) @@ -240,7 +250,7 @@ func TestGenerateKMSPodConfig_SelfManaged(t *testing.T) { t.Run(tc.name, func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: true, KMSClientID: "test-client-id", TenantID: "test-tenant-id", @@ -321,7 +331,7 @@ func TestGenerateKMSPodConfig_Managed(t *testing.T) { t.Run(tc.name, func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: false, }) g.Expect(err).NotTo(HaveOccurred()) @@ -339,7 +349,7 @@ func TestGenerateKMSPodConfig_BackupKey(t *testing.T) { t.Run("When self-managed backup key is specified it should include backup KMS container with env vars", func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: true, KMSClientID: "test-client-id", TenantID: "test-tenant-id", @@ -371,7 +381,7 @@ func TestGenerateKMSPodConfig_BackupKey(t *testing.T) { t.Run("When managed backup key is specified it should include backup container with secret-store mount", func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: false, }) g.Expect(err).NotTo(HaveOccurred()) @@ -415,7 +425,7 @@ func findContainer(containers []corev1.Container, name string) *corev1.Container func TestGenerateKMSPodConfig_ActiveContainerArgs(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: false, }) g.Expect(err).NotTo(HaveOccurred()) @@ -479,7 +489,7 @@ func TestGenerateKMSPodConfig_ActiveContainerArgs(t *testing.T) { func TestGenerateKMSPodConfig_BackupContainerArgs(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: false, }) g.Expect(err).NotTo(HaveOccurred()) @@ -550,7 +560,7 @@ func TestGenerateKMSPodConfig_LivenessProbe(t *testing.T) { t.Run(fmt.Sprintf("When %s is created it should have a correctly configured liveness probe", tc.name), func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: false, }) g.Expect(err).NotTo(HaveOccurred()) @@ -577,7 +587,7 @@ func TestGenerateKMSPodConfig_LivenessProbe(t *testing.T) { func TestGenerateKMSPodConfig_ResourceRequests(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: true, KMSClientID: "test-client-id", TenantID: "test-tenant-id", @@ -690,7 +700,7 @@ func TestGenerateKMSPodConfig_VolumeMountPaths(t *testing.T) { for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", tc.opts) + provider, err := newTestAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", tc.opts) g.Expect(err).NotTo(HaveOccurred()) podConfig, err := provider.GenerateKMSPodConfig() g.Expect(err).NotTo(HaveOccurred()) @@ -703,7 +713,7 @@ func TestGenerateKMSPodConfig_KASContainerMutation(t *testing.T) { t.Run("When KAS container mutation is applied it should mount the KMS socket volume at /opt", func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: false, }) g.Expect(err).NotTo(HaveOccurred()) @@ -725,7 +735,7 @@ func TestGenerateKMSPodConfig_KASContainerMutation(t *testing.T) { func TestGenerateKMSPodConfig_ContainerPorts(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpecWithBackup(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: false, }) g.Expect(err).NotTo(HaveOccurred()) @@ -766,7 +776,7 @@ func TestGenerateKMSPodConfig_ContainerPorts(t *testing.T) { func TestGenerateKMSPodConfig_ImagePullPolicy(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: true, KMSClientID: "test-client-id", TenantID: "test-tenant-id", @@ -805,7 +815,7 @@ func TestGenerateKMSPodConfig_NoBackupContainerWithoutBackupKey(t *testing.T) { t.Run("When no backup key is specified it should not create a backup container", func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(validAzureKMSSpec(), "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: false, }) g.Expect(err).NotTo(HaveOccurred()) @@ -838,7 +848,7 @@ func TestGenerateKMSEncryptionConfig_Azure(t *testing.T) { t.Run(tc.name, func(t *testing.T) { g := NewWithT(t) - provider, err := NewAzureKMSProvider(tc.spec, "test-kms-image:latest", AzureKMSProviderOptions{ + provider, err := newTestAzureKMSProvider(tc.spec, "test-kms-image:latest", AzureKMSProviderOptions{ IsSelfManaged: false, }) g.Expect(err).NotTo(HaveOccurred()) @@ -852,7 +862,7 @@ func TestGenerateKMSEncryptionConfig_Azure(t *testing.T) { g.Expect(encConfig.Resources[0].Resources).To(Equal(config.KMSEncryptedObjects())) providers := encConfig.Resources[0].Providers - if tc.spec.BackupKey != nil { + if tc.spec.BackupKey != nil { //nolint:staticcheck g.Expect(providers).To(HaveLen(3), "expected active KMS + backup KMS + Identity") } else { g.Expect(providers).To(HaveLen(2), "expected active KMS + Identity") @@ -867,9 +877,9 @@ func TestGenerateKMSEncryptionConfig_Azure(t *testing.T) { g.Expect(providers[0].KMS.Endpoint).To(Equal(azureActiveKMSUnixSocket)) g.Expect(providers[0].KMS.Timeout).To(Equal(&metav1.Duration{Duration: 35 * time.Second})) - if tc.spec.BackupKey != nil { + if tc.spec.BackupKey != nil { //nolint:staticcheck g.Expect(providers[1].KMS).NotTo(BeNil()) - backupKeyHash, err := util.HashStruct(tc.spec.BackupKey) + backupKeyHash, err := util.HashStruct(tc.spec.BackupKey) //nolint:staticcheck g.Expect(err).NotTo(HaveOccurred()) g.Expect(providers[1].KMS.Name).To(Equal(fmt.Sprintf("azure-%s", backupKeyHash))) g.Expect(providers[1].KMS.Endpoint).To(Equal(azureBackupKMSUnixSocket)) diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/ibmcloud.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/ibmcloud.go index 0e3ba9cfc67f..0bbf0df7ad58 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/ibmcloud.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/ibmcloud.go @@ -42,6 +42,13 @@ const ( ibmCloudKMSHealthPort = 8081 ) +// IBMCloudKMSProviderName returns the fixed EncryptionConfiguration KMS provider +// name used for IBM Cloud. Unlike AWS/Azure, IBM Cloud always uses a single +// provider with all key versions bundled into the sidecar. +func IBMCloudKMSProviderName() string { + return fmt.Sprintf("%s%s", ibmKeyNamePrefix, "v2") +} + var _ KMSProvider = &ibmCloudKMSProvider{} type ibmCloudKMSProvider struct { @@ -65,7 +72,7 @@ func (p *ibmCloudKMSProvider) GenerateKMSEncryptionConfig(_ string) (*v1.Encrypt { KMS: &v1.KMSConfiguration{ APIVersion: "v2", - Name: fmt.Sprintf("%s%s", ibmKeyNamePrefix, "v2"), + Name: IBMCloudKMSProviderName(), Endpoint: ibmCloudKMSUnixSocket, Timeout: &metav1.Duration{Duration: 35 * time.Second}, }, @@ -299,7 +306,6 @@ func (p *ibmCloudKMSProvider) GenerateKMSPodConfig() (*KMSPodConfig, error) { podConfig.KASContainerMutate = func(c *corev1.Container) { c.VolumeMounts = append(c.VolumeMounts, ibmCloudKMSVolumeMounts.ContainerMounts(KasMainContainerName)...) - c.Args = append(c.Args, "--encryption-provider-config-automatic-reload=false") } return podConfig, nil diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/kms.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/kms.go index cbd26825658d..66c970a8d17b 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/kms.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/kms.go @@ -1,6 +1,8 @@ package kms import ( + "github.com/openshift/hypershift/support/secretencryption" + corev1 "k8s.io/api/core/v1" v1 "k8s.io/apiserver/pkg/apis/apiserver/v1" ) @@ -20,7 +22,7 @@ type KMSProvider interface { const ( KasMainContainerName = "kube-apiserver" - encryptionConfigurationKind = "EncryptionConfiguration" + encryptionConfigurationKind = secretencryption.EncryptionConfigurationKind kasVolumeLocalhostKubeconfig = "localhost-kubeconfig" ) diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go new file mode 100644 index 000000000000..569922f01123 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go @@ -0,0 +1,176 @@ +package kas + +import ( + "testing" + + . "github.com/onsi/gomega" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms" + + apiserverv1 "k8s.io/apiserver/pkg/apis/apiserver/v1" +) + +func TestDeriveKMSKeys(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + kmsSpec *hyperv1.KMSSpec + encStatus *hyperv1.SecretEncryptionStatus + currentConfig *apiserverv1.EncryptionConfiguration + kasConverged bool + validate func(g Gomega, keys kmsWriteReadKeys) + }{ + { + name: "When AWS with nil status it should use spec active key as write with spec backup as read", + kmsSpec: &hyperv1.KMSSpec{ + Provider: hyperv1.AWS, + AWS: &hyperv1.AWSKMSSpec{ + ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/new-key"}, + BackupKey: &hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/old-key"}, + Region: "us-east-1", + }, + }, + encStatus: nil, + validate: func(g Gomega, keys kmsWriteReadKeys) { + g.Expect(keys.awsWrite).ToNot(BeNil()) + g.Expect(keys.awsWrite.ARN).To(Equal("arn:aws:kms:us-east-1:123456789:key/new-key")) + g.Expect(keys.awsRead).ToNot(BeNil()) + g.Expect(keys.awsRead.ARN).To(Equal("arn:aws:kms:us-east-1:123456789:key/old-key")) + }, + }, + { + name: "When AWS with status set but no target key it should use only write key", + kmsSpec: &hyperv1.KMSSpec{ + Provider: hyperv1.AWS, + AWS: &hyperv1.AWSKMSSpec{ + ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/current-key"}, + Region: "us-east-1", + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAWS, + AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/current-key", Region: "us-east-1"}, + }, + }, + validate: func(g Gomega, keys kmsWriteReadKeys) { + g.Expect(keys.awsWrite).ToNot(BeNil()) + g.Expect(keys.awsWrite.ARN).To(Equal("arn:aws:kms:us-east-1:123456789:key/current-key")) + g.Expect(keys.awsRead).To(BeNil()) + }, + }, + { + name: "When AWS rotation in progress and target key absent from config it should use old key as write (ReadOnlyDeploy)", + kmsSpec: &hyperv1.KMSSpec{ + Provider: hyperv1.AWS, + AWS: &hyperv1.AWSKMSSpec{ + ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/new-key"}, + Region: "us-east-1", + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAWS, + AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/old-key", Region: "us-east-1"}, + }, + TargetKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAWS, + AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/new-key", Region: "us-east-1"}, + }, + }, + currentConfig: nil, + validate: func(g Gomega, keys kmsWriteReadKeys) { + g.Expect(keys.awsWrite.ARN).To(Equal("arn:aws:kms:us-east-1:123456789:key/old-key"), "old key should be write during ReadOnlyDeploy") + g.Expect(keys.awsRead.ARN).To(Equal("arn:aws:kms:us-east-1:123456789:key/new-key"), "new key should be read-only during ReadOnlyDeploy") + }, + }, + { + name: "When AWS rotation in progress and target key present in config it should promote target to write (WritePromote)", + kmsSpec: &hyperv1.KMSSpec{ + Provider: hyperv1.AWS, + AWS: &hyperv1.AWSKMSSpec{ + ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/new-key"}, + Region: "us-east-1", + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAWS, + AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/old-key", Region: "us-east-1"}, + }, + TargetKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAWS, + AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/new-key", Region: "us-east-1"}, + }, + }, + currentConfig: kmsEncryptionConfig( + mustAWSProviderName("arn:aws:kms:us-east-1:123456789:key/old-key"), + mustAWSProviderName("arn:aws:kms:us-east-1:123456789:key/new-key"), + ), + kasConverged: true, + validate: func(g Gomega, keys kmsWriteReadKeys) { + g.Expect(keys.awsWrite.ARN).To(Equal("arn:aws:kms:us-east-1:123456789:key/new-key"), "target key should be write after promotion") + g.Expect(keys.awsRead.ARN).To(Equal("arn:aws:kms:us-east-1:123456789:key/old-key"), "old key should be read after promotion") + }, + }, + { + name: "When Azure rotation in progress and target key absent from config it should use old key as write", + kmsSpec: &hyperv1.KMSSpec{ + Provider: hyperv1.AZURE, + Azure: &hyperv1.AzureKMSSpec{ + ActiveKey: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKeyStatus{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, + }, + TargetKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKeyStatus{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, + }, + }, + currentConfig: nil, + validate: func(g Gomega, keys kmsWriteReadKeys) { + g.Expect(keys.azureWrite.KeyVersion).To(Equal("v1"), "old key should be write during ReadOnlyDeploy") + g.Expect(keys.azureRead.KeyVersion).To(Equal("v2"), "target key should be read-only during ReadOnlyDeploy") + }, + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + g := NewWithT(t) + + keys, err := deriveKMSKeys(tc.kmsSpec, tc.encStatus, tc.currentConfig, tc.kasConverged) + g.Expect(err).ToNot(HaveOccurred()) + tc.validate(g, keys) + }) + } +} + +func mustAWSProviderName(arn string) string { + name, _ := kms.AWSKMSProviderName(arn) + return name +} + +func kmsEncryptionConfig(writeProviderName, readProviderName string) *apiserverv1.EncryptionConfiguration { + providers := []apiserverv1.ProviderConfiguration{ + {KMS: &apiserverv1.KMSConfiguration{Name: writeProviderName, APIVersion: "v2"}}, + } + if readProviderName != "" { + providers = append(providers, apiserverv1.ProviderConfiguration{ + KMS: &apiserverv1.KMSConfiguration{Name: readProviderName, APIVersion: "v2"}, + }) + } + providers = append(providers, apiserverv1.ProviderConfiguration{Identity: &apiserverv1.IdentityConfiguration{}}) + return &apiserverv1.EncryptionConfiguration{ + Resources: []apiserverv1.ResourceConfiguration{ + {Providers: providers}, + }, + } +} diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption.go index 5baaf8c1f7f8..d9acda27073e 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption.go @@ -5,9 +5,11 @@ import ( hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/manifests" - "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/api" component "github.com/openshift/hypershift/support/controlplane-component" + "github.com/openshift/hypershift/support/podspec" + "github.com/openshift/hypershift/support/secretencryption" + appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -17,8 +19,8 @@ import ( ) const ( - secretEncryptionConfigurationKey = "config.yaml" - encryptionConfigurationKind = "EncryptionConfiguration" + secretEncryptionConfigurationKey = secretencryption.EncryptionConfigurationKey + encryptionConfigurationKind = secretencryption.EncryptionConfigurationKind secretEncryptionConfigFileVolumeName = "kas-secret-encryption-config" ) @@ -30,43 +32,23 @@ func secretEncryptionConfigPredicate(cpContext component.WorkloadContext) bool { func adaptSecretEncryptionConfig(cpContext component.WorkloadContext, secret *corev1.Secret) error { var data []byte secretEncryption := cpContext.HCP.Spec.SecretEncryption + encStatus := &cpContext.HCP.Status.SecretEncryption + + // Read the live encryption config from the cluster to derive the two-stage rollout state. + currentConfig, err := readCurrentEncryptionConfig(cpContext, secret) + if err != nil { + return fmt.Errorf("failed to read current encryption config: %w", err) + } + + // Check KAS convergence — needed to decide whether to promote the target key. + kasConverged, err := isKASConverged(cpContext) + if err != nil { + return fmt.Errorf("failed to check KAS convergence: %w", err) + } + switch secretEncryption.Type { case hyperv1.AESCBC: - if secretEncryption.AESCBC == nil || len(secretEncryption.AESCBC.ActiveKey.Name) == 0 { - return fmt.Errorf("aescbc metadata not specified") - } - activeKeySecret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: secretEncryption.AESCBC.ActiveKey.Name, - Namespace: cpContext.HCP.Namespace, - }, - } - if err := cpContext.Client.Get(cpContext, client.ObjectKeyFromObject(activeKeySecret), activeKeySecret); err != nil { - return fmt.Errorf("failed to get aescbc active secret: %w", err) - } - if _, ok := activeKeySecret.Data[hyperv1.AESCBCKeySecretKey]; !ok { - return fmt.Errorf("aescbc key field '%s' in active key secret not specified", hyperv1.AESCBCKeySecretKey) - } - aesCBCActiveKey := activeKeySecret.Data[hyperv1.AESCBCKeySecretKey] - var aesCBCBackupKey []byte - if secretEncryption.AESCBC.BackupKey != nil && len(secretEncryption.AESCBC.BackupKey.Name) > 0 { - backupKeySecret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: secretEncryption.AESCBC.BackupKey.Name, - Namespace: cpContext.HCP.Namespace, - }, - } - if err := cpContext.Client.Get(cpContext, client.ObjectKeyFromObject(backupKeySecret), backupKeySecret); err != nil { - return fmt.Errorf("failed to get aescbc backup key secret: %w", err) - } - if _, ok := backupKeySecret.Data[hyperv1.AESCBCKeySecretKey]; !ok { - return fmt.Errorf("aescbc key field %s in backup key secret not specified", hyperv1.AESCBCKeySecretKey) - } - aesCBCBackupKey = backupKeySecret.Data[hyperv1.AESCBCKeySecretKey] - } - - var err error - data, err = generateAESCBCEncryptionConfig(aesCBCActiveKey, aesCBCBackupKey) + data, err = deriveAESCBCEncryptionConfig(cpContext, secretEncryption, encStatus, currentConfig, kasConverged) if err != nil { return err } @@ -74,11 +56,8 @@ func adaptSecretEncryptionConfig(cpContext component.WorkloadContext, secret *co if secretEncryption.KMS == nil { return fmt.Errorf("kms metadata not specified") } - apiVersion, err := getKMSAPIVersion(cpContext, secret) - if err != nil { - return err - } - data, err = generateKMSEncryptionConfig(secretEncryption.KMS, apiVersion) + apiVersion := getKMSAPIVersion(currentConfig) + data, err = generateKMSEncryptionConfig(secretEncryption.KMS, encStatus, currentConfig, kasConverged, apiVersion) if err != nil { return err } @@ -88,36 +67,133 @@ func adaptSecretEncryptionConfig(cpContext component.WorkloadContext, secret *co return nil } -// getKMSAPIVersion returns the KMS API version from the given EncryptionConfig secret. -// If the current state is using the IdentityProvider, the function returns v2 as the default version to start with. -func getKMSAPIVersion(cpContext component.WorkloadContext, secret *corev1.Secret) (string, error) { - apiVersion := "v2" - if err := cpContext.Client.Get(cpContext, client.ObjectKeyFromObject(secret), secret); err != nil { +// isKASConverged checks if the KAS Deployment has fully rolled out. +// Returns false (not error) if the deployment doesn't exist yet. +func isKASConverged(cpContext component.WorkloadContext) (bool, error) { + kasDeployment := &appsv1.Deployment{} + kasRef := manifests.KASDeployment(cpContext.HCP.Namespace) + if err := cpContext.Client.Get(cpContext, client.ObjectKeyFromObject(kasRef), kasDeployment); err != nil { if apierrors.IsNotFound(err) { - return apiVersion, nil + return false, nil } - return "", fmt.Errorf("failed to get existing secret encryption config: %w", err) + return false, fmt.Errorf("failed to get KAS deployment: %w", err) } + return podspec.IsDeploymentReady(cpContext, kasDeployment), nil +} - encryptionConfigBytes := secret.Data[secretEncryptionConfigurationKey] - if len(encryptionConfigBytes) > 0 { - currentConfig := apiserverv1.EncryptionConfiguration{} - gvks, _, err := api.Scheme.ObjectKinds(¤tConfig) - if err != nil || len(gvks) == 0 { - return "", fmt.Errorf("cannot determine gvk of resource: %w", err) +// readCurrentEncryptionConfig reads the live encryption config secret from the +// cluster and parses its EncryptionConfiguration. Returns nil (not an error) +// if the secret does not exist yet. +func readCurrentEncryptionConfig(cpContext component.WorkloadContext, templateSecret *corev1.Secret) (*apiserverv1.EncryptionConfiguration, error) { + existingSecret := &corev1.Secret{} + if err := cpContext.Client.Get(cpContext, client.ObjectKeyFromObject(templateSecret), existingSecret); err != nil { + if apierrors.IsNotFound(err) { + return nil, nil } - if _, _, err = api.YamlSerializer.Decode(encryptionConfigBytes, &gvks[0], ¤tConfig); err != nil { - return "", fmt.Errorf("cannot decode resource: %w", err) + return nil, err + } + + configBytes := existingSecret.Data[secretEncryptionConfigurationKey] + if len(configBytes) == 0 { + return nil, nil + } + + return secretencryption.DecodeEncryptionConfiguration(configBytes) +} + +// deriveAESCBCEncryptionConfig determines the AESCBC write and read keys using +// the two-stage rollout pattern, then generates the EncryptionConfiguration. +// +// Two-stage derivation: +// - No targetKey: spec.activeKey is the sole write key. +// - targetKey set, target not yet promoted in current config: ReadOnlyDeploy — +// old key (status.activeKey) writes, new key (status.targetKey) reads. +// - targetKey set and already promoted in current config: WritePromote/Migrating — +// new key (status.targetKey) writes, old key (status.activeKey) reads. +// - status has no active key (upgrade transition): fall back to spec.backupKey. +func deriveAESCBCEncryptionConfig(cpContext component.WorkloadContext, secretEncryption *hyperv1.SecretEncryptionSpec, encStatus *hyperv1.SecretEncryptionStatus, currentConfig *apiserverv1.EncryptionConfiguration, kasConverged bool) ([]byte, error) { + if secretEncryption.AESCBC == nil || len(secretEncryption.AESCBC.ActiveKey.Name) == 0 { + return nil, fmt.Errorf("aescbc metadata not specified") + } + + if encStatus == nil || encStatus.ActiveKey.Provider == "" { + // Upgrade transition or initial setup: use spec keys with deprecated backupKey fallback. + writeKeyData, err := fetchAESCBCKeyData(cpContext, secretEncryption.AESCBC.ActiveKey.Name) + if err != nil { + return nil, fmt.Errorf("failed to get aescbc active key: %w", err) + } + var readKeyData []byte + if secretEncryption.AESCBC.BackupKey != nil && len(secretEncryption.AESCBC.BackupKey.Name) > 0 { //nolint:staticcheck + readKeyData, err = fetchAESCBCKeyData(cpContext, secretEncryption.AESCBC.BackupKey.Name) //nolint:staticcheck + if err != nil { + return nil, fmt.Errorf("failed to get aescbc backup key: %w", err) + } } + return generateAESCBCEncryptionConfig(writeKeyData, readKeyData) + } + + if encStatus.TargetKey.Provider == "" || encStatus.TargetKey.AESCBC.DataHash == "" || encStatus.ActiveKey.AESCBC.DataHash == "" { + // No rotation in progress or provider mismatch: spec.activeKey is the sole write key. + writeKeyData, err := fetchAESCBCKeyData(cpContext, secretEncryption.AESCBC.ActiveKey.Name) + if err != nil { + return nil, fmt.Errorf("failed to get aescbc active key: %w", err) + } + return generateAESCBCEncryptionConfig(writeKeyData, nil) + } + + // Rotation in progress. Fetch both keys. + targetSecretName := encStatus.TargetKey.AESCBC.Secret.Name + oldSecretName := encStatus.ActiveKey.AESCBC.Secret.Name + targetKeyData, err := fetchAESCBCKeyData(cpContext, targetSecretName) + if err != nil { + return nil, fmt.Errorf("failed to get aescbc target key secret %q: %w", targetSecretName, err) + } + oldKeyData, err := fetchAESCBCKeyData(cpContext, oldSecretName) + if err != nil { + return nil, fmt.Errorf("failed to get aescbc old key secret %q: %w", oldSecretName, err) + } + + // Determine stage from current EncryptionConfiguration. + targetKeyName, err := AESCBCKeyName(targetKeyData) + if err != nil { + return nil, fmt.Errorf("failed to compute aescbc target key name: %w", err) + } + if secretencryption.ShouldPromoteTargetKey(currentConfig, targetKeyName, hyperv1.AESCBC, kasConverged) { + return generateAESCBCEncryptionConfig(targetKeyData, oldKeyData) + } + // ReadOnlyDeploy: old key writes, target key reads. + return generateAESCBCEncryptionConfig(oldKeyData, targetKeyData) +} + +// fetchAESCBCKeyData retrieves the AESCBC key data from a named secret. +func fetchAESCBCKeyData(cpContext component.WorkloadContext, secretName string) ([]byte, error) { + keySecret := &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: secretName, + Namespace: cpContext.HCP.Namespace, + }, + } + if err := cpContext.Client.Get(cpContext, client.ObjectKeyFromObject(keySecret), keySecret); err != nil { + return nil, err + } + keyData, ok := keySecret.Data[hyperv1.AESCBCKeySecretKey] + if !ok { + return nil, fmt.Errorf("aescbc key field %q not found in secret %q", hyperv1.AESCBCKeySecretKey, secretName) + } + return keyData, nil +} - // Only look at write keys to return the APIVersion currently used. +// getKMSAPIVersion extracts the KMS API version from the current EncryptionConfiguration. +// Returns "v2" as default if no config exists or no KMS provider is configured. +func getKMSAPIVersion(currentConfig *apiserverv1.EncryptionConfiguration) string { + if currentConfig != nil { for _, r := range currentConfig.Resources { if len(r.Providers) > 0 && r.Providers[0].KMS != nil { - return r.Providers[0].KMS.APIVersion, nil + return r.Providers[0].KMS.APIVersion } } } - return apiVersion, nil + return "v2" } func buildVolumeSecretEncryptionConfigFile() corev1.Volume { diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption_test.go index 7f9d658ded65..a3037fe631e0 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption_test.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption_test.go @@ -3,6 +3,7 @@ package kas import ( "bytes" "context" + "encoding/base64" "fmt" "testing" "time" @@ -15,6 +16,7 @@ import ( controlplanecomponent "github.com/openshift/hypershift/support/controlplane-component" "github.com/openshift/hypershift/support/util" + appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" v1 "k8s.io/apiserver/pkg/apis/apiserver/v1" @@ -113,7 +115,25 @@ func TestReconcileKMSEncryptionConfigAWS(t *testing.T) { Data: make(map[string][]byte), } - clientBuilder := fake.NewClientBuilder().WithScheme(api.Scheme) + kasDeployment := &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{ + Name: "kube-apiserver", + Generation: 1, + }, + Spec: appsv1.DeploymentSpec{ + Replicas: ptr.To[int32](1), + }, + Status: appsv1.DeploymentStatus{ + ObservedGeneration: 1, + Replicas: 1, + UpdatedReplicas: 1, + ReadyReplicas: 1, + AvailableReplicas: 1, + UnavailableReplicas: 0, + }, + } + + clientBuilder := fake.NewClientBuilder().WithScheme(api.Scheme).WithObjects(kasDeployment) if tc.config != nil { buff := bytes.NewBuffer([]byte{}) err := api.YamlSerializer.Encode(tc.config, buff) @@ -501,3 +521,301 @@ func generateExpectedEncryptionConfig(apiVersion string) *v1.EncryptionConfigura return config } + +func TestDeriveAESCBCEncryptionConfig(t *testing.T) { + t.Parallel() + + const testNamespace = "test-namespace" + + newAESCBCKeySecret := func(name string, keyData []byte) *corev1.Secret { + return &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: testNamespace}, + Data: map[string][]byte{hyperv1.AESCBCKeySecretKey: keyData}, + } + } + + convergedKASDeployment := func() *appsv1.Deployment { + return &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{ + Name: "kube-apiserver", + Namespace: testNamespace, + Generation: 1, + }, + Spec: appsv1.DeploymentSpec{ + Replicas: ptr.To[int32](1), + }, + Status: appsv1.DeploymentStatus{ + ObservedGeneration: 1, + Replicas: 1, + UpdatedReplicas: 1, + ReadyReplicas: 1, + AvailableReplicas: 1, + UnavailableReplicas: 0, + }, + } + } + + decodeEncryptionConfig := func(g Gomega, data []byte) *v1.EncryptionConfiguration { + cfg := &v1.EncryptionConfiguration{} + gvks, _, err := api.Scheme.ObjectKinds(cfg) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(gvks).NotTo(BeEmpty()) + _, _, err = api.YamlSerializer.Decode(data, &gvks[0], cfg) + g.Expect(err).NotTo(HaveOccurred()) + return cfg + } + + testCases := []struct { + name string + secretObjects []*corev1.Secret + secretSpec *hyperv1.SecretEncryptionSpec + encStatus *hyperv1.SecretEncryptionStatus + currentConfig *v1.EncryptionConfiguration + kasConverged bool + verify func(g Gomega, data []byte) + }{ + { + name: "When status has no active key it should use spec active key as write key", + secretObjects: []*corev1.Secret{ + newAESCBCKeySecret("aescbc-key-1", []byte("active-key-data")), + }, + secretSpec: &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.AESCBC, + AESCBC: &hyperv1.AESCBCSpec{ + ActiveKey: corev1.LocalObjectReference{Name: "aescbc-key-1"}, + }, + }, + encStatus: nil, + verify: func(g Gomega, data []byte) { + cfg := decodeEncryptionConfig(g, data) + g.Expect(cfg.Resources).To(HaveLen(1)) + providers := cfg.Resources[0].Providers + g.Expect(providers).To(HaveLen(2)) + g.Expect(providers[0].AESCBC).NotTo(BeNil()) + g.Expect(providers[0].AESCBC.Keys).To(HaveLen(1)) + + expectedName, err := AESCBCKeyName([]byte("active-key-data")) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(providers[0].AESCBC.Keys[0].Name).To(Equal(expectedName)) + g.Expect(providers[0].AESCBC.Keys[0].Secret).To(Equal(base64.StdEncoding.EncodeToString([]byte("active-key-data")))) + + g.Expect(providers[1].Identity).NotTo(BeNil()) + }, + }, + { + name: "When status has no active key and backup key is set it should use both keys", + secretObjects: []*corev1.Secret{ + newAESCBCKeySecret("aescbc-key-1", []byte("active-key-data")), + newAESCBCKeySecret("aescbc-backup", []byte("backup-key-data")), + }, + secretSpec: &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.AESCBC, + AESCBC: &hyperv1.AESCBCSpec{ + ActiveKey: corev1.LocalObjectReference{Name: "aescbc-key-1"}, + BackupKey: &corev1.LocalObjectReference{Name: "aescbc-backup"}, + }, + }, + encStatus: nil, + verify: func(g Gomega, data []byte) { + cfg := decodeEncryptionConfig(g, data) + g.Expect(cfg.Resources).To(HaveLen(1)) + providers := cfg.Resources[0].Providers + g.Expect(providers).To(HaveLen(2)) + g.Expect(providers[0].AESCBC).NotTo(BeNil()) + g.Expect(providers[0].AESCBC.Keys).To(HaveLen(2)) + + activeKeyName, err := AESCBCKeyName([]byte("active-key-data")) + g.Expect(err).NotTo(HaveOccurred()) + backupKeyName, err := AESCBCKeyName([]byte("backup-key-data")) + g.Expect(err).NotTo(HaveOccurred()) + + g.Expect(providers[0].AESCBC.Keys[0].Name).To(Equal(activeKeyName)) + g.Expect(providers[0].AESCBC.Keys[1].Name).To(Equal(backupKeyName)) + }, + }, + { + name: "When no rotation in progress it should use spec active key only", + secretObjects: []*corev1.Secret{ + newAESCBCKeySecret("aescbc-key-1", []byte("active-key-data")), + }, + secretSpec: &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.AESCBC, + AESCBC: &hyperv1.AESCBCSpec{ + ActiveKey: corev1.LocalObjectReference{Name: "aescbc-key-1"}, + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAESCBC, + AESCBC: hyperv1.AESCBCKeyStatus{ + Secret: corev1.LocalObjectReference{Name: "aescbc-key-1"}, + DataHash: "activehash", + }, + }, + }, + verify: func(g Gomega, data []byte) { + cfg := decodeEncryptionConfig(g, data) + g.Expect(cfg.Resources).To(HaveLen(1)) + providers := cfg.Resources[0].Providers + g.Expect(providers).To(HaveLen(2)) + g.Expect(providers[0].AESCBC).NotTo(BeNil()) + g.Expect(providers[0].AESCBC.Keys).To(HaveLen(1)) + + expectedName, err := AESCBCKeyName([]byte("active-key-data")) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(providers[0].AESCBC.Keys[0].Name).To(Equal(expectedName)) + }, + }, + { + name: "When rotation in progress and target key is read-only it should keep old key as write", + secretObjects: []*corev1.Secret{ + newAESCBCKeySecret("old-key-secret", []byte("old-key-data")), + newAESCBCKeySecret("new-key-secret", []byte("new-key-data")), + }, + secretSpec: &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.AESCBC, + AESCBC: &hyperv1.AESCBCSpec{ + ActiveKey: corev1.LocalObjectReference{Name: "new-key-secret"}, + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAESCBC, + AESCBC: hyperv1.AESCBCKeyStatus{ + Secret: corev1.LocalObjectReference{Name: "old-key-secret"}, + DataHash: "oldhash", + }, + }, + TargetKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAESCBC, + AESCBC: hyperv1.AESCBCKeyStatus{ + Secret: corev1.LocalObjectReference{Name: "new-key-secret"}, + DataHash: "newhash", + }, + }, + }, + currentConfig: func() *v1.EncryptionConfiguration { + oldKeyName, _ := AESCBCKeyName([]byte("old-key-data")) + targetKeyName, _ := AESCBCKeyName([]byte("new-key-data")) + return &v1.EncryptionConfiguration{ + Resources: []v1.ResourceConfiguration{{ + Providers: []v1.ProviderConfiguration{ + {AESCBC: &v1.AESConfiguration{Keys: []v1.Key{ + {Name: oldKeyName, Secret: base64.StdEncoding.EncodeToString([]byte("old-key-data"))}, + {Name: targetKeyName, Secret: base64.StdEncoding.EncodeToString([]byte("new-key-data"))}, + }}}, + {Identity: &v1.IdentityConfiguration{}}, + }, + }}, + } + }(), + kasConverged: false, + verify: func(g Gomega, data []byte) { + cfg := decodeEncryptionConfig(g, data) + g.Expect(cfg.Resources).To(HaveLen(1)) + providers := cfg.Resources[0].Providers + g.Expect(providers[0].AESCBC).NotTo(BeNil()) + g.Expect(providers[0].AESCBC.Keys).To(HaveLen(2)) + + oldKeyName, err := AESCBCKeyName([]byte("old-key-data")) + g.Expect(err).NotTo(HaveOccurred()) + targetKeyName, err := AESCBCKeyName([]byte("new-key-data")) + g.Expect(err).NotTo(HaveOccurred()) + + g.Expect(providers[0].AESCBC.Keys[0].Name).To(Equal(oldKeyName), "old key should remain the write key") + g.Expect(providers[0].AESCBC.Keys[1].Name).To(Equal(targetKeyName), "target key should be read-only") + }, + }, + { + name: "When rotation in progress and target key should be promoted it should swap keys", + secretObjects: []*corev1.Secret{ + newAESCBCKeySecret("old-key-secret", []byte("old-key-data")), + newAESCBCKeySecret("new-key-secret", []byte("new-key-data")), + }, + secretSpec: &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.AESCBC, + AESCBC: &hyperv1.AESCBCSpec{ + ActiveKey: corev1.LocalObjectReference{Name: "new-key-secret"}, + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAESCBC, + AESCBC: hyperv1.AESCBCKeyStatus{ + Secret: corev1.LocalObjectReference{Name: "old-key-secret"}, + DataHash: "oldhash", + }, + }, + TargetKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAESCBC, + AESCBC: hyperv1.AESCBCKeyStatus{ + Secret: corev1.LocalObjectReference{Name: "new-key-secret"}, + DataHash: "newhash", + }, + }, + }, + currentConfig: func() *v1.EncryptionConfiguration { + oldKeyName, _ := AESCBCKeyName([]byte("old-key-data")) + targetKeyName, _ := AESCBCKeyName([]byte("new-key-data")) + return &v1.EncryptionConfiguration{ + Resources: []v1.ResourceConfiguration{{ + Providers: []v1.ProviderConfiguration{ + {AESCBC: &v1.AESConfiguration{Keys: []v1.Key{ + {Name: oldKeyName, Secret: base64.StdEncoding.EncodeToString([]byte("old-key-data"))}, + {Name: targetKeyName, Secret: base64.StdEncoding.EncodeToString([]byte("new-key-data"))}, + }}}, + {Identity: &v1.IdentityConfiguration{}}, + }, + }}, + } + }(), + kasConverged: true, + verify: func(g Gomega, data []byte) { + cfg := decodeEncryptionConfig(g, data) + g.Expect(cfg.Resources).To(HaveLen(1)) + providers := cfg.Resources[0].Providers + g.Expect(providers[0].AESCBC).NotTo(BeNil()) + g.Expect(providers[0].AESCBC.Keys).To(HaveLen(2)) + + oldKeyName, err := AESCBCKeyName([]byte("old-key-data")) + g.Expect(err).NotTo(HaveOccurred()) + targetKeyName, err := AESCBCKeyName([]byte("new-key-data")) + g.Expect(err).NotTo(HaveOccurred()) + + g.Expect(providers[0].AESCBC.Keys[0].Name).To(Equal(targetKeyName), "target key should be promoted to write key") + g.Expect(providers[0].AESCBC.Keys[1].Name).To(Equal(oldKeyName), "old key should become read-only") + }, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + g := NewWithT(t) + + kasDeployment := convergedKASDeployment() + clientBuilder := fake.NewClientBuilder().WithScheme(api.Scheme).WithObjects(kasDeployment) + for _, s := range tc.secretObjects { + clientBuilder.WithObjects(s) + } + + cpContext := controlplanecomponent.WorkloadContext{ + HCP: &hyperv1.HostedControlPlane{ + ObjectMeta: metav1.ObjectMeta{ + Namespace: testNamespace, + }, + Spec: hyperv1.HostedControlPlaneSpec{ + SecretEncryption: tc.secretSpec, + }, + }, + Client: clientBuilder.Build(), + } + + data, err := deriveAESCBCEncryptionConfig(cpContext, tc.secretSpec, tc.encStatus, tc.currentConfig, tc.kasConverged) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(data).NotTo(BeEmpty()) + + tc.verify(g, data) + }) + } +} diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kube_storage_version_migrator/component.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kube_storage_version_migrator/component.go new file mode 100644 index 000000000000..4357e2b4aca2 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kube_storage_version_migrator/component.go @@ -0,0 +1,43 @@ +package kubestorageversionmigrator + +import ( + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + component "github.com/openshift/hypershift/support/controlplane-component" +) + +const ( + ComponentName = "kube-storage-version-migrator" +) + +var _ component.ComponentOptions = &migratorOptions{} + +type migratorOptions struct{} + +// IsRequestServing implements controlplanecomponent.ComponentOptions. +func (o *migratorOptions) IsRequestServing() bool { + return false +} + +// MultiZoneSpread implements controlplanecomponent.ComponentOptions. +func (o *migratorOptions) MultiZoneSpread() bool { + return false +} + +// NeedsManagementKASAccess implements controlplanecomponent.ComponentOptions. +func (o *migratorOptions) NeedsManagementKASAccess() bool { + return false +} + +func NewComponent() component.ControlPlaneComponent { + return component.NewDeploymentComponent(ComponentName, &migratorOptions{}). + WithPredicate(predicate). + Build() +} + +func predicate(cpContext component.WorkloadContext) (bool, error) { + p := cpContext.HCP.Spec.Platform.Type + if p == hyperv1.IBMCloudPlatform || p == hyperv1.PowerVSPlatform { + return false, nil + } + return cpContext.HCP.Spec.SecretEncryption != nil, nil +} From a9e3944ff9bca6bd2a1782a4d7652fb4e586de89 Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Thu, 21 May 2026 13:52:35 +0200 Subject: [PATCH 05/12] feat(control-plane-operator): add HCCO re-encryption controller Add re-encryption controller to the HCCO that drives the key rotation lifecycle by deriving the current phase from observable state: - Detect key changes by comparing spec vs status fingerprints - Derive phase from EncryptionConfiguration contents and KAS convergence - Create StorageVersionMigration CRs via KubeStorageVersionMigrator - Manage targetKey, activeKey, and history in HCP status - Set EtcdDataEncryptionUpToDate condition with phase-specific reasons - Expose Prometheus metrics for rotation state, duration, and failures Signed-off-by: Mulham Raee Commit-Message-Assisted-by: Claude (via Claude Code) --- .../hostedclusterconfigoperator/cmd.go | 2 + .../controllers/reencryption/metrics.go | 72 ++ .../controllers/reencryption/reencryption.go | 532 ++++++++++ .../reencryption/reencryption_test.go | 957 ++++++++++++++++++ .../controllers/reencryption/setup.go | 104 ++ 5 files changed, 1667 insertions(+) create mode 100644 control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/metrics.go create mode 100644 control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go create mode 100644 control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go create mode 100644 control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/setup.go diff --git a/control-plane-operator/hostedclusterconfigoperator/cmd.go b/control-plane-operator/hostedclusterconfigoperator/cmd.go index 797f8973fcfe..29d8189ffd1b 100644 --- a/control-plane-operator/hostedclusterconfigoperator/cmd.go +++ b/control-plane-operator/hostedclusterconfigoperator/cmd.go @@ -29,6 +29,7 @@ import ( "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/controllers/machine" "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/controllers/node" "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/controllers/nodecount" + "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption" "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/controllers/resources" "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/controllers/spotremediation" "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/operator" @@ -72,6 +73,7 @@ var controllerFuncs = map[string]operator.ControllerSetupFunc{ "drainer": drainer.Setup, hcpstatus.ControllerName: hcpstatus.Setup, spotremediation.ControllerName: spotremediation.Setup, + reencryption.ControllerName: reencryption.Setup, } type HostedClusterConfigOperator struct { diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/metrics.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/metrics.go new file mode 100644 index 000000000000..0a51602ba639 --- /dev/null +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/metrics.go @@ -0,0 +1,72 @@ +package reencryption + +import ( + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + + "sigs.k8s.io/controller-runtime/pkg/metrics" + + "github.com/prometheus/client_golang/prometheus" +) + +var ( + migrationStateGauge = prometheus.NewGaugeVec(prometheus.GaugeOpts{ + Name: "hypershift_encryption_migration_state", + Help: "Current rotation state per hosted cluster. Label 'state' maps to history[0].state or 'idle' when no rotation is in progress.", + }, []string{"namespace", "name", "state"}) + + migrationDurationHistogram = prometheus.NewHistogramVec(prometheus.HistogramOpts{ + Name: "hypershift_encryption_migration_duration_seconds", + Help: "Duration of completed rotations from startedTime to completionTime.", + Buckets: prometheus.ExponentialBuckets(30, 2, 10), + }, []string{"namespace", "name"}) + + migrationFailuresCounter = prometheus.NewCounterVec(prometheus.CounterOpts{ + Name: "hypershift_encryption_migration_failures_total", + Help: "Total StorageVersionMigration CR failures per hosted cluster.", + }, []string{"namespace", "name"}) +) + +func init() { + metrics.Registry.MustRegister(migrationStateGauge, migrationDurationHistogram, migrationFailuresCounter) +} + +var allStates = []string{ + string(hyperv1.EncryptionMigrationStateReadOnlyDeploy), + string(hyperv1.EncryptionMigrationStateWritePromote), + string(hyperv1.EncryptionMigrationStateMigrating), + string(hyperv1.EncryptionMigrationStateCompleted), + string(hyperv1.EncryptionMigrationStateInterrupted), + "idle", +} + +func recordMigrationState(namespace, name string, status hyperv1.SecretEncryptionStatus) { + state := "idle" + if len(status.History) > 0 { + h := status.History[0] + if h.State != hyperv1.EncryptionMigrationStateCompleted && h.State != hyperv1.EncryptionMigrationStateInterrupted { + state = string(h.State) + } + } + for _, s := range allStates { + val := float64(0) + if s == state { + val = 1 + } + migrationStateGauge.WithLabelValues(namespace, name, s).Set(val) + } +} + +func recordMigrationDuration(namespace, name string, status hyperv1.SecretEncryptionStatus) { + if len(status.History) == 0 { + return + } + h := status.History[0] + if h.State == hyperv1.EncryptionMigrationStateCompleted && h.CompletionTime != nil { + duration := h.CompletionTime.Sub(h.StartedTime.Time).Seconds() + migrationDurationHistogram.WithLabelValues(namespace, name).Observe(duration) + } +} + +func recordMigrationFailure(namespace, name string) { + migrationFailuresCounter.WithLabelValues(namespace, name).Inc() +} diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go new file mode 100644 index 000000000000..f1cdfbb3c2cf --- /dev/null +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go @@ -0,0 +1,532 @@ +// Package reencryption implements the HCCO re-encryption controller that +// manages etcd data re-encryption after encryption key rotation. +package reencryption + +import ( + "context" + "fmt" + "strings" + "time" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/manifests" + kasaescbc "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/kas" + "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms" + "github.com/openshift/hypershift/support/config" + "github.com/openshift/hypershift/support/podspec" + "github.com/openshift/hypershift/support/secretencryption" + + "github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators" + + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/api/equality" + "k8s.io/apimachinery/pkg/api/meta" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime/schema" + "k8s.io/apimachinery/pkg/types" + + ctrl "sigs.k8s.io/controller-runtime" + crclient "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/reconcile" + + "github.com/go-logr/logr" +) + +const ( + // maxHistoryEntries is the maximum number of entries kept in the rotation history. + maxHistoryEntries = 5 +) + +// Reconciler watches for encryption key changes on the HCP spec and drives the +// multi-phase key rotation lifecycle: ReadOnlyDeploy -> WritePromote -> Migrating -> Completed. +type Reconciler struct { + cpClient crclient.Client + guestClient crclient.Client + hcpName string + hcpNamespace string + migrator migrators.Migrator + now func() time.Time +} + +func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) { + log := ctrl.LoggerFrom(ctx) + + hcp := &hyperv1.HostedControlPlane{} + if err := r.cpClient.Get(ctx, types.NamespacedName{Namespace: r.hcpNamespace, Name: r.hcpName}, hcp); err != nil { + return reconcile.Result{}, fmt.Errorf("failed to get HCP: %w", err) + } + + originalHCP := hcp.DeepCopy() + result, err := r.reconcile(ctx, log, hcp) + if err != nil { + return result, err + } + + if !equality.Semantic.DeepEqual(hcp.Status, originalHCP.Status) { + log.Info("Patching HCP status with secret encryption changes") + patch := crclient.MergeFrom(originalHCP) + if err := r.cpClient.Status().Patch(ctx, hcp, patch); err != nil { + return reconcile.Result{}, fmt.Errorf("failed to patch HCP status: %w", err) + } + log.Info("Successfully patched HCP status") + recordMigrationState(r.hcpNamespace, r.hcpName, hcp.Status.SecretEncryption) + recordMigrationDuration(r.hcpNamespace, r.hcpName, hcp.Status.SecretEncryption) + } + + return result, nil +} + +func (r *Reconciler) reconcile(ctx context.Context, log logr.Logger, hcp *hyperv1.HostedControlPlane) (reconcile.Result, error) { + // If encryption is not configured, ensure status is clean. + if hcp.Spec.SecretEncryption == nil { + return r.handleEncryptionNotConfigured(hcp) + } + + // Compute the spec fingerprint from the current spec. + specKeyStatus, err := r.keyStatusFromSpec(ctx, hcp) + if err != nil { + return reconcile.Result{}, fmt.Errorf("failed to compute key status from spec: %w", err) + } + if specKeyStatus == nil { + log.Info("Secret encryption configured but key status could not be derived, skipping") + return reconcile.Result{}, nil + } + + specFingerprint := secretencryption.FingerprintFromKeyStatus(specKeyStatus) + + statusActiveFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.ActiveKey) + + // Case 1: Status has no active key (first-time setup or upgrade bootstrap). + if hcp.Status.SecretEncryption.ActiveKey.Provider == "" { + return r.handleInitialBootstrap(log, hcp, specKeyStatus) + } + + // Case 2: A rotation is already in progress (targetKey is set). + if hcp.Status.SecretEncryption.TargetKey.Provider != "" { + return r.handleInProgressRotation(ctx, log, hcp, specKeyStatus, specFingerprint) + } + + // Case 3: No rotation in progress and spec matches status -> steady state. + if specFingerprint == statusActiveFingerprint { + log.V(2).Info("Encryption key is up to date, no rotation needed") + return reconcile.Result{}, nil + } + + // Case 4: Spec key differs from status active key -> start new rotation. + return r.startNewRotation(log, hcp, specKeyStatus, specFingerprint, statusActiveFingerprint) +} + +// handleEncryptionNotConfigured clears the targetKey and removes the EtcdDataEncryptionUpToDate condition. +func (r *Reconciler) handleEncryptionNotConfigured(hcp *hyperv1.HostedControlPlane) (reconcile.Result, error) { + hcp.Status.SecretEncryption.TargetKey = hyperv1.SecretEncryptionKeyStatus{} + meta.RemoveStatusCondition(&hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + return reconcile.Result{}, nil +} + +// handleInitialBootstrap sets the initial active key from the spec without starting a rotation. +func (r *Reconciler) handleInitialBootstrap(log logr.Logger, hcp *hyperv1.HostedControlPlane, specKeyStatus *hyperv1.SecretEncryptionKeyStatus) (reconcile.Result, error) { + log.Info("Initializing secret encryption status with active key from spec") + hcp.Status.SecretEncryption.ActiveKey = *specKeyStatus.DeepCopy() + + meta.SetStatusCondition(&hcp.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.EtcdDataEncryptionUpToDate), + Status: metav1.ConditionTrue, + Reason: hyperv1.ReEncryptionCompletedReason, + Message: "Encryption key initialized", + ObservedGeneration: hcp.Generation, + }) + return reconcile.Result{}, nil +} + +// startNewRotation sets the targetKey and creates a history entry for a new rotation. +func (r *Reconciler) startNewRotation(log logr.Logger, hcp *hyperv1.HostedControlPlane, specKeyStatus *hyperv1.SecretEncryptionKeyStatus, specFingerprint, statusActiveFingerprint string) (reconcile.Result, error) { + log.Info("Encryption key changed, starting new rotation", + "specFingerprint", specFingerprint, + "statusActiveFingerprint", statusActiveFingerprint) + + hcp.Status.SecretEncryption.TargetKey = *specKeyStatus.DeepCopy() + + fromRef := secretencryption.KeyReferenceFromStatus(&hcp.Status.SecretEncryption.ActiveKey) + toRef := secretencryption.KeyReferenceFromStatus(specKeyStatus) + + entry := hyperv1.EncryptionMigrationHistory{ + From: fromRef, + To: toRef, + State: hyperv1.EncryptionMigrationStateReadOnlyDeploy, + StartedTime: metav1.Time{Time: r.now()}, + } + + // Prepend new entry and trim history. + hcp.Status.SecretEncryption.History = prependHistory(hcp.Status.SecretEncryption.History, entry) + + meta.SetStatusCondition(&hcp.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.EtcdDataEncryptionUpToDate), + Status: metav1.ConditionFalse, + Reason: hyperv1.ReadOnlyRolloutInProgressReason, + Message: "Encryption key rotation started: deploying new key as read-only", + ObservedGeneration: hcp.Generation, + }) + + return reconcile.Result{}, nil +} + +// handleInProgressRotation derives the current phase from observable state and acts accordingly. +// It inspects the EncryptionConfiguration and KAS Deployment convergence rather than +// reading history[0].state. The history state is updated for observability only. +func (r *Reconciler) handleInProgressRotation(ctx context.Context, log logr.Logger, hcp *hyperv1.HostedControlPlane, _ *hyperv1.SecretEncryptionKeyStatus, specFingerprint string) (reconcile.Result, error) { + targetFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.TargetKey) + + if specFingerprint != targetFingerprint { + log.Info("Spec key differs from target key during rotation, current rotation will complete first", + "specFingerprint", specFingerprint, + "targetFingerprint", targetFingerprint) + } + + if len(hcp.Status.SecretEncryption.History) == 0 { + log.Info("Target key set but no history entry found, creating one") + fromRef := secretencryption.KeyReferenceFromStatus(&hcp.Status.SecretEncryption.ActiveKey) + toRef := secretencryption.KeyReferenceFromStatus(&hcp.Status.SecretEncryption.TargetKey) + entry := hyperv1.EncryptionMigrationHistory{ + From: fromRef, + To: toRef, + State: hyperv1.EncryptionMigrationStateReadOnlyDeploy, + StartedTime: metav1.Time{Time: r.now()}, + } + hcp.Status.SecretEncryption.History = prependHistory(hcp.Status.SecretEncryption.History, entry) + } + + // Derive the current phase from observable state. + role, err := r.deriveTargetKeyRole(ctx, hcp) + if err != nil { + return reconcile.Result{}, fmt.Errorf("failed to derive target key role from EncryptionConfiguration: %w", err) + } + + converged, err := r.isKASConverged(ctx, log, hcp) + if err != nil { + return reconcile.Result{}, fmt.Errorf("failed to check KAS convergence: %w", err) + } + + switch { + case role == secretencryption.TargetKeyAbsent: + // Target key not yet in EncryptionConfiguration — CPO hasn't generated the new config yet. + log.Info("Target key not yet in EncryptionConfiguration, waiting for CPO") + r.setHistoryState(hcp, hyperv1.EncryptionMigrationStateReadOnlyDeploy) + meta.SetStatusCondition(&hcp.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.EtcdDataEncryptionUpToDate), + Status: metav1.ConditionFalse, + Reason: hyperv1.ReadOnlyRolloutInProgressReason, + Message: "Waiting for new encryption key to be added to EncryptionConfiguration", + ObservedGeneration: hcp.Generation, + }) + return reconcile.Result{RequeueAfter: 30 * time.Second}, nil + + case role == secretencryption.TargetKeyReadOnly && !converged: + // Target key is read-only but KAS hasn't fully rolled out with it. + log.Info("Target key is read-only in config, waiting for KAS convergence") + r.setHistoryState(hcp, hyperv1.EncryptionMigrationStateReadOnlyDeploy) + meta.SetStatusCondition(&hcp.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.EtcdDataEncryptionUpToDate), + Status: metav1.ConditionFalse, + Reason: hyperv1.ReEncryptionWaitingForKASReason, + Message: "Waiting for KAS to converge with new encryption key in read-only mode", + ObservedGeneration: hcp.Generation, + }) + return reconcile.Result{RequeueAfter: 30 * time.Second}, nil + + case role == secretencryption.TargetKeyReadOnly && converged: + // KAS converged with target key as read-only — ready for write promotion. + log.Info("KAS converged with read-only key, ready for write promotion") + r.setHistoryState(hcp, hyperv1.EncryptionMigrationStateWritePromote) + meta.SetStatusCondition(&hcp.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.EtcdDataEncryptionUpToDate), + Status: metav1.ConditionFalse, + Reason: hyperv1.WritePromotionInProgressReason, + Message: "Promoting new encryption key to write provider", + ObservedGeneration: hcp.Generation, + }) + return reconcile.Result{}, nil + + case role == secretencryption.TargetKeyWrite && !converged: + // Target key is the write provider but KAS hasn't converged with it. + log.Info("Target key is write provider, waiting for KAS convergence") + r.setHistoryState(hcp, hyperv1.EncryptionMigrationStateWritePromote) + meta.SetStatusCondition(&hcp.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.EtcdDataEncryptionUpToDate), + Status: metav1.ConditionFalse, + Reason: hyperv1.ReEncryptionWaitingForKASReason, + Message: "Waiting for KAS to converge with new encryption key as write provider", + ObservedGeneration: hcp.Generation, + }) + return reconcile.Result{RequeueAfter: 30 * time.Second}, nil + + case role == secretencryption.TargetKeyWrite && converged: + // Target key is write provider and KAS converged — run migrations. + log.Info("KAS converged with target key as write provider, running migrations") + r.setHistoryState(hcp, hyperv1.EncryptionMigrationStateMigrating) + return r.handleMigratingPhase(ctx, log, hcp) + + default: + return reconcile.Result{}, nil + } +} + +// deriveTargetKeyRole reads the kas-secret-encryption-config Secret, parses the +// EncryptionConfiguration, and determines where the target key appears. +func (r *Reconciler) deriveTargetKeyRole(ctx context.Context, hcp *hyperv1.HostedControlPlane) (secretencryption.TargetKeyRole, error) { + secret := &corev1.Secret{} + secretKey := crclient.ObjectKey{ + Namespace: hcp.Namespace, + Name: manifests.KASSecretEncryptionConfigFile("").Name, + } + if err := r.cpClient.Get(ctx, secretKey, secret); err != nil { + return secretencryption.TargetKeyAbsent, fmt.Errorf("failed to get encryption config secret: %w", err) + } + + configBytes := secret.Data[secretencryption.EncryptionConfigurationKey] + if len(configBytes) == 0 { + return secretencryption.TargetKeyAbsent, nil + } + + currentConfig, err := secretencryption.DecodeEncryptionConfiguration(configBytes) + if err != nil { + return secretencryption.TargetKeyAbsent, err + } + + targetName, err := r.computeTargetKeyProviderName(ctx, hcp) + if err != nil { + return secretencryption.TargetKeyAbsent, fmt.Errorf("failed to compute target key provider name: %w", err) + } + + return secretencryption.FindKeyRole(currentConfig, targetName, hcp.Spec.SecretEncryption.Type), nil +} + +// computeTargetKeyProviderName computes the provider name that the CPO would +// generate for the target key in the EncryptionConfiguration. It reuses the +// same functions the CPO uses to ensure the names always match. +func (r *Reconciler) computeTargetKeyProviderName(ctx context.Context, hcp *hyperv1.HostedControlPlane) (string, error) { + tk := hcp.Status.SecretEncryption.TargetKey + if tk.Provider == "" { + return "", fmt.Errorf("no target key set") + } + + switch tk.Provider { + case hyperv1.SecretEncryptionProviderAzure: + if tk.Azure.KeyVaultName == "" { + return "", fmt.Errorf("azure target key status is nil") + } + return kms.AzureKMSProviderName(hyperv1.AzureKMSKey{ + KeyVaultName: tk.Azure.KeyVaultName, + KeyName: tk.Azure.KeyName, + KeyVersion: tk.Azure.KeyVersion, + }) + + case hyperv1.SecretEncryptionProviderAWS: + if tk.AWS.ARN == "" { + return "", fmt.Errorf("aws target key status is nil") + } + return kms.AWSKMSProviderName(tk.AWS.ARN) + + case hyperv1.SecretEncryptionProviderIBMCloud: + // IBM Cloud uses a single KMS provider with a fixed name; the sidecar + // handles key versioning internally via KP_DATA_JSON. + return kms.IBMCloudKMSProviderName(), nil + + case hyperv1.SecretEncryptionProviderAESCBC: + if tk.AESCBC.DataHash == "" { + return "", fmt.Errorf("aescbc target key status is nil") + } + secret := &corev1.Secret{} + if err := r.cpClient.Get(ctx, types.NamespacedName{ + Namespace: hcp.Namespace, + Name: tk.AESCBC.Secret.Name, + }, secret); err != nil { + return "", fmt.Errorf("failed to get AESCBC target key secret: %w", err) + } + return kasaescbc.AESCBCKeyName(secret.Data[hyperv1.AESCBCKeySecretKey]) + + default: + return "", fmt.Errorf("unsupported provider: %s", tk.Provider) + } +} + +// setHistoryState updates history[0].state for observability. This value is +// never used as input for phase derivation. +func (r *Reconciler) setHistoryState(hcp *hyperv1.HostedControlPlane, state hyperv1.EncryptionMigrationState) { + if len(hcp.Status.SecretEncryption.History) > 0 { + hcp.Status.SecretEncryption.History[0].State = state + } +} + +// handleMigratingPhase creates/monitors StorageVersionMigration CRs for each encrypted resource. +func (r *Reconciler) handleMigratingPhase(_ context.Context, log logr.Logger, hcp *hyperv1.HostedControlPlane) (reconcile.Result, error) { + if !r.migrator.HasSynced() { + log.Info("Migrator cache not yet synced, requeuing") + return reconcile.Result{RequeueAfter: 10 * time.Second}, nil + } + + resources := r.encryptedResources(hcp) + targetFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.TargetKey) + writeKey := fmt.Sprintf("encryption-key-%s", targetFingerprint) + + allFinished := true + var migrationErrors []string + + for _, gr := range resources { + finished, result, _, err := r.migrator.EnsureMigration(gr, writeKey) + if err != nil { + return reconcile.Result{}, fmt.Errorf("failed to ensure migration for %s: %w", gr, err) + } + if !finished { + allFinished = false + continue + } + if result != nil { + migrationErrors = append(migrationErrors, fmt.Sprintf("%s: %v", gr, result)) + } + } + + if len(migrationErrors) > 0 { + errMsg := strings.Join(migrationErrors, "; ") + log.Info("StorageVersionMigration encountered errors", "errors", errMsg) + meta.SetStatusCondition(&hcp.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.EtcdDataEncryptionUpToDate), + Status: metav1.ConditionFalse, + Reason: hyperv1.ReEncryptionFailedReason, + Message: fmt.Sprintf("Re-encryption failed for some resources: %s", errMsg), + ObservedGeneration: hcp.Generation, + }) + recordMigrationFailure(r.hcpNamespace, r.hcpName) + return reconcile.Result{RequeueAfter: 60 * time.Second}, nil + } + + if !allFinished { + log.Info("StorageVersionMigrations still in progress") + meta.SetStatusCondition(&hcp.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.EtcdDataEncryptionUpToDate), + Status: metav1.ConditionFalse, + Reason: hyperv1.ReEncryptionInProgressReason, + Message: "Re-encrypting etcd data with new encryption key", + ObservedGeneration: hcp.Generation, + }) + return reconcile.Result{RequeueAfter: 30 * time.Second}, nil + } + + // All migrations completed successfully. + log.Info("All StorageVersionMigrations completed successfully") + r.setHistoryState(hcp, hyperv1.EncryptionMigrationStateCompleted) + if len(hcp.Status.SecretEncryption.History) > 0 { + now := metav1.Time{Time: r.now()} + hcp.Status.SecretEncryption.History[0].CompletionTime = &now + } + + return r.completeRotation(log, hcp) +} + +// completeRotation promotes the target key to active and clears the target key. +func (r *Reconciler) completeRotation(log logr.Logger, hcp *hyperv1.HostedControlPlane) (reconcile.Result, error) { + if hcp.Status.SecretEncryption.TargetKey.Provider != "" { + log.Info("Completing rotation: promoting target key to active") + hcp.Status.SecretEncryption.ActiveKey = *hcp.Status.SecretEncryption.TargetKey.DeepCopy() + hcp.Status.SecretEncryption.TargetKey = hyperv1.SecretEncryptionKeyStatus{} + } + + meta.SetStatusCondition(&hcp.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.EtcdDataEncryptionUpToDate), + Status: metav1.ConditionTrue, + Reason: hyperv1.ReEncryptionCompletedReason, + Message: "All etcd data is encrypted with the current active key", + ObservedGeneration: hcp.Generation, + }) + + return reconcile.Result{}, nil +} + +// isKASConverged checks if the KAS Deployment has fully rolled out. +func (r *Reconciler) isKASConverged(ctx context.Context, log logr.Logger, hcp *hyperv1.HostedControlPlane) (bool, error) { + deployment := &appsv1.Deployment{} + kasRef := manifests.KASDeployment(hcp.Namespace) + if err := r.cpClient.Get(ctx, crclient.ObjectKeyFromObject(kasRef), deployment); err != nil { + return false, fmt.Errorf("failed to get KAS deployment: %w", err) + } + + ready := podspec.IsDeploymentReady(ctx, deployment) + if !ready { + log.V(2).Info("KAS not converged") + } + return ready, nil +} + +// keyStatusFromSpec computes a SecretEncryptionKeyStatus from the HCP spec. +// For AESCBC, this reads the key secret to compute the data hash. +func (r *Reconciler) keyStatusFromSpec(ctx context.Context, hcp *hyperv1.HostedControlPlane) (*hyperv1.SecretEncryptionKeyStatus, error) { + spec := hcp.Spec.SecretEncryption + if spec == nil { + return nil, nil + } + + var dataHash string + if spec.Type == hyperv1.AESCBC && spec.AESCBC != nil { + secret := &corev1.Secret{} + secretKey := types.NamespacedName{ + Namespace: hcp.Namespace, + Name: spec.AESCBC.ActiveKey.Name, + } + if err := r.cpClient.Get(ctx, secretKey, secret); err != nil { + return nil, fmt.Errorf("failed to get AESCBC key secret %s: %w", secretKey, err) + } + keyData, ok := secret.Data[hyperv1.AESCBCKeySecretKey] + if !ok { + return nil, fmt.Errorf("AESCBC key secret %s missing %q key", secretKey, hyperv1.AESCBCKeySecretKey) + } + dataHash = secretencryption.DataHash(keyData) + } + + return secretencryption.KeyStatusFromSpec(spec, dataHash), nil +} + +// encryptedResources returns the list of GroupResources that need re-encryption. +func (r *Reconciler) encryptedResources(hcp *hyperv1.HostedControlPlane) []schema.GroupResource { + spec := hcp.Spec.SecretEncryption + if spec == nil { + return nil + } + + var resourceStrings []string + switch spec.Type { + case hyperv1.KMS: + resourceStrings = config.KMSEncryptedObjects() + case hyperv1.AESCBC: + resourceStrings = config.AESCBCEncryptedObjects() + default: + return nil + } + + resources := make([]schema.GroupResource, 0, len(resourceStrings)) + for _, rs := range resourceStrings { + resources = append(resources, parseGroupResource(rs)) + } + return resources +} + +// parseGroupResource converts a resource string like "routes.route.openshift.io" to a GroupResource. +func parseGroupResource(rs string) schema.GroupResource { + parts := strings.SplitN(rs, ".", 2) + if len(parts) == 1 { + return schema.GroupResource{Resource: parts[0]} + } + return schema.GroupResource{Resource: parts[0], Group: parts[1]} +} + +// prependHistory prepends a new entry to the history and trims it to maxHistoryEntries. +func prependHistory(history []hyperv1.EncryptionMigrationHistory, entry hyperv1.EncryptionMigrationHistory) []hyperv1.EncryptionMigrationHistory { + result := make([]hyperv1.EncryptionMigrationHistory, 0, maxHistoryEntries) + result = append(result, entry) + for i, h := range history { + if i >= maxHistoryEntries-1 { + break + } + result = append(result, h) + } + return result +} diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go new file mode 100644 index 000000000000..538b94652141 --- /dev/null +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go @@ -0,0 +1,957 @@ +package reencryption + +import ( + "bytes" + "context" + "encoding/base64" + "fmt" + "strings" + "testing" + "time" + + . "github.com/onsi/gomega" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + kasaescbc "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/kas" + "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms" + hccoapi "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/api" + "github.com/openshift/hypershift/support/config" + "github.com/openshift/hypershift/support/secretencryption" + + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/api/meta" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" + "k8s.io/apimachinery/pkg/types" + apiserverv1 "k8s.io/apiserver/pkg/apis/apiserver/v1" + clientgoscheme "k8s.io/client-go/kubernetes/scheme" + "k8s.io/client-go/tools/cache" + + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/client/fake" + "sigs.k8s.io/controller-runtime/pkg/reconcile" +) + +const ( + testNamespace = "test-hcp-namespace" + testHCPName = "test-hcp" +) + +var ( + testScheme = func() *runtime.Scheme { + s := runtime.NewScheme() + _ = clientgoscheme.AddToScheme(s) + _ = hyperv1.AddToScheme(s) + return s + }() + + fixedTime = time.Date(2025, 6, 15, 12, 0, 0, 0, time.UTC) +) + +// fakeMigrator implements the Migrator interface for testing. +type fakeMigrator struct { + migrations map[string]*fakeMigrationState +} + +type fakeMigrationState struct { + finished bool + result error + ts time.Time +} + +func newFakeMigrator() *fakeMigrator { + return &fakeMigrator{ + migrations: make(map[string]*fakeMigrationState), + } +} + +func (f *fakeMigrator) EnsureMigration(gr schema.GroupResource, writeKey string) (finished bool, result error, ts time.Time, err error) { + key := fmt.Sprintf("%s/%s", gr.String(), writeKey) + state, exists := f.migrations[key] + if !exists { + f.migrations[key] = &fakeMigrationState{finished: false} + return false, nil, time.Time{}, nil + } + return state.finished, state.result, state.ts, nil +} + +func (f *fakeMigrator) PruneMigration(gr schema.GroupResource) error { + for k := range f.migrations { + if strings.HasPrefix(k, gr.String()) { + delete(f.migrations, k) + } + } + return nil +} + +func (f *fakeMigrator) AddEventHandler(handler cache.ResourceEventHandler) (cache.ResourceEventHandlerRegistration, error) { + return nil, nil +} + +func (f *fakeMigrator) HasSynced() bool { + return true +} + +func (f *fakeMigrator) completeMigration(gr schema.GroupResource, writeKey string) { + key := fmt.Sprintf("%s/%s", gr.String(), writeKey) + f.migrations[key] = &fakeMigrationState{ + finished: true, + result: nil, + ts: fixedTime, + } +} + +func (f *fakeMigrator) failMigration(gr schema.GroupResource, writeKey string, err error) { + key := fmt.Sprintf("%s/%s", gr.String(), writeKey) + f.migrations[key] = &fakeMigrationState{ + finished: true, + result: err, + ts: fixedTime, + } +} + +func (f *fakeMigrator) completeAll(resources []schema.GroupResource, writeKey string) { + for _, gr := range resources { + f.completeMigration(gr, writeKey) + } +} + +// Test helpers. + +func newHCP(opts ...func(*hyperv1.HostedControlPlane)) *hyperv1.HostedControlPlane { + hcp := &hyperv1.HostedControlPlane{ + ObjectMeta: metav1.ObjectMeta{ + Name: testHCPName, + Namespace: testNamespace, + Generation: 1, + }, + } + for _, opt := range opts { + opt(hcp) + } + return hcp +} + +func withAESCBCEncryption(secretName string) func(*hyperv1.HostedControlPlane) { + return func(hcp *hyperv1.HostedControlPlane) { + hcp.Spec.SecretEncryption = &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.AESCBC, + AESCBC: &hyperv1.AESCBCSpec{ + ActiveKey: corev1.LocalObjectReference{Name: secretName}, + }, + } + } +} + +func withKMSEncryption() func(*hyperv1.HostedControlPlane) { + return func(hcp *hyperv1.HostedControlPlane) { + hcp.Spec.SecretEncryption = &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.KMS, + KMS: &hyperv1.KMSSpec{ + Provider: hyperv1.AWS, + AWS: &hyperv1.AWSKMSSpec{ + ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789012:key/test-key-1"}, + Region: "us-east-1", + }, + }, + } + } +} + +func withActiveKey(ks *hyperv1.SecretEncryptionKeyStatus) func(*hyperv1.HostedControlPlane) { + return func(hcp *hyperv1.HostedControlPlane) { + hcp.Status.SecretEncryption.ActiveKey = *ks.DeepCopy() + } +} + +func withTargetKey(ks *hyperv1.SecretEncryptionKeyStatus) func(*hyperv1.HostedControlPlane) { + return func(hcp *hyperv1.HostedControlPlane) { + hcp.Status.SecretEncryption.TargetKey = *ks.DeepCopy() + } +} + +func withHistory(entries ...hyperv1.EncryptionMigrationHistory) func(*hyperv1.HostedControlPlane) { + return func(hcp *hyperv1.HostedControlPlane) { + hcp.Status.SecretEncryption.History = entries + } +} + +func aescbcKeyStatus(secretName, dataHash string) *hyperv1.SecretEncryptionKeyStatus { + return secretencryption.KeyStatusFromAESCBCSpec(corev1.LocalObjectReference{Name: secretName}, dataHash) +} + +func awsKeyStatus(arn, region string) *hyperv1.SecretEncryptionKeyStatus { + return secretencryption.KeyStatusFromAWSSpec(hyperv1.AWSKMSKeyEntry{ARN: arn}, region) +} + +func aescbcKeySecret(name, namespace, keyData string) *corev1.Secret { + return &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Namespace: namespace, + }, + Data: map[string][]byte{ + hyperv1.AESCBCKeySecretKey: []byte(keyData), + }, + } +} + +// aescbcProviderKeyName computes the provider key name that the CPO generates +// for an AESCBC key. This must match the naming in kas/aescbc.go. +func aescbcProviderKeyName(keyData string) string { + name, _ := kasaescbc.AESCBCKeyName([]byte(keyData)) + return name +} + +func awsProviderKeyName(arn string) string { + name, _ := kms.AWSKMSProviderName(arn) + return name +} + +// encryptionConfigSecret builds the kas-secret-encryption-config Secret with +// a config.yaml field containing a YAML-encoded EncryptionConfiguration. +// writeKeyName is the first (write) provider key; readKeyName (if non-empty) is +// the second (read-only) provider key. +func encryptionConfigSecret(namespace string, encType hyperv1.SecretEncryptionType, writeKeyName, readKeyName string) *corev1.Secret { + var cfg apiserverv1.EncryptionConfiguration + cfg.TypeMeta = metav1.TypeMeta{ + APIVersion: apiserverv1.SchemeGroupVersion.String(), + Kind: "EncryptionConfiguration", + } + + var providers []apiserverv1.ProviderConfiguration + + switch encType { + case hyperv1.AESCBC: + keys := []apiserverv1.Key{ + {Name: writeKeyName, Secret: base64.StdEncoding.EncodeToString([]byte("dummy"))}, + } + if readKeyName != "" { + keys = append(keys, apiserverv1.Key{Name: readKeyName, Secret: base64.StdEncoding.EncodeToString([]byte("dummy"))}) + } + providers = append(providers, + apiserverv1.ProviderConfiguration{AESCBC: &apiserverv1.AESConfiguration{Keys: keys}}, + apiserverv1.ProviderConfiguration{Identity: &apiserverv1.IdentityConfiguration{}}, + ) + cfg.Resources = []apiserverv1.ResourceConfiguration{ + {Resources: []string{"secrets"}, Providers: providers}, + } + + case hyperv1.KMS: + providers = append(providers, apiserverv1.ProviderConfiguration{ + KMS: &apiserverv1.KMSConfiguration{ + Name: writeKeyName, + APIVersion: "v2", + Endpoint: "unix:///var/run/awskmsactive.sock", + Timeout: &metav1.Duration{Duration: 35 * time.Second}, + }, + }) + if readKeyName != "" { + providers = append(providers, apiserverv1.ProviderConfiguration{ + KMS: &apiserverv1.KMSConfiguration{ + Name: readKeyName, + APIVersion: "v2", + Endpoint: "unix:///var/run/awskmsbackup.sock", + Timeout: &metav1.Duration{Duration: 35 * time.Second}, + }, + }) + } + providers = append(providers, apiserverv1.ProviderConfiguration{Identity: &apiserverv1.IdentityConfiguration{}}) + cfg.Resources = []apiserverv1.ResourceConfiguration{ + {Resources: config.KMSEncryptedObjects(), Providers: providers}, + } + } + + buf := bytes.NewBuffer(nil) + if err := hccoapi.YamlSerializer.Encode(&cfg, buf); err != nil { + panic(fmt.Sprintf("failed to encode EncryptionConfiguration: %v", err)) + } + + return &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: "kas-secret-encryption-config", + Namespace: namespace, + }, + Data: map[string][]byte{ + "config.yaml": buf.Bytes(), + }, + } +} + +func convergedKASDeployment(namespace string) *appsv1.Deployment { + replicas := int32(3) + return &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{ + Name: "kube-apiserver", + Namespace: namespace, + Generation: 1, + }, + Spec: appsv1.DeploymentSpec{ + Replicas: &replicas, + }, + Status: appsv1.DeploymentStatus{ + ObservedGeneration: 1, + Replicas: 3, + UpdatedReplicas: 3, + ReadyReplicas: 3, + AvailableReplicas: 3, + UnavailableReplicas: 0, + }, + } +} + +func rollingKASDeployment(namespace string) *appsv1.Deployment { + replicas := int32(3) + return &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{ + Name: "kube-apiserver", + Namespace: namespace, + Generation: 2, + }, + Spec: appsv1.DeploymentSpec{ + Replicas: &replicas, + }, + Status: appsv1.DeploymentStatus{ + ObservedGeneration: 1, + Replicas: 3, + UpdatedReplicas: 1, + ReadyReplicas: 2, + AvailableReplicas: 2, + UnavailableReplicas: 1, + }, + } +} + +func newReconciler(cpClient, guestClient client.Client, migrator *fakeMigrator) *Reconciler { + return &Reconciler{ + cpClient: cpClient, + guestClient: guestClient, + hcpName: testHCPName, + hcpNamespace: testNamespace, + migrator: migrator, + now: func() time.Time { return fixedTime }, + } +} + +func buildCPClient(objs ...client.Object) client.Client { + return fake.NewClientBuilder(). + WithScheme(testScheme). + WithObjects(objs...). + WithStatusSubresource(&hyperv1.HostedControlPlane{}). + Build() +} + +func getHCP(ctx context.Context, g Gomega, cl client.Client) *hyperv1.HostedControlPlane { + hcp := &hyperv1.HostedControlPlane{} + g.Expect(cl.Get(ctx, types.NamespacedName{Name: testHCPName, Namespace: testNamespace}, hcp)).To(Succeed()) + return hcp +} + +func TestReconcile(t *testing.T) { + tests := []struct { + name string + cpObjects []client.Object + migrator func() *fakeMigrator + expectResult reconcile.Result + expectError bool + validate func(*testing.T, Gomega, client.Client, *fakeMigrator) + }{ + { + name: "When encryption is not configured it should remove the condition and clear targetKey", + cpObjects: []client.Object{ + newHCP(), // no encryption spec + convergedKASDeployment(testNamespace), + }, + migrator: newFakeMigrator, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).To(BeNil(), "condition should be removed when encryption is not configured") + }, + }, + { + name: "When encryption is configured with AESCBC and no active key in status it should initialize active key", + cpObjects: []client.Object{ + newHCP(withAESCBCEncryption("aescbc-key-1")), + aescbcKeySecret("aescbc-key-1", testNamespace, "test-key-data-1"), + convergedKASDeployment(testNamespace), + }, + migrator: newFakeMigrator, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.Provider).ToNot(BeEmpty()) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.Provider).To(Equal(hyperv1.SecretEncryptionProviderAESCBC)) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.AESCBC.DataHash).ToNot(BeEmpty()) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.AESCBC.Secret.Name).To(Equal("aescbc-key-1")) + dh := secretencryption.DataHash([]byte("test-key-data-1")) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.AESCBC.DataHash).To(Equal(dh)) + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).To(BeEmpty()) + + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).ToNot(BeNil()) + g.Expect(cond.Status).To(Equal(metav1.ConditionTrue)) + g.Expect(cond.Reason).To(Equal(hyperv1.ReEncryptionCompletedReason)) + }, + }, + { + name: "When encryption key is already up to date it should remain in steady state", + cpObjects: func() []client.Object { + dataHash := secretencryption.DataHash([]byte("test-key-data-1")) + return []client.Object{ + newHCP( + withAESCBCEncryption("aescbc-key-1"), + withActiveKey(aescbcKeyStatus("aescbc-key-1", dataHash)), + ), + aescbcKeySecret("aescbc-key-1", testNamespace, "test-key-data-1"), + convergedKASDeployment(testNamespace), + } + }(), + migrator: newFakeMigrator, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).To(BeEmpty()) + }, + }, + { + name: "When AESCBC key data changes it should start a new rotation", + cpObjects: func() []client.Object { + oldHash := secretencryption.DataHash([]byte("old-key-data")) + return []client.Object{ + newHCP( + withAESCBCEncryption("aescbc-key-1"), + withActiveKey(aescbcKeyStatus("aescbc-key-1", oldHash)), + ), + aescbcKeySecret("aescbc-key-1", testNamespace, "new-key-data"), + convergedKASDeployment(testNamespace), + } + }(), + migrator: newFakeMigrator, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).ToNot(BeEmpty()) + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).To(Equal(hyperv1.SecretEncryptionProviderAESCBC)) + newHash := secretencryption.DataHash([]byte("new-key-data")) + g.Expect(hcp.Status.SecretEncryption.TargetKey.AESCBC.DataHash).To(Equal(newHash)) + + g.Expect(hcp.Status.SecretEncryption.History).To(HaveLen(1)) + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateReadOnlyDeploy)) + g.Expect(hcp.Status.SecretEncryption.History[0].CompletionTime).To(BeNil()) + + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).ToNot(BeNil()) + g.Expect(cond.Status).To(Equal(metav1.ConditionFalse)) + g.Expect(cond.Reason).To(Equal(hyperv1.ReadOnlyRolloutInProgressReason)) + }, + }, + { + name: "When in ReadOnlyDeploy phase and KAS is not converged it should wait", + cpObjects: func() []client.Object { + oldHash := secretencryption.DataHash([]byte("old-key-data")) + newHash := secretencryption.DataHash([]byte("new-key-data")) + oldKS := aescbcKeyStatus("aescbc-key-1", oldHash) + newKS := aescbcKeyStatus("aescbc-key-1", newHash) + return []client.Object{ + newHCP( + withAESCBCEncryption("aescbc-key-1"), + withActiveKey(oldKS), + withTargetKey(newKS), + withHistory(hyperv1.EncryptionMigrationHistory{ + From: secretencryption.KeyReferenceFromStatus(oldKS), + To: secretencryption.KeyReferenceFromStatus(newKS), + State: hyperv1.EncryptionMigrationStateReadOnlyDeploy, + StartedTime: metav1.Time{Time: fixedTime}, + }), + ), + aescbcKeySecret("aescbc-key-1", testNamespace, "new-key-data"), + rollingKASDeployment(testNamespace), + // Target key is read-only (second), old key is write (first). + encryptionConfigSecret(testNamespace, hyperv1.AESCBC, + aescbcProviderKeyName("old-key-data"), + aescbcProviderKeyName("new-key-data")), + } + }(), + migrator: newFakeMigrator, + expectResult: reconcile.Result{RequeueAfter: 30 * time.Second}, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateReadOnlyDeploy)) + + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).ToNot(BeNil()) + g.Expect(cond.Status).To(Equal(metav1.ConditionFalse)) + g.Expect(cond.Reason).To(Equal(hyperv1.ReEncryptionWaitingForKASReason)) + }, + }, + { + name: "When in ReadOnlyDeploy phase and KAS is converged it should advance to WritePromote", + cpObjects: func() []client.Object { + oldHash := secretencryption.DataHash([]byte("old-key-data")) + newHash := secretencryption.DataHash([]byte("new-key-data")) + oldKS := aescbcKeyStatus("aescbc-key-1", oldHash) + newKS := aescbcKeyStatus("aescbc-key-1", newHash) + return []client.Object{ + newHCP( + withAESCBCEncryption("aescbc-key-1"), + withActiveKey(oldKS), + withTargetKey(newKS), + withHistory(hyperv1.EncryptionMigrationHistory{ + From: secretencryption.KeyReferenceFromStatus(oldKS), + To: secretencryption.KeyReferenceFromStatus(newKS), + State: hyperv1.EncryptionMigrationStateReadOnlyDeploy, + StartedTime: metav1.Time{Time: fixedTime}, + }), + ), + aescbcKeySecret("aescbc-key-1", testNamespace, "new-key-data"), + convergedKASDeployment(testNamespace), + // Target key is read-only (second), old key is write (first). + encryptionConfigSecret(testNamespace, hyperv1.AESCBC, + aescbcProviderKeyName("old-key-data"), + aescbcProviderKeyName("new-key-data")), + } + }(), + migrator: newFakeMigrator, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateWritePromote)) + + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).ToNot(BeNil()) + g.Expect(cond.Status).To(Equal(metav1.ConditionFalse)) + g.Expect(cond.Reason).To(Equal(hyperv1.WritePromotionInProgressReason)) + }, + }, + { + name: "When in WritePromote phase and KAS is converged it should advance to Migrating", + cpObjects: func() []client.Object { + oldHash := secretencryption.DataHash([]byte("old-key-data")) + newHash := secretencryption.DataHash([]byte("new-key-data")) + oldKS := aescbcKeyStatus("aescbc-key-1", oldHash) + newKS := aescbcKeyStatus("aescbc-key-1", newHash) + return []client.Object{ + newHCP( + withAESCBCEncryption("aescbc-key-1"), + withActiveKey(oldKS), + withTargetKey(newKS), + withHistory(hyperv1.EncryptionMigrationHistory{ + From: secretencryption.KeyReferenceFromStatus(oldKS), + To: secretencryption.KeyReferenceFromStatus(newKS), + State: hyperv1.EncryptionMigrationStateWritePromote, + StartedTime: metav1.Time{Time: fixedTime}, + }), + ), + aescbcKeySecret("aescbc-key-1", testNamespace, "new-key-data"), + convergedKASDeployment(testNamespace), + // Target key promoted to write (first), old key demoted to read-only (second). + encryptionConfigSecret(testNamespace, hyperv1.AESCBC, + aescbcProviderKeyName("new-key-data"), + aescbcProviderKeyName("old-key-data")), + } + }(), + migrator: newFakeMigrator, + // The controller derives Migrating from observable state (target key is write + KAS converged) + // and immediately starts migrations which are not yet finished, so it requeues. + expectResult: reconcile.Result{RequeueAfter: 30 * time.Second}, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateMigrating)) + + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).ToNot(BeNil()) + g.Expect(cond.Status).To(Equal(metav1.ConditionFalse)) + g.Expect(cond.Reason).To(Equal(hyperv1.ReEncryptionInProgressReason)) + }, + }, + { + name: "When in Migrating phase and migrations are in progress it should wait", + cpObjects: func() []client.Object { + oldHash := secretencryption.DataHash([]byte("old-key-data")) + newHash := secretencryption.DataHash([]byte("new-key-data")) + oldKS := aescbcKeyStatus("aescbc-key-1", oldHash) + newKS := aescbcKeyStatus("aescbc-key-1", newHash) + return []client.Object{ + newHCP( + withAESCBCEncryption("aescbc-key-1"), + withActiveKey(oldKS), + withTargetKey(newKS), + withHistory(hyperv1.EncryptionMigrationHistory{ + From: secretencryption.KeyReferenceFromStatus(oldKS), + To: secretencryption.KeyReferenceFromStatus(newKS), + State: hyperv1.EncryptionMigrationStateMigrating, + StartedTime: metav1.Time{Time: fixedTime}, + }), + ), + aescbcKeySecret("aescbc-key-1", testNamespace, "new-key-data"), + convergedKASDeployment(testNamespace), + // Target key is write (first), old key is read-only (second). + encryptionConfigSecret(testNamespace, hyperv1.AESCBC, + aescbcProviderKeyName("new-key-data"), + aescbcProviderKeyName("old-key-data")), + } + }(), + migrator: newFakeMigrator, + expectResult: reconcile.Result{RequeueAfter: 30 * time.Second}, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateMigrating)) + }, + }, + { + name: "When in Migrating phase and all AESCBC migrations complete it should complete rotation", + cpObjects: func() []client.Object { + oldHash := secretencryption.DataHash([]byte("old-key-data")) + newHash := secretencryption.DataHash([]byte("new-key-data")) + oldKS := aescbcKeyStatus("aescbc-key-1", oldHash) + newKS := aescbcKeyStatus("aescbc-key-1", newHash) + return []client.Object{ + newHCP( + withAESCBCEncryption("aescbc-key-1"), + withActiveKey(oldKS), + withTargetKey(newKS), + withHistory(hyperv1.EncryptionMigrationHistory{ + From: secretencryption.KeyReferenceFromStatus(oldKS), + To: secretencryption.KeyReferenceFromStatus(newKS), + State: hyperv1.EncryptionMigrationStateMigrating, + StartedTime: metav1.Time{Time: fixedTime}, + }), + ), + aescbcKeySecret("aescbc-key-1", testNamespace, "new-key-data"), + convergedKASDeployment(testNamespace), + // Target key is write (first), old key is read-only (second). + encryptionConfigSecret(testNamespace, hyperv1.AESCBC, + aescbcProviderKeyName("new-key-data"), + aescbcProviderKeyName("old-key-data")), + } + }(), + migrator: func() *fakeMigrator { + m := newFakeMigrator() + newHash := secretencryption.DataHash([]byte("new-key-data")) + fp := secretencryption.FingerprintAESCBCKey("aescbc-key-1", newHash) + writeKey := fmt.Sprintf("encryption-key-%s", fp) + // AESCBC only encrypts secrets. + m.completeMigration(schema.GroupResource{Resource: "secrets"}, writeKey) + return m + }, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).To(BeEmpty()) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.Provider).ToNot(BeEmpty()) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.Provider).To(Equal(hyperv1.SecretEncryptionProviderAESCBC)) + newHash := secretencryption.DataHash([]byte("new-key-data")) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.AESCBC.DataHash).To(Equal(newHash)) + + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateCompleted)) + g.Expect(hcp.Status.SecretEncryption.History[0].CompletionTime).ToNot(BeNil()) + + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).ToNot(BeNil()) + g.Expect(cond.Status).To(Equal(metav1.ConditionTrue)) + g.Expect(cond.Reason).To(Equal(hyperv1.ReEncryptionCompletedReason)) + }, + }, + { + name: "When in Migrating phase and a migration fails it should set failed condition", + cpObjects: func() []client.Object { + oldHash := secretencryption.DataHash([]byte("old-key-data")) + newHash := secretencryption.DataHash([]byte("new-key-data")) + oldKS := aescbcKeyStatus("aescbc-key-1", oldHash) + newKS := aescbcKeyStatus("aescbc-key-1", newHash) + return []client.Object{ + newHCP( + withAESCBCEncryption("aescbc-key-1"), + withActiveKey(oldKS), + withTargetKey(newKS), + withHistory(hyperv1.EncryptionMigrationHistory{ + From: secretencryption.KeyReferenceFromStatus(oldKS), + To: secretencryption.KeyReferenceFromStatus(newKS), + State: hyperv1.EncryptionMigrationStateMigrating, + StartedTime: metav1.Time{Time: fixedTime}, + }), + ), + aescbcKeySecret("aescbc-key-1", testNamespace, "new-key-data"), + convergedKASDeployment(testNamespace), + // Target key is write (first), old key is read-only (second). + encryptionConfigSecret(testNamespace, hyperv1.AESCBC, + aescbcProviderKeyName("new-key-data"), + aescbcProviderKeyName("old-key-data")), + } + }(), + migrator: func() *fakeMigrator { + m := newFakeMigrator() + newHash := secretencryption.DataHash([]byte("new-key-data")) + fp := secretencryption.FingerprintAESCBCKey("aescbc-key-1", newHash) + writeKey := fmt.Sprintf("encryption-key-%s", fp) + m.failMigration(schema.GroupResource{Resource: "secrets"}, writeKey, fmt.Errorf("migration failed: timeout")) + return m + }, + expectResult: reconcile.Result{RequeueAfter: 60 * time.Second}, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateMigrating)) + + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).ToNot(BeNil()) + g.Expect(cond.Status).To(Equal(metav1.ConditionFalse)) + g.Expect(cond.Reason).To(Equal(hyperv1.ReEncryptionFailedReason)) + }, + }, + { + name: "When using AWS KMS and key ARN changes it should start rotation with 5 encrypted resources", + cpObjects: func() []client.Object { + oldKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/old-key", "us-east-1") + return []client.Object{ + newHCP( + withKMSEncryption(), + withActiveKey(oldKS), + ), + convergedKASDeployment(testNamespace), + } + }(), + migrator: newFakeMigrator, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).ToNot(BeEmpty()) + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).To(Equal(hyperv1.SecretEncryptionProviderAWS)) + g.Expect(hcp.Status.SecretEncryption.TargetKey.AWS.ARN).To(Equal("arn:aws:kms:us-east-1:123456789012:key/test-key-1")) + + g.Expect(hcp.Status.SecretEncryption.History).To(HaveLen(1)) + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateReadOnlyDeploy)) + }, + }, + { + name: "When in Migrating phase with KMS and all 5 migrations complete it should complete rotation", + cpObjects: func() []client.Object { + oldKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/old-key", "us-east-1") + newKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/test-key-1", "us-east-1") + return []client.Object{ + newHCP( + withKMSEncryption(), + withActiveKey(oldKS), + withTargetKey(newKS), + withHistory(hyperv1.EncryptionMigrationHistory{ + From: secretencryption.KeyReferenceFromStatus(oldKS), + To: secretencryption.KeyReferenceFromStatus(newKS), + State: hyperv1.EncryptionMigrationStateMigrating, + StartedTime: metav1.Time{Time: fixedTime}, + }), + ), + convergedKASDeployment(testNamespace), + // Target key is write (first KMS provider), old key is read-only (second). + encryptionConfigSecret(testNamespace, hyperv1.KMS, + awsProviderKeyName("arn:aws:kms:us-east-1:123456789012:key/test-key-1"), + awsProviderKeyName("arn:aws:kms:us-east-1:123456789012:key/old-key")), + } + }(), + migrator: func() *fakeMigrator { + m := newFakeMigrator() + fp := secretencryption.FingerprintAWSKMSKey("arn:aws:kms:us-east-1:123456789012:key/test-key-1") + writeKey := fmt.Sprintf("encryption-key-%s", fp) + resources := []schema.GroupResource{ + {Resource: "secrets"}, + {Resource: "configmaps"}, + {Resource: "routes", Group: "route.openshift.io"}, + {Resource: "oauthaccesstokens", Group: "oauth.openshift.io"}, + {Resource: "oauthauthorizetokens", Group: "oauth.openshift.io"}, + } + m.completeAll(resources, writeKey) + return m + }, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).To(BeEmpty()) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.Provider).To(Equal(hyperv1.SecretEncryptionProviderAWS)) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.AWS.ARN).To(Equal("arn:aws:kms:us-east-1:123456789012:key/test-key-1")) + + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateCompleted)) + + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).ToNot(BeNil()) + g.Expect(cond.Status).To(Equal(metav1.ConditionTrue)) + }, + }, + { + name: "When spec key changes mid-rotation it should let current rotation complete first", + cpObjects: func() []client.Object { + oldHash := secretencryption.DataHash([]byte("old-key-data")) + midHash := secretencryption.DataHash([]byte("mid-key-data")) + oldKS := aescbcKeyStatus("aescbc-key-1", oldHash) + midKS := aescbcKeyStatus("aescbc-key-2", midHash) + + hcp := newHCP( + withActiveKey(oldKS), + withTargetKey(midKS), + withHistory(hyperv1.EncryptionMigrationHistory{ + From: secretencryption.KeyReferenceFromStatus(oldKS), + To: secretencryption.KeyReferenceFromStatus(midKS), + State: hyperv1.EncryptionMigrationStateWritePromote, + StartedTime: metav1.Time{Time: fixedTime}, + }), + ) + // Spec now points to a third key (simulates user changing spec again). + hcp.Spec.SecretEncryption = &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.AESCBC, + AESCBC: &hyperv1.AESCBCSpec{ + ActiveKey: corev1.LocalObjectReference{Name: "aescbc-key-3"}, + }, + } + return []client.Object{ + hcp, + aescbcKeySecret("aescbc-key-2", testNamespace, "mid-key-data"), + aescbcKeySecret("aescbc-key-3", testNamespace, "third-key-data"), + convergedKASDeployment(testNamespace), + // Target (mid) key is write (first), old key is read-only (second). + encryptionConfigSecret(testNamespace, hyperv1.AESCBC, + aescbcProviderKeyName("mid-key-data"), + aescbcProviderKeyName("old-key-data")), + } + }(), + migrator: newFakeMigrator, + // The controller derives Migrating from observable state (target key is write + KAS converged) + // and immediately starts migrations which are not yet finished, so it requeues. + expectResult: reconcile.Result{RequeueAfter: 30 * time.Second}, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + // The current rotation should continue: WritePromote -> Migrating. + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateMigrating)) + // TargetKey should remain the mid-rotation key, not the new spec key. + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).ToNot(BeEmpty()) + }, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + g := NewWithT(t) + ctx := context.Background() + + cpClient := buildCPClient(tt.cpObjects...) + migrator := tt.migrator() + r := newReconciler(cpClient, nil, migrator) + + result, err := r.Reconcile(ctx, reconcile.Request{ + NamespacedName: types.NamespacedName{ + Namespace: testNamespace, + Name: testHCPName, + }, + }) + + if tt.expectError { + g.Expect(err).To(HaveOccurred()) + } else { + g.Expect(err).ToNot(HaveOccurred()) + } + + g.Expect(result).To(Equal(tt.expectResult)) + + if tt.validate != nil { + tt.validate(t, g, cpClient, migrator) + } + }) + } +} + +func TestParseGroupResource(t *testing.T) { + tests := []struct { + name string + input string + expected schema.GroupResource + }{ + { + name: "When parsing a core resource it should return empty group", + input: "secrets", + expected: schema.GroupResource{Group: "", Resource: "secrets"}, + }, + { + name: "When parsing a core resource configmaps it should return empty group", + input: "configmaps", + expected: schema.GroupResource{Group: "", Resource: "configmaps"}, + }, + { + name: "When parsing a route resource it should split group correctly", + input: "routes.route.openshift.io", + expected: schema.GroupResource{Group: "route.openshift.io", Resource: "routes"}, + }, + { + name: "When parsing an oauth resource it should split group correctly", + input: "oauthaccesstokens.oauth.openshift.io", + expected: schema.GroupResource{Group: "oauth.openshift.io", Resource: "oauthaccesstokens"}, + }, + { + name: "When parsing oauthauthorizetokens resource it should split group correctly", + input: "oauthauthorizetokens.oauth.openshift.io", + expected: schema.GroupResource{Group: "oauth.openshift.io", Resource: "oauthauthorizetokens"}, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + g := NewWithT(t) + g.Expect(parseGroupResource(tt.input)).To(Equal(tt.expected)) + }) + } +} + +func TestPrependHistory(t *testing.T) { + t.Run("When prepending to empty history it should contain only the new entry", func(t *testing.T) { + g := NewWithT(t) + entry := hyperv1.EncryptionMigrationHistory{ + State: hyperv1.EncryptionMigrationStateReadOnlyDeploy, + StartedTime: metav1.Time{Time: fixedTime}, + } + result := prependHistory(nil, entry) + g.Expect(result).To(HaveLen(1)) + g.Expect(result[0].State).To(Equal(hyperv1.EncryptionMigrationStateReadOnlyDeploy)) + }) + + t.Run("When prepending to full history it should trim to max entries", func(t *testing.T) { + g := NewWithT(t) + existing := make([]hyperv1.EncryptionMigrationHistory, maxHistoryEntries) + for i := range existing { + existing[i] = hyperv1.EncryptionMigrationHistory{ + State: hyperv1.EncryptionMigrationStateCompleted, + StartedTime: metav1.Time{Time: fixedTime.Add(-time.Duration(i) * time.Hour)}, + } + } + entry := hyperv1.EncryptionMigrationHistory{ + State: hyperv1.EncryptionMigrationStateReadOnlyDeploy, + StartedTime: metav1.Time{Time: fixedTime}, + } + result := prependHistory(existing, entry) + g.Expect(result).To(HaveLen(maxHistoryEntries)) + g.Expect(result[0].State).To(Equal(hyperv1.EncryptionMigrationStateReadOnlyDeploy)) + g.Expect(result[maxHistoryEntries-1].State).To(Equal(hyperv1.EncryptionMigrationStateCompleted)) + }) +} + +func TestEncryptedResources(t *testing.T) { + t.Run("When encryption type is AESCBC it should return only secrets", func(t *testing.T) { + g := NewWithT(t) + r := &Reconciler{} + hcp := newHCP(withAESCBCEncryption("key")) + resources := r.encryptedResources(hcp) + g.Expect(resources).To(HaveLen(1)) + g.Expect(resources[0]).To(Equal(schema.GroupResource{Resource: "secrets"})) + }) + + t.Run("When encryption type is KMS it should return 5 resources", func(t *testing.T) { + g := NewWithT(t) + r := &Reconciler{} + hcp := newHCP(withKMSEncryption()) + resources := r.encryptedResources(hcp) + g.Expect(resources).To(HaveLen(5)) + g.Expect(resources).To(ContainElement(schema.GroupResource{Resource: "secrets"})) + g.Expect(resources).To(ContainElement(schema.GroupResource{Resource: "configmaps"})) + g.Expect(resources).To(ContainElement(schema.GroupResource{Group: "route.openshift.io", Resource: "routes"})) + g.Expect(resources).To(ContainElement(schema.GroupResource{Group: "oauth.openshift.io", Resource: "oauthaccesstokens"})) + g.Expect(resources).To(ContainElement(schema.GroupResource{Group: "oauth.openshift.io", Resource: "oauthauthorizetokens"})) + }) + + t.Run("When encryption is not configured it should return nil", func(t *testing.T) { + g := NewWithT(t) + r := &Reconciler{} + hcp := newHCP() + resources := r.encryptedResources(hcp) + g.Expect(resources).To(BeNil()) + }) +} diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/setup.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/setup.go new file mode 100644 index 000000000000..b7d4dd5fc5ed --- /dev/null +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/setup.go @@ -0,0 +1,104 @@ +package reencryption + +import ( + "context" + "fmt" + "time" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/operator" + + "github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators" + + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/types" + kubeclient "k8s.io/client-go/kubernetes" + "k8s.io/client-go/tools/cache" + + crclient "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/controller" + "sigs.k8s.io/controller-runtime/pkg/handler" + "sigs.k8s.io/controller-runtime/pkg/reconcile" + "sigs.k8s.io/controller-runtime/pkg/source" + kubemigratorclient "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset" + migrationv1alpha1informer "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer" +) + +const ControllerName = "reencryption" + +func Setup(ctx context.Context, opts *operator.HostedClusterConfigOperatorConfig) error { + // Create the kube-storage-version-migrator client for the guest cluster. + svmClient, err := kubemigratorclient.NewForConfig(opts.TargetConfig) + if err != nil { + return fmt.Errorf("failed to create storage-version-migrator client: %w", err) + } + + // Create a discovery client for the guest cluster to resolve preferred versions. + guestKubeClient, err := kubeclient.NewForConfig(opts.TargetConfig) + if err != nil { + return fmt.Errorf("failed to create guest kube client: %w", err) + } + + svmInformerFactory := migrationv1alpha1informer.NewSharedInformerFactory(svmClient, 10*time.Minute) + svmInformer := svmInformerFactory.Migration().V1alpha1() + + migrator := migrators.NewKubeStorageVersionMigrator( + svmClient, + svmInformer, + guestKubeClient.Discovery(), + ) + + r := &Reconciler{ + cpClient: opts.CPCluster.GetClient(), + guestClient: opts.Manager.GetClient(), + hcpName: opts.HCPName, + hcpNamespace: opts.Namespace, + migrator: migrator, + now: time.Now, + } + + c, err := controller.New(ControllerName, opts.Manager, controller.Options{Reconciler: r}) + if err != nil { + return fmt.Errorf("failed to construct controller: %w", err) + } + + // Watch the HostedControlPlane in the CP cluster. + if err := c.Watch(source.Kind(opts.CPCluster.GetCache(), &hyperv1.HostedControlPlane{}, + &handler.TypedEnqueueRequestForObject[*hyperv1.HostedControlPlane]{})); err != nil { + return fmt.Errorf("failed to watch HostedControlPlane: %w", err) + } + + // Watch KAS Deployment in the CP cluster for convergence detection. + hcpMapper := func(_ context.Context, obj crclient.Object) []reconcile.Request { + if obj.GetNamespace() == opts.Namespace { + return []reconcile.Request{{NamespacedName: types.NamespacedName{ + Namespace: opts.Namespace, + Name: opts.HCPName, + }}} + } + return nil + } + if err := c.Watch(source.Kind[crclient.Object](opts.CPCluster.GetCache(), &appsv1.Deployment{}, + handler.EnqueueRequestsFromMapFunc(hcpMapper))); err != nil { + return fmt.Errorf("failed to watch KAS Deployment: %w", err) + } + + // Watch Secrets in the CP cluster namespace (for AESCBC key changes). + if err := c.Watch(source.Kind[crclient.Object](opts.CPCluster.GetCache(), &corev1.Secret{}, + handler.EnqueueRequestsFromMapFunc(hcpMapper))); err != nil { + return fmt.Errorf("failed to watch Secrets: %w", err) + } + + // Register an event handler on the SVM informer. This call is required + // because AddEventHandler initializes the migrator's internal cacheSynced + // function; without it, HasSynced() will panic. The handler itself is a + // no-op because the controller reconciles on a requeue interval while + // migrations are in progress. + if _, err := migrator.AddEventHandler(cache.ResourceEventHandlerFuncs{}); err != nil { + return fmt.Errorf("failed to add SVM event handler: %w", err) + } + svmInformerFactory.Start(ctx.Done()) + + return nil +} From 36d576448a0caff654b1462b12cf5b96047816d4 Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Thu, 21 May 2026 13:52:40 +0200 Subject: [PATCH 06/12] docs: regenerate API reference and aggregated docs Signed-off-by: Mulham Raee Commit-Message-Assisted-by: Claude (via Claude Code) --- docs/content/reference/aggregated-docs.md | 608 ++++++++++++++++++++++ docs/content/reference/api.md | 608 ++++++++++++++++++++++ 2 files changed, 1216 insertions(+) diff --git a/docs/content/reference/aggregated-docs.md b/docs/content/reference/aggregated-docs.md index d70c1b359e8d..6a4e3d70a299 100644 --- a/docs/content/reference/aggregated-docs.md +++ b/docs/content/reference/aggregated-docs.md @@ -37047,6 +37047,50 @@ NodePoolStatus +###AESCBCKeyStatus { #hypershift.openshift.io/v1beta1.AESCBCKeyStatus } +

+(Appears on: +SecretEncryptionKeyStatus) +

+

+

AESCBCKeyStatus contains a reference to the AESCBC key secret and a SHA-256 hash +of its contents for fingerprinting.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+secret
+ + +Kubernetes core/v1.LocalObjectReference + + +		 +

secret is a reference to the secret containing the AESCBC key.

+
+dataHash
+ +string + +		 +

dataHash is the hex-encoded SHA-256 hash of the secret’s “key” data field +at the time re-encryption completed.

+
###AESCBCSpec { #hypershift.openshift.io/v1beta1.AESCBCSpec }

(Appears on: @@ -37089,6 +37133,8 @@ Kubernetes core/v1.LocalObjectReference (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

+

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. +The system automatically manages the previous key via the status field.

@@ -37345,6 +37391,47 @@ string +###AWSKMSKeyStatus { #hypershift.openshift.io/v1beta1.AWSKMSKeyStatus } +

+(Appears on: +SecretEncryptionKeyStatus) +

+

+

AWSKMSKeyStatus contains identity fields for an AWS KMS key, sufficient to +reconstruct the backup sidecar container arguments.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+arn
+ +string + +		 +

arn is the Amazon Resource Name of the KMS key.

+
+region
+ +string + +		 +

region is the AWS region of the KMS key.

+
###AWSKMSSpec { #hypershift.openshift.io/v1beta1.AWSKMSSpec }

(Appears on: @@ -37398,6 +37485,8 @@ AWSKMSKeyEntry (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

+

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. +The system automatically manages the previous key via the status field.

@@ -39084,6 +39173,58 @@ string +###AzureKMSKeyStatus { #hypershift.openshift.io/v1beta1.AzureKMSKeyStatus } +

+(Appears on: +SecretEncryptionKeyStatus) +

+

+

AzureKMSKeyStatus contains identity fields for an Azure KMS key, sufficient to +reconstruct the EncryptionConfiguration read provider.

+

+ + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+keyVaultName
+ +string + +		 +

keyVaultName is the name of the Azure Key Vault.

+
+keyName
+ +string + +		 +

keyName is the name of the key in the vault.

+
+keyVersion
+ +string + +		 +

keyVersion is the version of the key.

+
###AzureKMSSpec { #hypershift.openshift.io/v1beta1.AzureKMSSpec }

(Appears on: @@ -39126,6 +39267,8 @@ AzureKMSKey (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

+

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. +The system automatically manages the previous key via the status field.

@@ -41644,6 +41787,13 @@ A failure here often means a software bug or a non-stable cluster.

most recent etcd backup. True means the last backup completed successfully; False means a backup is in progress or the last backup failed.

+

"EtcdDataEncryptionUpToDate"

+

EtcdDataEncryptionUpToDate indicates whether all etcd data is encrypted with the +currently active encryption key. +True: all data confirmed encrypted with the active key. +False: re-encryption is in progress or has failed. +Absent: encryption is not configured.

+

"EtcdRecoveryActive"

EtcdRecoveryActive indicates that the Etcd cluster is failing and the recovery job was triggered.

@@ -42529,6 +42679,168 @@ UserManagedDiagnostics +###EncryptionKeyReference { #hypershift.openshift.io/v1beta1.EncryptionKeyReference } +

+(Appears on: +EncryptionMigrationHistory) +

+

+

EncryptionKeyReference identifies an encryption key by its provider and fingerprint.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+provider
+ + +SecretEncryptionProvider + + +		 +

provider identifies the encryption provider.

+
+fingerprint
+ +string + +		 +

fingerprint is the hex-encoded SHA-256 hash of the key’s identity fields.

+
+###EncryptionMigrationHistory { #hypershift.openshift.io/v1beta1.EncryptionMigrationHistory } +

+(Appears on: +SecretEncryptionStatus) +

+

+

EncryptionMigrationHistory records a key rotation, including in-progress rotations.

+

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+from,omitzero
+ + +EncryptionKeyReference + + +		 +

from is the key that data was migrated from (the previous active key).

+
+to,omitzero
+ + +EncryptionKeyReference + + +		 +

to is the key that data was migrated to (the target key).

+
+state
+ + +EncryptionMigrationState + + +		 +

state tracks the current phase of this rotation.

+
+startedTime
+ + +Kubernetes meta/v1.Time + + +		 +

startedTime is when the rotation was initiated.

+
+completionTime
+ + +Kubernetes meta/v1.Time + + +		 +(Optional) +

completionTime is when the rotation finished. Not set while the rotation is in progress.

+
+###EncryptionMigrationState { #hypershift.openshift.io/v1beta1.EncryptionMigrationState } +

+(Appears on: +EncryptionMigrationHistory) +

+

+

EncryptionMigrationState tracks the lifecycle of a key rotation.

+

+ + + + + + + + + + + + + + + + + + +
ValueDescription

"Completed"

EncryptionMigrationStateCompleted means all data was successfully re-encrypted with the target key.

+

"Interrupted"

EncryptionMigrationStateInterrupted means the rotation was abandoned before data was encrypted +with the target key (e.g., targetKey replaced during ReadOnlyDeploy).

+

"Migrating"

EncryptionMigrationStateMigrating means all KAS replicas have converged on the new write +provider and re-encryption (StorageVersionMigration) is in progress.

+

"ReadOnlyDeploy"

EncryptionMigrationStateReadOnlyDeploy means the new key is being deployed as a read-only +provider. The old key remains the write provider.

+

"WritePromote"

EncryptionMigrationStateWritePromote means the new key is being promoted to write provider. +The old key becomes read-only.

+
###EtcdManagementType { #hypershift.openshift.io/v1beta1.EtcdManagementType }

(Appears on: @@ -45313,6 +45625,20 @@ successful etcd backup snapshot. Persisted here because HCPEtcdBackup CRs are ephemeral and may be deleted by retention policies.

+ + +secretEncryption,omitzero
+ + +SecretEncryptionStatus + + + + +(Optional) +

secretEncryption tracks the state of secret encryption key rotation and re-encryption.

+ + ###HostedControlPlaneSpec { #hypershift.openshift.io/v1beta1.HostedControlPlaneSpec } @@ -46101,6 +46427,20 @@ ConfigurationStatus

configuration contains the cluster configuration status of the HostedCluster

+ + +secretEncryption,omitzero
+ + +SecretEncryptionStatus + + + + +(Optional) +

secretEncryption tracks the state of secret encryption key rotation and re-encryption.

+ + ###IBMCloudKMSAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSAuthSpec } @@ -46262,6 +46602,91 @@ key is enabled for data encryption.

+###IBMCloudKMSKeyStatus { #hypershift.openshift.io/v1beta1.IBMCloudKMSKeyStatus } +

+(Appears on: +SecretEncryptionKeyStatus) +

+

+

IBMCloudKMSKeyStatus contains identity fields for an IBM Cloud KMS key list entry, +sufficient to reconstruct the KP_DATA_JSON entry for the backup key.

+

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+crkID
+ +string + +		 +

crkID is the Customer Root Key ID.

+
+instanceID
+ +string + +		 +

instanceID is the KMS instance ID.

+
+keyVersion
+ +int32 + +		 +

keyVersion is the key version number.

+
+region
+ +string + +		 +

region is the IBM Cloud region.

+
+correlationID
+ +string + +		 +

correlationID is the correlation ID for the key.

+
+url
+ +string + +		 +

url is the KMS endpoint URL.

+
###IBMCloudKMSManagedAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSManagedAuthSpec }

(Appears on: @@ -51663,6 +52088,121 @@ When omitted, the autoscaler defaults to 50%.

+###SecretEncryptionKeyStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus } +

+(Appears on: +SecretEncryptionStatus) +

+

+

SecretEncryptionKeyStatus records the active key identity. Status-specific types are used +instead of reusing the spec types directly, to decouple status serialization from spec type evolution.

+

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+provider
+ + +SecretEncryptionProvider + + +		 +

provider identifies the encryption provider.

+
+azure,omitzero
+ + +AzureKMSKeyStatus + + +		 +(Optional) +

azure holds the Azure KMS key identity fields.

+
+aws,omitzero
+ + +AWSKMSKeyStatus + + +		 +(Optional) +

aws holds the AWS KMS key identity fields.

+
+ibmCloud,omitzero
+ + +IBMCloudKMSKeyStatus + + +		 +(Optional) +

ibmCloud holds the IBM Cloud KMS key identity fields.

+
+aescbc,omitzero
+ + +AESCBCKeyStatus + + +		 +(Optional) +

aescbc holds a reference to the AESCBC key secret.

+
+###SecretEncryptionProvider { #hypershift.openshift.io/v1beta1.SecretEncryptionProvider } +

+(Appears on: +EncryptionKeyReference, +SecretEncryptionKeyStatus) +

+

+

SecretEncryptionProvider identifies the encryption provider recorded in status. +This is a separate type from KMSProvider because the KMSProvider enum does not include AESCBC.

+

+ + + + + + + + + + + + + + + + +
ValueDescription

"AESCBC"

"AWS"

"Azure"

"IBMCloud"

###SecretEncryptionSpec { #hypershift.openshift.io/v1beta1.SecretEncryptionSpec }

(Appears on: @@ -51724,6 +52264,74 @@ AESCBCSpec +###SecretEncryptionStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionStatus } +

+(Appears on: +HostedClusterStatus, +HostedControlPlaneStatus) +

+

+

SecretEncryptionStatus tracks the state of secret encryption key rotation and re-encryption.

+

+ + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+activeKey,omitzero
+ + +SecretEncryptionKeyStatus + + +		 +(Optional) +

activeKey is the encryption key specification that all etcd data is confirmed encrypted with. +Updated after successful re-encryption.

+
+targetKey,omitzero
+ + +SecretEncryptionKeyStatus + + +		 +(Optional) +

targetKey is the key being rolled out during an active rotation. Snapshot from +spec.secretEncryption’s active key when the rotation starts. The CPO uses this +(not the current spec) during the rotation, so mid-rotation spec changes are +safely queued until the current rotation completes. Cleared when rotation completes.

+
+history
+ + +[]EncryptionMigrationHistory + + +		 +(Optional) +

history contains a list of key rotations applied to this cluster. The newest +entry is first in the list. Entries have state Completed when re-encryption +has finished. The current rotation phase is always history[0].state when +history[0] is not Completed or Interrupted.

+
###SecretEncryptionType { #hypershift.openshift.io/v1beta1.SecretEncryptionType }

(Appears on: diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md index fb4fb96c1b20..a25c11791714 100644 --- a/docs/content/reference/api.md +++ b/docs/content/reference/api.md @@ -1362,6 +1362,50 @@ NodePoolStatus +###AESCBCKeyStatus { #hypershift.openshift.io/v1beta1.AESCBCKeyStatus } +

+(Appears on: +SecretEncryptionKeyStatus) +

+

+

AESCBCKeyStatus contains a reference to the AESCBC key secret and a SHA-256 hash +of its contents for fingerprinting.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+secret
+ + +Kubernetes core/v1.LocalObjectReference + + +		 +

secret is a reference to the secret containing the AESCBC key.

+
+dataHash
+ +string + +		 +

dataHash is the hex-encoded SHA-256 hash of the secret’s “key” data field +at the time re-encryption completed.

+
###AESCBCSpec { #hypershift.openshift.io/v1beta1.AESCBCSpec }

(Appears on: @@ -1404,6 +1448,8 @@ Kubernetes core/v1.LocalObjectReference (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

+

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. +The system automatically manages the previous key via the status field.

@@ -1660,6 +1706,47 @@ string +###AWSKMSKeyStatus { #hypershift.openshift.io/v1beta1.AWSKMSKeyStatus } +

+(Appears on: +SecretEncryptionKeyStatus) +

+

+

AWSKMSKeyStatus contains identity fields for an AWS KMS key, sufficient to +reconstruct the backup sidecar container arguments.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+arn
+ +string + +		 +

arn is the Amazon Resource Name of the KMS key.

+
+region
+ +string + +		 +

region is the AWS region of the KMS key.

+
###AWSKMSSpec { #hypershift.openshift.io/v1beta1.AWSKMSSpec }

(Appears on: @@ -1713,6 +1800,8 @@ AWSKMSKeyEntry (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

+

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. +The system automatically manages the previous key via the status field.

@@ -3399,6 +3488,58 @@ string +###AzureKMSKeyStatus { #hypershift.openshift.io/v1beta1.AzureKMSKeyStatus } +

+(Appears on: +SecretEncryptionKeyStatus) +

+

+

AzureKMSKeyStatus contains identity fields for an Azure KMS key, sufficient to +reconstruct the EncryptionConfiguration read provider.

+

+ + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+keyVaultName
+ +string + +		 +

keyVaultName is the name of the Azure Key Vault.

+
+keyName
+ +string + +		 +

keyName is the name of the key in the vault.

+
+keyVersion
+ +string + +		 +

keyVersion is the version of the key.

+
###AzureKMSSpec { #hypershift.openshift.io/v1beta1.AzureKMSSpec }

(Appears on: @@ -3441,6 +3582,8 @@ AzureKMSKey (Optional)

backupKey defines the old key during the rotation process so previously created secrets can continue to be decrypted until they are all re-encrypted with the active key.

+

Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. +The system automatically manages the previous key via the status field.

@@ -5959,6 +6102,13 @@ A failure here often means a software bug or a non-stable cluster.

most recent etcd backup. True means the last backup completed successfully; False means a backup is in progress or the last backup failed.

+

"EtcdDataEncryptionUpToDate"

+

EtcdDataEncryptionUpToDate indicates whether all etcd data is encrypted with the +currently active encryption key. +True: all data confirmed encrypted with the active key. +False: re-encryption is in progress or has failed. +Absent: encryption is not configured.

+

"EtcdRecoveryActive"

EtcdRecoveryActive indicates that the Etcd cluster is failing and the recovery job was triggered.

@@ -6844,6 +6994,168 @@ UserManagedDiagnostics +###EncryptionKeyReference { #hypershift.openshift.io/v1beta1.EncryptionKeyReference } +

+(Appears on: +EncryptionMigrationHistory) +

+

+

EncryptionKeyReference identifies an encryption key by its provider and fingerprint.

+

+ + + + + + + + + + + + + + + + + +
FieldDescription
+provider
+ + +SecretEncryptionProvider + + +		 +

provider identifies the encryption provider.

+
+fingerprint
+ +string + +		 +

fingerprint is the hex-encoded SHA-256 hash of the key’s identity fields.

+
+###EncryptionMigrationHistory { #hypershift.openshift.io/v1beta1.EncryptionMigrationHistory } +

+(Appears on: +SecretEncryptionStatus) +

+

+

EncryptionMigrationHistory records a key rotation, including in-progress rotations.

+

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+from,omitzero
+ + +EncryptionKeyReference + + +		 +

from is the key that data was migrated from (the previous active key).

+
+to,omitzero
+ + +EncryptionKeyReference + + +		 +

to is the key that data was migrated to (the target key).

+
+state
+ + +EncryptionMigrationState + + +		 +

state tracks the current phase of this rotation.

+
+startedTime
+ + +Kubernetes meta/v1.Time + + +		 +

startedTime is when the rotation was initiated.

+
+completionTime
+ + +Kubernetes meta/v1.Time + + +		 +(Optional) +

completionTime is when the rotation finished. Not set while the rotation is in progress.

+
+###EncryptionMigrationState { #hypershift.openshift.io/v1beta1.EncryptionMigrationState } +

+(Appears on: +EncryptionMigrationHistory) +

+

+

EncryptionMigrationState tracks the lifecycle of a key rotation.

+

+ + + + + + + + + + + + + + + + + + +
ValueDescription

"Completed"

EncryptionMigrationStateCompleted means all data was successfully re-encrypted with the target key.

+

"Interrupted"

EncryptionMigrationStateInterrupted means the rotation was abandoned before data was encrypted +with the target key (e.g., targetKey replaced during ReadOnlyDeploy).

+

"Migrating"

EncryptionMigrationStateMigrating means all KAS replicas have converged on the new write +provider and re-encryption (StorageVersionMigration) is in progress.

+

"ReadOnlyDeploy"

EncryptionMigrationStateReadOnlyDeploy means the new key is being deployed as a read-only +provider. The old key remains the write provider.

+

"WritePromote"

EncryptionMigrationStateWritePromote means the new key is being promoted to write provider. +The old key becomes read-only.

+
###EtcdManagementType { #hypershift.openshift.io/v1beta1.EtcdManagementType }

(Appears on: @@ -9628,6 +9940,20 @@ successful etcd backup snapshot. Persisted here because HCPEtcdBackup CRs are ephemeral and may be deleted by retention policies.

+ + +secretEncryption,omitzero
+ + +SecretEncryptionStatus + + + + +(Optional) +

secretEncryption tracks the state of secret encryption key rotation and re-encryption.

+ + ###HostedControlPlaneSpec { #hypershift.openshift.io/v1beta1.HostedControlPlaneSpec } @@ -10416,6 +10742,20 @@ ConfigurationStatus

configuration contains the cluster configuration status of the HostedCluster

+ + +secretEncryption,omitzero
+ + +SecretEncryptionStatus + + + + +(Optional) +

secretEncryption tracks the state of secret encryption key rotation and re-encryption.

+ + ###IBMCloudKMSAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSAuthSpec } @@ -10577,6 +10917,91 @@ key is enabled for data encryption.

+###IBMCloudKMSKeyStatus { #hypershift.openshift.io/v1beta1.IBMCloudKMSKeyStatus } +

+(Appears on: +SecretEncryptionKeyStatus) +

+

+

IBMCloudKMSKeyStatus contains identity fields for an IBM Cloud KMS key list entry, +sufficient to reconstruct the KP_DATA_JSON entry for the backup key.

+

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+crkID
+ +string + +		 +

crkID is the Customer Root Key ID.

+
+instanceID
+ +string + +		 +

instanceID is the KMS instance ID.

+
+keyVersion
+ +int32 + +		 +

keyVersion is the key version number.

+
+region
+ +string + +		 +

region is the IBM Cloud region.

+
+correlationID
+ +string + +		 +

correlationID is the correlation ID for the key.

+
+url
+ +string + +		 +

url is the KMS endpoint URL.

+
###IBMCloudKMSManagedAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSManagedAuthSpec }

(Appears on: @@ -15978,6 +16403,121 @@ When omitted, the autoscaler defaults to 50%.

+###SecretEncryptionKeyStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus } +

+(Appears on: +SecretEncryptionStatus) +

+

+

SecretEncryptionKeyStatus records the active key identity. Status-specific types are used +instead of reusing the spec types directly, to decouple status serialization from spec type evolution.

+

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+provider
+ + +SecretEncryptionProvider + + +		 +

provider identifies the encryption provider.

+
+azure,omitzero
+ + +AzureKMSKeyStatus + + +		 +(Optional) +

azure holds the Azure KMS key identity fields.

+
+aws,omitzero
+ + +AWSKMSKeyStatus + + +		 +(Optional) +

aws holds the AWS KMS key identity fields.

+
+ibmCloud,omitzero
+ + +IBMCloudKMSKeyStatus + + +		 +(Optional) +

ibmCloud holds the IBM Cloud KMS key identity fields.

+
+aescbc,omitzero
+ + +AESCBCKeyStatus + + +		 +(Optional) +

aescbc holds a reference to the AESCBC key secret.

+
+###SecretEncryptionProvider { #hypershift.openshift.io/v1beta1.SecretEncryptionProvider } +

+(Appears on: +EncryptionKeyReference, +SecretEncryptionKeyStatus) +

+

+

SecretEncryptionProvider identifies the encryption provider recorded in status. +This is a separate type from KMSProvider because the KMSProvider enum does not include AESCBC.

+

+ + + + + + + + + + + + + + + + +
ValueDescription

"AESCBC"

"AWS"

"Azure"

"IBMCloud"

###SecretEncryptionSpec { #hypershift.openshift.io/v1beta1.SecretEncryptionSpec }

(Appears on: @@ -16039,6 +16579,74 @@ AESCBCSpec +###SecretEncryptionStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionStatus } +

+(Appears on: +HostedClusterStatus, +HostedControlPlaneStatus) +

+

+

SecretEncryptionStatus tracks the state of secret encryption key rotation and re-encryption.

+

+ + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+activeKey,omitzero
+ + +SecretEncryptionKeyStatus + + +		 +(Optional) +

activeKey is the encryption key specification that all etcd data is confirmed encrypted with. +Updated after successful re-encryption.

+
+targetKey,omitzero
+ + +SecretEncryptionKeyStatus + + +		 +(Optional) +

targetKey is the key being rolled out during an active rotation. Snapshot from +spec.secretEncryption’s active key when the rotation starts. The CPO uses this +(not the current spec) during the rotation, so mid-rotation spec changes are +safely queued until the current rotation completes. Cleared when rotation completes.

+
+history
+ + +[]EncryptionMigrationHistory + + +		 +(Optional) +

history contains a list of key rotations applied to this cluster. The newest +entry is first in the list. Entries have state Completed when re-encryption +has finished. The current rotation phase is always history[0].state when +history[0] is not Completed or Interrupted.

+
###SecretEncryptionType { #hypershift.openshift.io/v1beta1.SecretEncryptionType }

(Appears on: From 5f0a579df235d9c34fa771d24c7a4b5c1011f8fb Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Thu, 21 May 2026 14:24:04 +0200 Subject: [PATCH 07/12] chore(api): sync vendored API types after rebase Signed-off-by: Mulham Raee Commit-Message-Assisted-by: Claude (via Claude Code) --- .../hypershift/v1beta1/hosted_controlplane.go | 4 + .../v1beta1/hostedcluster_conditions.go | 14 + .../hypershift/v1beta1/hostedcluster_types.go | 145 ++++++++++ .../api/hypershift/v1beta1/ibmcloud.go | 35 +++ .../v1beta1/zz_generated.deepcopy.go | 143 ++++++++++ .../controllers/migrators/errors.go | 47 ++++ .../controllers/migrators/inprocess.go | 198 ++++++++++++++ .../migrators/inprocess_processor.go | 185 +++++++++++++ .../migrators/kubestorageversionmigrator.go | 120 +++++++++ .../controllers/migrators/metrics.go | 93 +++++++ .../encryption/controllers/migrators/types.go | 26 ++ vendor/modules.txt | 6 + .../pkg/clients/informer/factory.go | 251 ++++++++++++++++++ .../pkg/clients/informer/generic.go | 64 +++++ .../internalinterfaces/factory_interfaces.go | 40 +++ .../clients/informer/migration/interface.go | 46 ++++ .../informer/migration/v1alpha1/interface.go | 52 ++++ .../migration/v1alpha1/storagestate.go | 89 +++++++ .../v1alpha1/storageversionmigration.go | 89 +++++++ .../migration/v1alpha1/expansion_generated.go | 27 ++ .../lister/migration/v1alpha1/storagestate.go | 68 +++++ .../v1alpha1/storageversionmigration.go | 68 +++++ 22 files changed, 1810 insertions(+) create mode 100644 vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/errors.go create mode 100644 vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/inprocess.go create mode 100644 vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/inprocess_processor.go create mode 100644 vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/kubestorageversionmigrator.go create mode 100644 vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/metrics.go create mode 100644 vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/types.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/factory.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/generic.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces/factory_interfaces.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/interface.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/interface.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/storagestate.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/storageversionmigration.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/expansion_generated.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/storagestate.go create mode 100644 vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/storageversionmigration.go diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hosted_controlplane.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hosted_controlplane.go index 8486514f0a18..05a2fa60d220 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hosted_controlplane.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hosted_controlplane.go @@ -419,6 +419,10 @@ type HostedControlPlaneStatus struct { // configuration contains the cluster configuration status of the HostedCluster // +optional Configuration *ConfigurationStatus `json:"configuration,omitempty"` + + // secretEncryption tracks the state of secret encryption key rotation and re-encryption. + // +optional + SecretEncryption SecretEncryptionStatus `json:"secretEncryption,omitzero"` } // APIEndpoint represents a reachable Kubernetes API endpoint. diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_conditions.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_conditions.go index 9fda11a60a2c..374e52a4fefc 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_conditions.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_conditions.go @@ -265,6 +265,12 @@ const ( PublicEndpointSharedIngressConfiguredReason = "SharedIngressConfigured" PublicEndpointTopologyPrivateReason = "TopologyPrivate" PublicEndpointConvergenceInProgressReason = "ConvergenceInProgress" + // EtcdDataEncryptionUpToDate indicates whether all etcd data is encrypted with the + // currently active encryption key. + // True: all data confirmed encrypted with the active key. + // False: re-encryption is in progress or has failed. + // Absent: encryption is not configured. + EtcdDataEncryptionUpToDate ConditionType = "EtcdDataEncryptionUpToDate" ) // Reasons. @@ -349,6 +355,14 @@ const ( AutoNodeNotConfiguredReason = "AutoNodeNotConfigured" AutoNodeProgressingReason = "AutoNodeProgressing" AutoNodeEvaluationFailedReason = "AutoNodeEvaluationFailed" + + ReadOnlyRolloutInProgressReason = "ReadOnlyRolloutInProgress" + WritePromotionInProgressReason = "WritePromotionInProgress" + ReEncryptionInProgressReason = "ReEncryptionInProgress" + ReEncryptionCompletedReason = "ReEncryptionCompleted" + ReEncryptionFailedReason = "ReEncryptionFailed" + ReEncryptionWaitingForKASReason = "ReEncryptionWaitingForKASConvergence" + ReEncryptionPersistentFailureReason = "ReEncryptionPersistentFailure" ) // Messages. diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go index 74b50f24ad38..98b7c1e9ba9d 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go @@ -2073,10 +2073,151 @@ type AESCBCSpec struct { ActiveKey corev1.LocalObjectReference `json:"activeKey"` // backupKey defines the old key during the rotation process so previously created // secrets can continue to be decrypted until they are all re-encrypted with the active key. + // + // Deprecated: This field will be ignored when status.secretEncryption.activeKey is set. + // The system automatically manages the previous key via the status field. // +optional BackupKey *corev1.LocalObjectReference `json:"backupKey,omitempty"` } +// SecretEncryptionProvider identifies the encryption provider recorded in status. +// This is a separate type from KMSProvider because the KMSProvider enum does not include AESCBC. +type SecretEncryptionProvider string + +const ( + SecretEncryptionProviderAzure SecretEncryptionProvider = "Azure" + SecretEncryptionProviderAWS SecretEncryptionProvider = "AWS" + SecretEncryptionProviderIBMCloud SecretEncryptionProvider = "IBMCloud" + SecretEncryptionProviderAESCBC SecretEncryptionProvider = "AESCBC" +) + +// SecretEncryptionStatus tracks the state of secret encryption key rotation and re-encryption. +// +k8s:deepcopy-gen=true +// +kubebuilder:validation:MinProperties=1 +type SecretEncryptionStatus struct { + // activeKey is the encryption key specification that all etcd data is confirmed encrypted with. + // Updated after successful re-encryption. + // +optional + ActiveKey SecretEncryptionKeyStatus `json:"activeKey,omitzero"` + // targetKey is the key being rolled out during an active rotation. Snapshot from + // spec.secretEncryption's active key when the rotation starts. The CPO uses this + // (not the current spec) during the rotation, so mid-rotation spec changes are + // safely queued until the current rotation completes. Cleared when rotation completes. + // +optional + TargetKey SecretEncryptionKeyStatus `json:"targetKey,omitzero"` + // history contains a list of key rotations applied to this cluster. The newest + // entry is first in the list. Entries have state Completed when re-encryption + // has finished. The current rotation phase is always history[0].state when + // history[0] is not Completed or Interrupted. + // +optional + // +listType=atomic + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=5 + History []EncryptionMigrationHistory `json:"history,omitempty"` +} + +// SecretEncryptionKeyStatus records the active key identity. Status-specific types are used +// instead of reusing the spec types directly, to decouple status serialization from spec type evolution. +// +k8s:deepcopy-gen=true +// +kubebuilder:validation:XValidation:rule="self.provider == 'Azure' ? has(self.azure) : !has(self.azure)",message="azure is required when provider is Azure, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="self.provider == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws is required when provider is AWS, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="self.provider == 'IBMCloud' ? has(self.ibmCloud) : !has(self.ibmCloud)",message="ibmCloud is required when provider is IBMCloud, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="self.provider == 'AESCBC' ? has(self.aescbc) : !has(self.aescbc)",message="aescbc is required when provider is AESCBC, and forbidden otherwise" +// +union +type SecretEncryptionKeyStatus struct { + // provider identifies the encryption provider. + // +required + // +unionDiscriminator + // +kubebuilder:validation:Enum=Azure;AWS;IBMCloud;AESCBC + Provider SecretEncryptionProvider `json:"provider,omitempty"` + // azure holds the Azure KMS key identity fields. + // +optional + // +unionMember + Azure AzureKMSKeyStatus `json:"azure,omitzero"` + // aws holds the AWS KMS key identity fields. + // +optional + // +unionMember + AWS AWSKMSKeyStatus `json:"aws,omitzero"` + // ibmCloud holds the IBM Cloud KMS key identity fields. + // +optional + // +unionMember + IBMCloud IBMCloudKMSKeyStatus `json:"ibmCloud,omitzero"` + // aescbc holds a reference to the AESCBC key secret. + // +optional + // +unionMember + AESCBC AESCBCKeyStatus `json:"aescbc,omitzero"` +} + +// AESCBCKeyStatus contains a reference to the AESCBC key secret and a SHA-256 hash +// of its contents for fingerprinting. +// +k8s:deepcopy-gen=true +type AESCBCKeyStatus struct { + // secret is a reference to the secret containing the AESCBC key. + // +required + Secret corev1.LocalObjectReference `json:"secret,omitempty"` + // dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field + // at the time re-encryption completed. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=64 + DataHash string `json:"dataHash,omitempty"` +} + +// EncryptionKeyReference identifies an encryption key by its provider and fingerprint. +// +k8s:deepcopy-gen=true +type EncryptionKeyReference struct { + // provider identifies the encryption provider. + // +required + // +kubebuilder:validation:Enum=Azure;AWS;IBMCloud;AESCBC + Provider SecretEncryptionProvider `json:"provider,omitempty"` + // fingerprint is the hex-encoded SHA-256 hash of the key's identity fields. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=64 + Fingerprint string `json:"fingerprint,omitempty"` +} + +// EncryptionMigrationState tracks the lifecycle of a key rotation. +// +kubebuilder:validation:Enum=ReadOnlyDeploy;WritePromote;Migrating;Completed;Interrupted +type EncryptionMigrationState string + +const ( + // EncryptionMigrationStateReadOnlyDeploy means the new key is being deployed as a read-only + // provider. The old key remains the write provider. + EncryptionMigrationStateReadOnlyDeploy EncryptionMigrationState = "ReadOnlyDeploy" + // EncryptionMigrationStateWritePromote means the new key is being promoted to write provider. + // The old key becomes read-only. + EncryptionMigrationStateWritePromote EncryptionMigrationState = "WritePromote" + // EncryptionMigrationStateMigrating means all KAS replicas have converged on the new write + // provider and re-encryption (StorageVersionMigration) is in progress. + EncryptionMigrationStateMigrating EncryptionMigrationState = "Migrating" + // EncryptionMigrationStateCompleted means all data was successfully re-encrypted with the target key. + EncryptionMigrationStateCompleted EncryptionMigrationState = "Completed" + // EncryptionMigrationStateInterrupted means the rotation was abandoned before data was encrypted + // with the target key (e.g., targetKey replaced during ReadOnlyDeploy). + EncryptionMigrationStateInterrupted EncryptionMigrationState = "Interrupted" +) + +// EncryptionMigrationHistory records a key rotation, including in-progress rotations. +// +k8s:deepcopy-gen=true +type EncryptionMigrationHistory struct { + // from is the key that data was migrated from (the previous active key). + // +required + From EncryptionKeyReference `json:"from,omitzero"` + // to is the key that data was migrated to (the target key). + // +required + To EncryptionKeyReference `json:"to,omitzero"` + // state tracks the current phase of this rotation. + // +required + State EncryptionMigrationState `json:"state,omitempty"` + // startedTime is when the rotation was initiated. + // +required + StartedTime metav1.Time `json:"startedTime,omitempty"` + // completionTime is when the rotation finished. Not set while the rotation is in progress. + // +optional + CompletionTime *metav1.Time `json:"completionTime,omitempty"` +} + type PayloadArchType string const ( @@ -2190,6 +2331,10 @@ type HostedClusterStatus struct { // +kubebuilder:validation:MaxLength=2048 // +kubebuilder:validation:XValidation:rule="self.matches('^(https|s3)://.*')",message="lastSuccessfulEtcdBackupURL must be a valid URL with scheme https or s3" LastSuccessfulEtcdBackupURL string `json:"lastSuccessfulEtcdBackupURL,omitempty"` + + // secretEncryption tracks the state of secret encryption key rotation and re-encryption. + // +optional + SecretEncryption SecretEncryptionStatus `json:"secretEncryption,omitzero"` } // AutoNodeStatus contains the observed state of the AutoNode provisioner. diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go index 0f824883e300..bad0e9c3c1c0 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go @@ -44,6 +44,41 @@ type IBMCloudKMSKeyEntry struct { KeyVersion int `json:"keyVersion"` } +// IBMCloudKMSKeyStatus contains identity fields for an IBM Cloud KMS key list entry, +// sufficient to reconstruct the KP_DATA_JSON entry for the backup key. +// +k8s:deepcopy-gen=true +type IBMCloudKMSKeyStatus struct { + // crkID is the Customer Root Key ID. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + CRKID string `json:"crkID,omitempty"` + // instanceID is the KMS instance ID. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + InstanceID string `json:"instanceID,omitempty"` + // keyVersion is the key version number. + // +required + // +kubebuilder:validation:Minimum=0 + KeyVersion int32 `json:"keyVersion,omitempty"` + // region is the IBM Cloud region. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + Region string `json:"region,omitempty"` + // correlationID is the correlation ID for the key. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + CorrelationID string `json:"correlationID,omitempty"` + // url is the KMS endpoint URL. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + URL string `json:"url,omitempty"` +} + // IBMCloudKMSAuthSpec defines metadata for how authentication is done with IBM Cloud KMS type IBMCloudKMSAuthSpec struct { // type defines the IBM Cloud KMS authentication strategy diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go index 454f86378499..33601892dd28 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -29,6 +29,22 @@ import ( "k8s.io/apimachinery/pkg/util/intstr" ) +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AESCBCKeyStatus) DeepCopyInto(out *AESCBCKeyStatus) { + *out = *in + out.Secret = in.Secret +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AESCBCKeyStatus. +func (in *AESCBCKeyStatus) DeepCopy() *AESCBCKeyStatus { + if in == nil { + return nil + } + out := new(AESCBCKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AESCBCSpec) DeepCopyInto(out *AESCBCSpec) { *out = *in @@ -256,6 +272,21 @@ func (in *AWSKMSKeyEntry) DeepCopy() *AWSKMSKeyEntry { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AWSKMSKeyStatus) DeepCopyInto(out *AWSKMSKeyStatus) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSKMSKeyStatus. +func (in *AWSKMSKeyStatus) DeepCopy() *AWSKMSKeyStatus { + if in == nil { + return nil + } + out := new(AWSKMSKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AWSKMSSpec) DeepCopyInto(out *AWSKMSSpec) { *out = *in @@ -641,6 +672,21 @@ func (in *AzureKMSKey) DeepCopy() *AzureKMSKey { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AzureKMSKeyStatus) DeepCopyInto(out *AzureKMSKeyStatus) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AzureKMSKeyStatus. +func (in *AzureKMSKeyStatus) DeepCopy() *AzureKMSKeyStatus { + if in == nil { + return nil + } + out := new(AzureKMSKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AzureKMSSpec) DeepCopyInto(out *AzureKMSSpec) { *out = *in @@ -1615,6 +1661,43 @@ func (in *Diagnostics) DeepCopy() *Diagnostics { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *EncryptionKeyReference) DeepCopyInto(out *EncryptionKeyReference) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionKeyReference. +func (in *EncryptionKeyReference) DeepCopy() *EncryptionKeyReference { + if in == nil { + return nil + } + out := new(EncryptionKeyReference) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *EncryptionMigrationHistory) DeepCopyInto(out *EncryptionMigrationHistory) { + *out = *in + out.From = in.From + out.To = in.To + in.StartedTime.DeepCopyInto(&out.StartedTime) + if in.CompletionTime != nil { + in, out := &in.CompletionTime, &out.CompletionTime + *out = (*in).DeepCopy() + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionMigrationHistory. +func (in *EncryptionMigrationHistory) DeepCopy() *EncryptionMigrationHistory { + if in == nil { + return nil + } + out := new(EncryptionMigrationHistory) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *EtcdSpec) DeepCopyInto(out *EtcdSpec) { *out = *in @@ -2461,6 +2544,7 @@ func (in *HostedClusterStatus) DeepCopyInto(out *HostedClusterStatus) { *out = new(ConfigurationStatus) (*in).DeepCopyInto(*out) } + in.SecretEncryption.DeepCopyInto(&out.SecretEncryption) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostedClusterStatus. @@ -2697,6 +2781,7 @@ func (in *HostedControlPlaneStatus) DeepCopyInto(out *HostedControlPlaneStatus) *out = new(ConfigurationStatus) (*in).DeepCopyInto(*out) } + in.SecretEncryption.DeepCopyInto(&out.SecretEncryption) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostedControlPlaneStatus. @@ -2749,6 +2834,21 @@ func (in *IBMCloudKMSKeyEntry) DeepCopy() *IBMCloudKMSKeyEntry { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IBMCloudKMSKeyStatus) DeepCopyInto(out *IBMCloudKMSKeyStatus) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IBMCloudKMSKeyStatus. +func (in *IBMCloudKMSKeyStatus) DeepCopy() *IBMCloudKMSKeyStatus { + if in == nil { + return nil + } + out := new(IBMCloudKMSKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *IBMCloudKMSManagedAuthSpec) DeepCopyInto(out *IBMCloudKMSManagedAuthSpec) { *out = *in @@ -4423,6 +4523,25 @@ func (in *ScaleDownConfig) DeepCopy() *ScaleDownConfig { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SecretEncryptionKeyStatus) DeepCopyInto(out *SecretEncryptionKeyStatus) { + *out = *in + out.Azure = in.Azure + out.AWS = in.AWS + out.IBMCloud = in.IBMCloud + out.AESCBC = in.AESCBC +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretEncryptionKeyStatus. +func (in *SecretEncryptionKeyStatus) DeepCopy() *SecretEncryptionKeyStatus { + if in == nil { + return nil + } + out := new(SecretEncryptionKeyStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretEncryptionSpec) DeepCopyInto(out *SecretEncryptionSpec) { *out = *in @@ -4448,6 +4567,30 @@ func (in *SecretEncryptionSpec) DeepCopy() *SecretEncryptionSpec { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SecretEncryptionStatus) DeepCopyInto(out *SecretEncryptionStatus) { + *out = *in + out.ActiveKey = in.ActiveKey + out.TargetKey = in.TargetKey + if in.History != nil { + in, out := &in.History, &out.History + *out = make([]EncryptionMigrationHistory, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretEncryptionStatus. +func (in *SecretEncryptionStatus) DeepCopy() *SecretEncryptionStatus { + if in == nil { + return nil + } + out := new(SecretEncryptionStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretReference) DeepCopyInto(out *SecretReference) { *out = *in diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/errors.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/errors.go new file mode 100644 index 000000000000..6b153a91bf7d --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/errors.go @@ -0,0 +1,47 @@ +/* +Copyright 2018 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package migrators + +import ( + "strings" + + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/util/net" + "k8s.io/utils/ptr" +) + +// isConnectionRefusedError checks if the error string include "connection refused" +// TODO: find a "go-way" to detect this error, probably using *os.SyscallError +func isConnectionRefusedError(err error) bool { + return strings.Contains(err.Error(), "connection refused") +} + +// canRetry returns false if the provided error indicates a retry is +// impossible. It returns true if the error is possibly temporary. It returns +// nil for all other error where it is unclear. +func canRetry(err error) *bool { + switch { + case err == nil: + return nil + case errors.IsNotFound(err), errors.IsMethodNotSupported(err): + return ptr.To(false) + case errors.IsConflict(err), errors.IsServerTimeout(err), errors.IsTooManyRequests(err), net.IsProbableEOF(err), net.IsConnectionReset(err), net.IsNoRoutesError(err), isConnectionRefusedError(err): + return ptr.To(true) + default: + return nil + } +} diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/inprocess.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/inprocess.go new file mode 100644 index 000000000000..2a9c1e6022dc --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/inprocess.go @@ -0,0 +1,198 @@ +package migrators + +import ( + "context" + "fmt" + "sync" + "time" + + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/runtime/schema" + "k8s.io/client-go/discovery" + "k8s.io/client-go/dynamic" + "k8s.io/client-go/tools/cache" + "k8s.io/klog/v2" +) + +func NewInProcessMigrator(dynamicClient dynamic.Interface, discoveryClient discovery.ServerResourcesInterface) *InProcessMigrator { + return &InProcessMigrator{ + dynamicClient: dynamicClient, + discoveryClient: discoveryClient, + running: map[schema.GroupResource]*inProcessMigration{}, + } +} + +// InProcessMigrator runs migration in-process using paging. +type InProcessMigrator struct { + dynamicClient dynamic.Interface + discoveryClient discovery.ServerResourcesInterface + + lock sync.Mutex + running map[schema.GroupResource]*inProcessMigration + + handler cache.ResourceEventHandler +} + +func (m *InProcessMigrator) HasSynced() bool { + return true +} + +type inProcessMigration struct { + stopCh chan<- struct{} + doneCh <-chan struct{} + writeKey string + + // non-nil when finished. *result==nil means "no error" + result *error + // when did it finish + timestamp time.Time +} + +var _ Migrator = &InProcessMigrator{} + +func (m *InProcessMigrator) EnsureMigration(gr schema.GroupResource, writeKey string) (finished bool, result error, ts time.Time, err error) { + m.lock.Lock() + defer m.lock.Unlock() + + // finished? + migration := m.running[gr] + if migration != nil && migration.writeKey == writeKey { + if migration.result == nil { + return false, nil, time.Time{}, nil + } + return true, *migration.result, migration.timestamp, nil + } + + // different key? + if migration != nil && migration.result == nil { + klog.V(2).Infof("Interrupting running migration for resource %v and write key %q", gr, migration.writeKey) + close(migration.stopCh) + + // give go routine time to update the result + m.lock.Unlock() + <-migration.doneCh + m.lock.Lock() + } + + v, err := preferredResourceVersion(m.discoveryClient, gr) + if err != nil { + return false, nil, time.Time{}, err + } + + stopCh := make(chan struct{}) + doneCh := make(chan struct{}) + m.running[gr] = &inProcessMigration{ + stopCh: stopCh, + doneCh: doneCh, + writeKey: writeKey, + } + + go m.runMigration(gr.WithVersion(v), writeKey, stopCh, doneCh) + + return false, nil, time.Time{}, nil +} + +func (m *InProcessMigrator) runMigration(gvr schema.GroupVersionResource, writeKey string, stopCh <-chan struct{}, doneCh chan<- struct{}) { + var result error + + defer close(doneCh) + defer func() { + if r := recover(); r != nil { + if err, ok := r.(error); ok { + result = err + } else { + result = fmt.Errorf("panic: %v", r) + } + } + + m.lock.Lock() + defer m.lock.Unlock() + migration := m.running[gvr.GroupResource()] + if migration == nil || migration.writeKey != writeKey { + // ok, this is not us. Should never happen. + return + } + + migration.result = &result + migration.timestamp = time.Now() + + m.handler.OnAdd(&corev1.Secret{}, false) // fake secret to trigger event loop of controller + }() + + ctx, cancelFn := context.WithCancel(context.Background()) + defer cancelFn() + go func() { + <-stopCh + cancelFn() + }() + + d := m.dynamicClient.Resource(gvr) + + listProcessor := newListProcessor(ctx, m.dynamicClient, func(obj *unstructured.Unstructured) error { + for { + _, updateErr := d.Namespace(obj.GetNamespace()).Update(ctx, obj, metav1.UpdateOptions{}) + if updateErr == nil || errors.IsNotFound(updateErr) || errors.IsConflict(updateErr) { + return nil + } + if retryable := canRetry(updateErr); retryable == nil || *retryable == false { + klog.Warningf("Update of %s/%s failed: %v", obj.GetNamespace(), obj.GetName(), updateErr) + return updateErr // not retryable or we don't know. Return error and controller will restart migration. + } + if seconds, delay := errors.SuggestsClientDelay(updateErr); delay && seconds > 0 { + klog.V(2).Infof("Sleeping %ds while updating %s/%s of type %v after retryable error: %v", seconds, obj.GetNamespace(), obj.GetName(), gvr, updateErr) + time.Sleep(time.Duration(seconds) * time.Second) + } + } + }) + result = listProcessor.run(ctx, gvr) +} + +func (m *InProcessMigrator) PruneMigration(gr schema.GroupResource) error { + m.lock.Lock() + defer m.lock.Unlock() + + migration := m.running[gr] + delete(m.running, gr) + + // finished? + if migration != nil && migration.result == nil { + close(migration.stopCh) + + // give go routine time to update the result + m.lock.Unlock() + <-migration.doneCh + m.lock.Lock() + } + + return nil +} + +func (m *InProcessMigrator) AddEventHandler(handler cache.ResourceEventHandler) (cache.ResourceEventHandlerRegistration, error) { + m.handler = handler + return nil, nil +} + +func preferredResourceVersion(c discovery.ServerResourcesInterface, gr schema.GroupResource) (string, error) { + resourceLists, discoveryErr := c.ServerPreferredResources() // safe to ignore error + for _, resourceList := range resourceLists { + groupVersion, err := schema.ParseGroupVersion(resourceList.GroupVersion) + if err != nil { + return "", err + } + if groupVersion.Group != gr.Group { + continue + } + for _, resource := range resourceList.APIResources { + if (len(resource.Group) == 0 || resource.Group == gr.Group) && resource.Name == gr.Resource { + if len(resource.Version) > 0 { + return resource.Version, nil + } + return groupVersion.Version, nil + } + } + } + return "", fmt.Errorf("failed to find version for %s, discoveryErr=%v", gr, discoveryErr) +} diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/inprocess_processor.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/inprocess_processor.go new file mode 100644 index 000000000000..8cff939bbc2a --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/inprocess_processor.go @@ -0,0 +1,185 @@ +package migrators + +import ( + "context" + "fmt" + "reflect" + "sync" + "time" + + "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" + utilerrors "k8s.io/apimachinery/pkg/util/errors" + utilruntime "k8s.io/apimachinery/pkg/util/runtime" + "k8s.io/client-go/dynamic" + "k8s.io/client-go/tools/pager" + "k8s.io/klog/v2" +) + +const ( + defaultConcurrency = 10 +) + +// workerFunc function that is executed by workers to process a single item +type workerFunc func(*unstructured.Unstructured) error + +// listProcessor represents a type that processes resources in parallel. +// It retrieves resources from the server in batches and distributes among set of workers. +type listProcessor struct { + concurrency int + workerFn workerFunc + dynamicClient dynamic.Interface + ctx context.Context +} + +// newListProcessor creates a new instance of listProcessor +func newListProcessor(ctx context.Context, dynamicClient dynamic.Interface, workerFn workerFunc) *listProcessor { + return &listProcessor{ + concurrency: defaultConcurrency, + workerFn: workerFn, + dynamicClient: dynamicClient, + ctx: ctx, + } +} + +// run starts processing all the instance of the given GVR in batches. +// Note that this operation block until all resources have been process, we can't get the next page or the context has been cancelled +func (p *listProcessor) run(ctx context.Context, gvr schema.GroupVersionResource) error { + listPager := pager.New(pager.SimplePageFunc(func(opts metav1.ListOptions) (runtime.Object, error) { + for { + allResource, err := p.dynamicClient.Resource(gvr).List(ctx, opts) + if err != nil { + klog.Warningf("List of %v failed: %v", gvr, err) + if errors.IsResourceExpired(err) { + token, err := inconsistentContinueToken(err) + if err != nil { + return nil, err + } + opts.Continue = token + klog.V(2).Infof("Relisting %v after handling expired token", gvr) + continue + } else if retryable := canRetry(err); retryable == nil || *retryable == false { + return nil, err // not retryable or we don't know. Return error and controller will restart migration. + } else { + if seconds, delay := errors.SuggestsClientDelay(err); delay { + time.Sleep(time.Duration(seconds) * time.Second) + } + klog.V(2).Infof("Relisting %v after retryable error: %v", gvr, err) + continue + } + } + + migrationStarted := time.Now() + klog.V(2).Infof("Migrating %d objects of %v", len(allResource.Items), gvr) + if err = p.processList(allResource, gvr); err != nil { + klog.Warningf("Migration of %v failed after %v: %v", gvr, time.Now().Sub(migrationStarted), err) + return nil, err + } + klog.V(2).Infof("Migration of %d objects of %v finished in %v", len(allResource.Items), gvr, time.Now().Sub(migrationStarted)) + + allResource.Items = nil // do not accumulate items, this fakes the visitor pattern + return allResource, nil // leave the rest of the list intact to preserve continue token + } + })) + listPager.FullListIfExpired = false // prevent memory explosion from full list + + migrationStarted := time.Now() + if _, _, err := listPager.List(p.ctx, metav1.ListOptions{}); err != nil { + metrics.ObserveFailedMigration(gvr.String()) + return err + } + migrationDuration := time.Now().Sub(migrationStarted) + klog.V(2).Infof("Migration for %v finished in %v", gvr, migrationDuration) + metrics.ObserveSucceededMigration(gvr.String()) + metrics.ObserveSucceededMigrationDuration(migrationDuration.Seconds(), gvr.String()) + return nil +} + +func (p *listProcessor) processList(l *unstructured.UnstructuredList, gvr schema.GroupVersionResource) error { + workCh := make(chan *unstructured.Unstructured, p.concurrency) + ctx, cancel := context.WithCancel(p.ctx) + defer cancel() + + processed := 0 + go func() { + defer utilruntime.HandleCrash() + defer close(workCh) + for i := range l.Items { + select { + case workCh <- &l.Items[i]: + processed++ + case <-ctx.Done(): + return + } + } + }() + + var wg sync.WaitGroup + errCh := make(chan error, p.concurrency) + for i := 0; i < p.concurrency; i++ { + wg.Add(1) + go func() { + defer wg.Done() + if err := p.worker(workCh, gvr); err != nil { + errCh <- err + cancel() // stop everything when the first worker errors + } + }() + } + wg.Wait() + close(errCh) + + var errs []error + for err := range errCh { + errs = append(errs, err) + } + if len(errs) > 0 { + return utilerrors.NewAggregate(errs) + } + if processed < len(l.Items) { + return fmt.Errorf("context cancelled") + } + return nil +} + +func (p *listProcessor) worker(workCh <-chan *unstructured.Unstructured, gvr schema.GroupVersionResource) (result error) { + defer func() { + if r := recover(); r != nil { + if err, ok := r.(error); ok { + result = err + } else { + result = fmt.Errorf("panic: %v", r) + } + } + }() + + for item := range workCh { + err := p.workerFn(item) + metrics.ObserveObjectsMigrated(1, gvr.String()) + if err != nil { + return err + } + } + + return nil +} + +// inconsistentContinueToken extracts the continue token from the response which might be used to retrieve the remainder of the results +// +// Note: +// continuing with the provided token might result in an inconsistent list. Objects that were created, +// modified, or deleted between the time the first chunk was returned and now may show up in the list. +func inconsistentContinueToken(err error) (string, error) { + status, ok := err.(errors.APIStatus) + if !ok { + return "", fmt.Errorf("expected error to implement the APIStatus interface, got %v", reflect.TypeOf(err)) + } + token := status.Status().ListMeta.Continue + if len(token) == 0 { + return "", fmt.Errorf("expected non empty continue token") + } + return token, nil +} diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/kubestorageversionmigrator.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/kubestorageversionmigrator.go new file mode 100644 index 000000000000..e270eef7446a --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/kubestorageversionmigrator.go @@ -0,0 +1,120 @@ +package migrators + +import ( + "context" + "fmt" + "time" + + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime/schema" + "k8s.io/client-go/discovery" + "k8s.io/client-go/tools/cache" + migrationv1alpha1 "sigs.k8s.io/kube-storage-version-migrator/pkg/apis/migration/v1alpha1" + kubemigratorclient "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset" + migrationv1alpha1informer "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1" +) + +const writeKeyAnnotationKey = "encryption.apiserver.operator.openshift.io/write-key" + +func NewKubeStorageVersionMigrator(client kubemigratorclient.Interface, informer migrationv1alpha1informer.Interface, discoveryClient discovery.ServerResourcesInterface) *KubeStorageVersionMigrator { + return &KubeStorageVersionMigrator{ + discoveryClient: discoveryClient, + client: client, + informer: informer, + } +} + +// KubeStorageVersionMigrator runs migration through the kube-storage-version-migrator components, +// driven by CustomResources. +type KubeStorageVersionMigrator struct { + discoveryClient discovery.ServerResourcesInterface + client kubemigratorclient.Interface + informer migrationv1alpha1informer.Interface + cacheSynced func() bool +} + +func (m *KubeStorageVersionMigrator) AddEventHandler(handler cache.ResourceEventHandler) (cache.ResourceEventHandlerRegistration, error) { + informer := m.informer.StorageVersionMigrations().Informer() + registration, err := informer.AddEventHandler(handler) + if err != nil { + return nil, err + } + m.cacheSynced = informer.HasSynced + return registration, nil +} + +func (m *KubeStorageVersionMigrator) HasSynced() bool { + return m.cacheSynced() +} + +func (m *KubeStorageVersionMigrator) EnsureMigration(gr schema.GroupResource, writeKey string) (finished bool, result error, ts time.Time, err error) { + name := migrationResourceName(gr) + if migration, err := m.informer.StorageVersionMigrations().Lister().Get(name); err != nil && !errors.IsNotFound(err) { + return false, nil, time.Time{}, err + } else if err == nil && migration.Annotations[writeKeyAnnotationKey] == writeKey { + for _, c := range migration.Status.Conditions { + switch c.Type { + case migrationv1alpha1.MigrationSucceeded: + if c.Status == corev1.ConditionTrue { + return true, nil, c.LastUpdateTime.Time, nil + } + case migrationv1alpha1.MigrationFailed: + if c.Status == corev1.ConditionTrue { + return true, fmt.Errorf("migration of %s for key %q failed: %s", gr, writeKey, c.Message), c.LastUpdateTime.Time, nil + } + } + } + return false, nil, time.Time{}, nil + } else if err == nil { + if err := m.client.MigrationV1alpha1().StorageVersionMigrations().Delete(context.TODO(), name, metav1.DeleteOptions{ + Preconditions: &metav1.Preconditions{ResourceVersion: &migration.ResourceVersion}, + }); err != nil && !errors.IsNotFound(err) { + return false, nil, time.Time{}, err + } + } + + v, err := preferredResourceVersion(m.discoveryClient, gr) + if err != nil { + return false, nil, time.Time{}, err + } + + _, err = m.client.MigrationV1alpha1().StorageVersionMigrations().Create(context.TODO(), &migrationv1alpha1.StorageVersionMigration{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Annotations: map[string]string{ + writeKeyAnnotationKey: writeKey, + }, + }, + Spec: migrationv1alpha1.StorageVersionMigrationSpec{ + Resource: migrationv1alpha1.GroupVersionResource{ + Group: gr.Group, + Version: v, + Resource: gr.Resource, + }, + }, + }, metav1.CreateOptions{}) + + return false, nil, time.Time{}, err +} + +func (m *KubeStorageVersionMigrator) PruneMigration(gr schema.GroupResource) error { + name := migrationResourceName(gr) + if err := m.client.MigrationV1alpha1().StorageVersionMigrations().Delete(context.TODO(), name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) { + return err + } + return nil +} + +func migrationResourceName(gr schema.GroupResource) string { + return fmt.Sprintf("encryption-migration-%s-%s", groupToHumanReadable(gr), gr.Resource) +} + +func groupToHumanReadable(gr schema.GroupResource) string { + group := gr.Group + if len(group) == 0 { + group = "core" + } + return group +} diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/metrics.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/metrics.go new file mode 100644 index 000000000000..54a2e8d1c1bb --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/metrics.go @@ -0,0 +1,93 @@ +package migrators + +import ( + "github.com/prometheus/client_golang/prometheus" + + k8smetrics "k8s.io/component-base/metrics" + "k8s.io/component-base/metrics/legacyregistry" +) + +const ( + namespace = "storage_migrator" + subsystem = "core_migrator" +) + +// metrics provides access to all core migrator metrics. +var metrics *migratorMetrics + +func init() { + metrics = newMigratorMetrics(legacyregistry.Register) +} + +// migratorMetrics instruments core migrator with prometheus metrics. +type migratorMetrics struct { + objectsMigrated *k8smetrics.CounterVec + migration *k8smetrics.CounterVec + migrationDuration *k8smetrics.HistogramVec +} + +// newMigratorMetrics create a new MigratorMetrics, configured with default metric names. +func newMigratorMetrics(registerFunc func(k8smetrics.Registerable) error) *migratorMetrics { + // objectMigrates is defined in kube-storave-version-migrator + objectsMigrated := k8smetrics.NewCounterVec( + &k8smetrics.CounterOpts{ + Namespace: namespace, + Subsystem: subsystem, + Name: "migrated_objects", + Help: "The total number of objects that have been migrated, labeled with the full resource name", + }, []string{"resource"}) + registerFunc(objectsMigrated) + + // migration is defined in kube-storave-version-migrator + migration := k8smetrics.NewCounterVec( + &k8smetrics.CounterOpts{ + Namespace: namespace, + Subsystem: subsystem, + Name: "migrations", + Help: "The total number of completed migration, labeled with the full resource name, and the status of the migration (failed or succeeded)", + }, []string{"resource", "status"}) + registerFunc(migration) + + // migrationDuration is not defined upstream but uses the same Namespace and Subsystem + // as the other metrics that are defined in kube-storave-version-migrator + migrationDuration := k8smetrics.NewHistogramVec( + &k8smetrics.HistogramOpts{ + Namespace: namespace, + Subsystem: subsystem, + Name: "migration_duration_seconds", + Help: "How long a successful migration takes in seconds, labeled with the full resource name", + Buckets: prometheus.ExponentialBuckets(120, 2, 7), + }, []string{"resource"}) + registerFunc(migrationDuration) + + return &migratorMetrics{ + objectsMigrated: objectsMigrated, + migration: migration, + migrationDuration: migrationDuration, + } +} + +func (m *migratorMetrics) Reset() { + m.objectsMigrated.Reset() + m.migration.Reset() +} + +// ObserveObjectsMigrated adds the number of migrated objects for a resource type +func (m *migratorMetrics) ObserveObjectsMigrated(added int, resource string) { + m.objectsMigrated.WithLabelValues(resource).Add(float64(added)) +} + +// ObserveSucceededMigration increments the number of successful migrations for a resource type +func (m *migratorMetrics) ObserveSucceededMigration(resource string) { + m.migration.WithLabelValues(resource, "Succeeded").Add(float64(1)) +} + +// ObserveFailedMigration increments the number of failed migrations for a resource type +func (m *migratorMetrics) ObserveFailedMigration(resource string) { + m.migration.WithLabelValues(resource, "Failed").Add(float64(1)) +} + +// ObserveMigrationDuration records migration duration in seconds for a resource type +func (m *migratorMetrics) ObserveSucceededMigrationDuration(seconds float64, resource string) { + m.migrationDuration.WithLabelValues(resource).Observe(seconds) +} diff --git a/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/types.go b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/types.go new file mode 100644 index 000000000000..3b6623ff0e63 --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators/types.go @@ -0,0 +1,26 @@ +package migrators + +import ( + "time" + + "k8s.io/apimachinery/pkg/runtime/schema" + + "github.com/openshift/library-go/pkg/controller/factory" +) + +// Migrator is a resource migration mechanism. +type Migrator interface { + // EnsureMigration starts a migration if it does not exist. If a migration of + // the same write-key exists and is finished (with or without error), nothing happens. + // If a migration of another key exists, that migration is deleted first before + // starting a new one. This function is idem-potent as long as a running or finished + // migration is not pruned. + // If finished is true, result is the result of the migration, with nil meaning that it + // finished successfully. The timestamp shows when it has been finished. + EnsureMigration(gr schema.GroupResource, writeKey string) (finished bool, result error, ts time.Time, err error) + // PruneMigration removes a migration, independently whether it is running or finished, + // with error or not. If there is no migration, this must not return an error. + PruneMigration(gr schema.GroupResource) error + + factory.Informer +} diff --git a/vendor/modules.txt b/vendor/modules.txt index 5c8b8c880d96..73730f9bbe30 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1161,6 +1161,7 @@ github.com/openshift/library-go/pkg/network github.com/openshift/library-go/pkg/operator/apiserver/audit github.com/openshift/library-go/pkg/operator/certrotation github.com/openshift/library-go/pkg/operator/condition +github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators github.com/openshift/library-go/pkg/operator/events github.com/openshift/library-go/pkg/operator/management github.com/openshift/library-go/pkg/operator/resource/resourceapply @@ -2703,6 +2704,11 @@ sigs.k8s.io/kube-storage-version-migrator/pkg/apis/migration/v1alpha1 sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset/scheme sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset/typed/migration/v1alpha1 +sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer +sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces +sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration +sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1 +sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1 # sigs.k8s.io/kustomize/api v0.21.0 ## explicit; go 1.24.0 sigs.k8s.io/kustomize/api/filters/annotations diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/factory.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/factory.go new file mode 100644 index 000000000000..6c8c2d69b283 --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/factory.go @@ -0,0 +1,251 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by informer-gen. DO NOT EDIT. + +package informer + +import ( + reflect "reflect" + sync "sync" + time "time" + + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + schema "k8s.io/apimachinery/pkg/runtime/schema" + cache "k8s.io/client-go/tools/cache" + clientset "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset" + internalinterfaces "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces" + migration "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration" +) + +// SharedInformerOption defines the functional option type for SharedInformerFactory. +type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory + +type sharedInformerFactory struct { + client clientset.Interface + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc + lock sync.Mutex + defaultResync time.Duration + customResync map[reflect.Type]time.Duration + + informers map[reflect.Type]cache.SharedIndexInformer + // startedInformers is used for tracking which informers have been started. + // This allows Start() to be called multiple times safely. + startedInformers map[reflect.Type]bool + // wg tracks how many goroutines were started. + wg sync.WaitGroup + // shuttingDown is true when Shutdown has been called. It may still be running + // because it needs to wait for goroutines. + shuttingDown bool +} + +// WithCustomResyncConfig sets a custom resync period for the specified informer types. +func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption { + return func(factory *sharedInformerFactory) *sharedInformerFactory { + for k, v := range resyncConfig { + factory.customResync[reflect.TypeOf(k)] = v + } + return factory + } +} + +// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory. +func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption { + return func(factory *sharedInformerFactory) *sharedInformerFactory { + factory.tweakListOptions = tweakListOptions + return factory + } +} + +// WithNamespace limits the SharedInformerFactory to the specified namespace. +func WithNamespace(namespace string) SharedInformerOption { + return func(factory *sharedInformerFactory) *sharedInformerFactory { + factory.namespace = namespace + return factory + } +} + +// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces. +func NewSharedInformerFactory(client clientset.Interface, defaultResync time.Duration) SharedInformerFactory { + return NewSharedInformerFactoryWithOptions(client, defaultResync) +} + +// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory. +// Listers obtained via this SharedInformerFactory will be subject to the same filters +// as specified here. +// Deprecated: Please use NewSharedInformerFactoryWithOptions instead +func NewFilteredSharedInformerFactory(client clientset.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory { + return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions)) +} + +// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options. +func NewSharedInformerFactoryWithOptions(client clientset.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory { + factory := &sharedInformerFactory{ + client: client, + namespace: v1.NamespaceAll, + defaultResync: defaultResync, + informers: make(map[reflect.Type]cache.SharedIndexInformer), + startedInformers: make(map[reflect.Type]bool), + customResync: make(map[reflect.Type]time.Duration), + } + + // Apply all options + for _, opt := range options { + factory = opt(factory) + } + + return factory +} + +func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) { + f.lock.Lock() + defer f.lock.Unlock() + + if f.shuttingDown { + return + } + + for informerType, informer := range f.informers { + if !f.startedInformers[informerType] { + f.wg.Add(1) + // We need a new variable in each loop iteration, + // otherwise the goroutine would use the loop variable + // and that keeps changing. + informer := informer + go func() { + defer f.wg.Done() + informer.Run(stopCh) + }() + f.startedInformers[informerType] = true + } + } +} + +func (f *sharedInformerFactory) Shutdown() { + f.lock.Lock() + f.shuttingDown = true + f.lock.Unlock() + + // Will return immediately if there is nothing to wait for. + f.wg.Wait() +} + +func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool { + informers := func() map[reflect.Type]cache.SharedIndexInformer { + f.lock.Lock() + defer f.lock.Unlock() + + informers := map[reflect.Type]cache.SharedIndexInformer{} + for informerType, informer := range f.informers { + if f.startedInformers[informerType] { + informers[informerType] = informer + } + } + return informers + }() + + res := map[reflect.Type]bool{} + for informType, informer := range informers { + res[informType] = cache.WaitForCacheSync(stopCh, informer.HasSynced) + } + return res +} + +// InternalInformerFor returns the SharedIndexInformer for obj using an internal +// client. +func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer { + f.lock.Lock() + defer f.lock.Unlock() + + informerType := reflect.TypeOf(obj) + informer, exists := f.informers[informerType] + if exists { + return informer + } + + resyncPeriod, exists := f.customResync[informerType] + if !exists { + resyncPeriod = f.defaultResync + } + + informer = newFunc(f.client, resyncPeriod) + f.informers[informerType] = informer + + return informer +} + +// SharedInformerFactory provides shared informers for resources in all known +// API group versions. +// +// It is typically used like this: +// +// ctx, cancel := context.Background() +// defer cancel() +// factory := NewSharedInformerFactory(client, resyncPeriod) +// defer factory.WaitForStop() // Returns immediately if nothing was started. +// genericInformer := factory.ForResource(resource) +// typedInformer := factory.SomeAPIGroup().V1().SomeType() +// factory.Start(ctx.Done()) // Start processing these informers. +// synced := factory.WaitForCacheSync(ctx.Done()) +// for v, ok := range synced { +// if !ok { +// fmt.Fprintf(os.Stderr, "caches failed to sync: %v", v) +// return +// } +// } +// +// // Creating informers can also be created after Start, but then +// // Start must be called again: +// anotherGenericInformer := factory.ForResource(resource) +// factory.Start(ctx.Done()) +type SharedInformerFactory interface { + internalinterfaces.SharedInformerFactory + + // Start initializes all requested informers. They are handled in goroutines + // which run until the stop channel gets closed. + Start(stopCh <-chan struct{}) + + // Shutdown marks a factory as shutting down. At that point no new + // informers can be started anymore and Start will return without + // doing anything. + // + // In addition, Shutdown blocks until all goroutines have terminated. For that + // to happen, the close channel(s) that they were started with must be closed, + // either before Shutdown gets called or while it is waiting. + // + // Shutdown may be called multiple times, even concurrently. All such calls will + // block until all goroutines have terminated. + Shutdown() + + // WaitForCacheSync blocks until all started informers' caches were synced + // or the stop channel gets closed. + WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool + + // ForResource gives generic access to a shared informer of the matching type. + ForResource(resource schema.GroupVersionResource) (GenericInformer, error) + + // InternalInformerFor returns the SharedIndexInformer for obj using an internal + // client. + InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer + + Migration() migration.Interface +} + +func (f *sharedInformerFactory) Migration() migration.Interface { + return migration.New(f, f.namespace, f.tweakListOptions) +} diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/generic.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/generic.go new file mode 100644 index 000000000000..6d572e6df198 --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/generic.go @@ -0,0 +1,64 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by informer-gen. DO NOT EDIT. + +package informer + +import ( + "fmt" + + schema "k8s.io/apimachinery/pkg/runtime/schema" + cache "k8s.io/client-go/tools/cache" + v1alpha1 "sigs.k8s.io/kube-storage-version-migrator/pkg/apis/migration/v1alpha1" +) + +// GenericInformer is type of SharedIndexInformer which will locate and delegate to other +// sharedInformers based on type +type GenericInformer interface { + Informer() cache.SharedIndexInformer + Lister() cache.GenericLister +} + +type genericInformer struct { + informer cache.SharedIndexInformer + resource schema.GroupResource +} + +// Informer returns the SharedIndexInformer. +func (f *genericInformer) Informer() cache.SharedIndexInformer { + return f.informer +} + +// Lister returns the GenericLister. +func (f *genericInformer) Lister() cache.GenericLister { + return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource) +} + +// ForResource gives generic access to a shared informer of the matching type +// TODO extend this to unknown resources with a client pool +func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) { + switch resource { + // Group=migration.k8s.io, Version=v1alpha1 + case v1alpha1.SchemeGroupVersion.WithResource("storagestates"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Migration().V1alpha1().StorageStates().Informer()}, nil + case v1alpha1.SchemeGroupVersion.WithResource("storageversionmigrations"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Migration().V1alpha1().StorageVersionMigrations().Informer()}, nil + + } + + return nil, fmt.Errorf("no informer found for %v", resource) +} diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces/factory_interfaces.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces/factory_interfaces.go new file mode 100644 index 000000000000..3279b434c00d --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces/factory_interfaces.go @@ -0,0 +1,40 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by informer-gen. DO NOT EDIT. + +package internalinterfaces + +import ( + time "time" + + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + cache "k8s.io/client-go/tools/cache" + clientset "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset" +) + +// NewInformerFunc takes clientset.Interface and time.Duration to return a SharedIndexInformer. +type NewInformerFunc func(clientset.Interface, time.Duration) cache.SharedIndexInformer + +// SharedInformerFactory a small interface to allow for adding an informer without an import cycle +type SharedInformerFactory interface { + Start(stopCh <-chan struct{}) + InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer +} + +// TweakListOptionsFunc is a function that transforms a v1.ListOptions. +type TweakListOptionsFunc func(*v1.ListOptions) diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/interface.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/interface.go new file mode 100644 index 000000000000..a7afeb46025f --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/interface.go @@ -0,0 +1,46 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by informer-gen. DO NOT EDIT. + +package migration + +import ( + internalinterfaces "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces" + v1alpha1 "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1" +) + +// Interface provides access to each of this group's versions. +type Interface interface { + // V1alpha1 provides access to shared informers for resources in V1alpha1. + V1alpha1() v1alpha1.Interface +} + +type group struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// V1alpha1 returns a new v1alpha1.Interface. +func (g *group) V1alpha1() v1alpha1.Interface { + return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions) +} diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/interface.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/interface.go new file mode 100644 index 000000000000..22d5acc8106c --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/interface.go @@ -0,0 +1,52 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + internalinterfaces "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces" +) + +// Interface provides access to all the informers in this group version. +type Interface interface { + // StorageStates returns a StorageStateInformer. + StorageStates() StorageStateInformer + // StorageVersionMigrations returns a StorageVersionMigrationInformer. + StorageVersionMigrations() StorageVersionMigrationInformer +} + +type version struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// StorageStates returns a StorageStateInformer. +func (v *version) StorageStates() StorageStateInformer { + return &storageStateInformer{factory: v.factory, tweakListOptions: v.tweakListOptions} +} + +// StorageVersionMigrations returns a StorageVersionMigrationInformer. +func (v *version) StorageVersionMigrations() StorageVersionMigrationInformer { + return &storageVersionMigrationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions} +} diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/storagestate.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/storagestate.go new file mode 100644 index 000000000000..483b60f1ad8c --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/storagestate.go @@ -0,0 +1,89 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + time "time" + + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" + migrationv1alpha1 "sigs.k8s.io/kube-storage-version-migrator/pkg/apis/migration/v1alpha1" + clientset "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset" + internalinterfaces "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces" + v1alpha1 "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1" +) + +// StorageStateInformer provides access to a shared informer and lister for +// StorageStates. +type StorageStateInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.StorageStateLister +} + +type storageStateInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// NewStorageStateInformer constructs a new informer for StorageState type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewStorageStateInformer(client clientset.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredStorageStateInformer(client, resyncPeriod, indexers, nil) +} + +// NewFilteredStorageStateInformer constructs a new informer for StorageState type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredStorageStateInformer(client clientset.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.MigrationV1alpha1().StorageStates().List(context.TODO(), options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.MigrationV1alpha1().StorageStates().Watch(context.TODO(), options) + }, + }, + &migrationv1alpha1.StorageState{}, + resyncPeriod, + indexers, + ) +} + +func (f *storageStateInformer) defaultInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredStorageStateInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *storageStateInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&migrationv1alpha1.StorageState{}, f.defaultInformer) +} + +func (f *storageStateInformer) Lister() v1alpha1.StorageStateLister { + return v1alpha1.NewStorageStateLister(f.Informer().GetIndexer()) +} diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/storageversionmigration.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/storageversionmigration.go new file mode 100644 index 000000000000..4bc90ea5e108 --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/migration/v1alpha1/storageversionmigration.go @@ -0,0 +1,89 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + time "time" + + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" + migrationv1alpha1 "sigs.k8s.io/kube-storage-version-migrator/pkg/apis/migration/v1alpha1" + clientset "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset" + internalinterfaces "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/informer/internalinterfaces" + v1alpha1 "sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1" +) + +// StorageVersionMigrationInformer provides access to a shared informer and lister for +// StorageVersionMigrations. +type StorageVersionMigrationInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.StorageVersionMigrationLister +} + +type storageVersionMigrationInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// NewStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewStorageVersionMigrationInformer(client clientset.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredStorageVersionMigrationInformer(client, resyncPeriod, indexers, nil) +} + +// NewFilteredStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredStorageVersionMigrationInformer(client clientset.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.MigrationV1alpha1().StorageVersionMigrations().List(context.TODO(), options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.MigrationV1alpha1().StorageVersionMigrations().Watch(context.TODO(), options) + }, + }, + &migrationv1alpha1.StorageVersionMigration{}, + resyncPeriod, + indexers, + ) +} + +func (f *storageVersionMigrationInformer) defaultInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredStorageVersionMigrationInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *storageVersionMigrationInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&migrationv1alpha1.StorageVersionMigration{}, f.defaultInformer) +} + +func (f *storageVersionMigrationInformer) Lister() v1alpha1.StorageVersionMigrationLister { + return v1alpha1.NewStorageVersionMigrationLister(f.Informer().GetIndexer()) +} diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/expansion_generated.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/expansion_generated.go new file mode 100644 index 000000000000..daa75a09cf14 --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/expansion_generated.go @@ -0,0 +1,27 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +// StorageStateListerExpansion allows custom methods to be added to +// StorageStateLister. +type StorageStateListerExpansion interface{} + +// StorageVersionMigrationListerExpansion allows custom methods to be added to +// StorageVersionMigrationLister. +type StorageVersionMigrationListerExpansion interface{} diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/storagestate.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/storagestate.go new file mode 100644 index 000000000000..a555aa2f152a --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/storagestate.go @@ -0,0 +1,68 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" + v1alpha1 "sigs.k8s.io/kube-storage-version-migrator/pkg/apis/migration/v1alpha1" +) + +// StorageStateLister helps list StorageStates. +// All objects returned here must be treated as read-only. +type StorageStateLister interface { + // List lists all StorageStates in the indexer. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.StorageState, err error) + // Get retrieves the StorageState from the index for a given name. + // Objects returned here must be treated as read-only. + Get(name string) (*v1alpha1.StorageState, error) + StorageStateListerExpansion +} + +// storageStateLister implements the StorageStateLister interface. +type storageStateLister struct { + indexer cache.Indexer +} + +// NewStorageStateLister returns a new StorageStateLister. +func NewStorageStateLister(indexer cache.Indexer) StorageStateLister { + return &storageStateLister{indexer: indexer} +} + +// List lists all StorageStates in the indexer. +func (s *storageStateLister) List(selector labels.Selector) (ret []*v1alpha1.StorageState, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.StorageState)) + }) + return ret, err +} + +// Get retrieves the StorageState from the index for a given name. +func (s *storageStateLister) Get(name string) (*v1alpha1.StorageState, error) { + obj, exists, err := s.indexer.GetByKey(name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("storagestate"), name) + } + return obj.(*v1alpha1.StorageState), nil +} diff --git a/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/storageversionmigration.go b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/storageversionmigration.go new file mode 100644 index 000000000000..8858bd2dde47 --- /dev/null +++ b/vendor/sigs.k8s.io/kube-storage-version-migrator/pkg/clients/lister/migration/v1alpha1/storageversionmigration.go @@ -0,0 +1,68 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" + v1alpha1 "sigs.k8s.io/kube-storage-version-migrator/pkg/apis/migration/v1alpha1" +) + +// StorageVersionMigrationLister helps list StorageVersionMigrations. +// All objects returned here must be treated as read-only. +type StorageVersionMigrationLister interface { + // List lists all StorageVersionMigrations in the indexer. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.StorageVersionMigration, err error) + // Get retrieves the StorageVersionMigration from the index for a given name. + // Objects returned here must be treated as read-only. + Get(name string) (*v1alpha1.StorageVersionMigration, error) + StorageVersionMigrationListerExpansion +} + +// storageVersionMigrationLister implements the StorageVersionMigrationLister interface. +type storageVersionMigrationLister struct { + indexer cache.Indexer +} + +// NewStorageVersionMigrationLister returns a new StorageVersionMigrationLister. +func NewStorageVersionMigrationLister(indexer cache.Indexer) StorageVersionMigrationLister { + return &storageVersionMigrationLister{indexer: indexer} +} + +// List lists all StorageVersionMigrations in the indexer. +func (s *storageVersionMigrationLister) List(selector labels.Selector) (ret []*v1alpha1.StorageVersionMigration, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.StorageVersionMigration)) + }) + return ret, err +} + +// Get retrieves the StorageVersionMigration from the index for a given name. +func (s *storageVersionMigrationLister) Get(name string) (*v1alpha1.StorageVersionMigration, error) { + obj, exists, err := s.indexer.GetByKey(name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("storageversionmigration"), name) + } + return obj.(*v1alpha1.StorageVersionMigration), nil +} From 65eb05eb3657150f157dbdde0d1d769c39210b3a Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Tue, 26 May 2026 13:01:48 +0200 Subject: [PATCH 08/12] refactor(api): reuse spec key types in SecretEncryptionKeyStatus Replace the duplicated *KeyStatus types (AWSKMSKeyStatus, AzureKMSKeyStatus, IBMCloudKMSKeyStatus) with the existing spec types (AWSKMSKeyEntry, AzureKMSKey, IBMCloudKMSKeyEntry) in SecretEncryptionKeyStatus. This follows the Kubernetes convention of reusing spec types in status when the data shape is the same. Also adds omitempty to the inner fields of the three spec types, fixing a pre-existing API convention violation. Co-Authored-By: Claude Opus 4.6 (1M context) --- api/hypershift/v1beta1/aws.go | 16 -- api/hypershift/v1beta1/azure.go | 25 +-- api/hypershift/v1beta1/hostedcluster_types.go | 9 +- api/hypershift/v1beta1/ibmcloud.go | 45 +--- .../v1beta1/zz_generated.deepcopy.go | 45 ---- .../AAA_ungated.yaml | 110 ++++------ .../ClusterUpdateAcceptRisks.yaml | 110 ++++------ .../ClusterVersionOperatorConfiguration.yaml | 110 ++++------ .../ExternalOIDC.yaml | 110 ++++------ ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 110 ++++------ .../ExternalOIDCWithUpstreamParity.yaml | 110 ++++------ .../GCPPlatform.yaml | 110 ++++------ .../HCPEtcdBackup.yaml | 110 ++++------ ...perShiftOnlyDynamicResourceAllocation.yaml | 110 ++++------ .../ImageStreamImportMode.yaml | 110 ++++------ .../KMSEncryptionProvider.yaml | 110 ++++------ .../OpenStack.yaml | 110 ++++------ .../TLSAdherence.yaml | 110 ++++------ .../AAA_ungated.yaml | 110 ++++------ .../ClusterUpdateAcceptRisks.yaml | 110 ++++------ .../ClusterVersionOperatorConfiguration.yaml | 110 ++++------ .../ExternalOIDC.yaml | 110 ++++------ ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 110 ++++------ .../ExternalOIDCWithUpstreamParity.yaml | 110 ++++------ .../GCPPlatform.yaml | 110 ++++------ .../HCPEtcdBackup.yaml | 110 ++++------ ...perShiftOnlyDynamicResourceAllocation.yaml | 110 ++++------ .../ImageStreamImportMode.yaml | 110 ++++------ .../KMSEncryptionProvider.yaml | 110 ++++------ .../OpenStack.yaml | 110 ++++------ .../TLSAdherence.yaml | 110 ++++------ .../hypershift/v1beta1/awskmskeystatus.go | 47 ---- .../hypershift/v1beta1/azurekmskeystatus.go | 56 ----- .../v1beta1/ibmcloudkmskeystatus.go | 83 ------- .../v1beta1/secretencryptionkeystatus.go | 12 +- client/applyconfiguration/utils.go | 6 - ...usters-Hypershift-CustomNoUpgrade.crd.yaml | 110 ++++------ ...hostedclusters-Hypershift-Default.crd.yaml | 110 ++++------ ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 110 ++++------ ...planes-Hypershift-CustomNoUpgrade.crd.yaml | 110 ++++------ ...dcontrolplanes-Hypershift-Default.crd.yaml | 110 ++++------ ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 110 ++++------ .../hostedcontrolplane/v2/kas/kms_test.go | 14 +- .../reencryption/reencryption_test.go | 10 +- docs/content/reference/aggregated-docs.md | 202 ++---------------- docs/content/reference/api.md | 202 ++---------------- support/secretencryption/fingerprint.go | 14 +- support/secretencryption/fingerprint_test.go | 4 +- support/secretencryption/keystatus.go | 25 +-- support/secretencryption/keystatus_test.go | 2 +- .../hypershift/api/hypershift/v1beta1/aws.go | 16 -- .../api/hypershift/v1beta1/azure.go | 25 +-- .../hypershift/v1beta1/hostedcluster_types.go | 9 +- .../api/hypershift/v1beta1/ibmcloud.go | 45 +--- .../v1beta1/zz_generated.deepcopy.go | 45 ---- 55 files changed, 1486 insertions(+), 2991 deletions(-) delete mode 100644 client/applyconfiguration/hypershift/v1beta1/awskmskeystatus.go delete mode 100644 client/applyconfiguration/hypershift/v1beta1/azurekmskeystatus.go delete mode 100644 client/applyconfiguration/hypershift/v1beta1/ibmcloudkmskeystatus.go diff --git a/api/hypershift/v1beta1/aws.go b/api/hypershift/v1beta1/aws.go index a5b9c824274c..5521f6f7d688 100644 --- a/api/hypershift/v1beta1/aws.go +++ b/api/hypershift/v1beta1/aws.go @@ -1082,23 +1082,7 @@ type AWSKMSKeyEntry struct { // +required // +kubebuilder:validation:Pattern=`^arn:` // +kubebuilder:validation:MaxLength=2048 - ARN string `json:"arn"` -} - -// AWSKMSKeyStatus contains identity fields for an AWS KMS key, sufficient to -// reconstruct the backup sidecar container arguments. -// +k8s:deepcopy-gen=true -type AWSKMSKeyStatus struct { - // arn is the Amazon Resource Name of the KMS key. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=2048 ARN string `json:"arn,omitempty"` - // region is the AWS region of the KMS key. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - Region string `json:"region,omitempty"` } // AWSPlatformStatus contains status specific to the AWS platform diff --git a/api/hypershift/v1beta1/azure.go b/api/hypershift/v1beta1/azure.go index 71f7beea32a4..d9809f7627f0 100644 --- a/api/hypershift/v1beta1/azure.go +++ b/api/hypershift/v1beta1/azure.go @@ -892,37 +892,16 @@ type AzureKMSKey struct { // `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` // +kubebuilder:validation:MaxLength=255 // +required - KeyVaultName string `json:"keyVaultName"` + KeyVaultName string `json:"keyVaultName,omitempty"` // keyName is the name of the keyvault key used for encrypt/decrypt // +kubebuilder:validation:MaxLength=255 // +required - KeyName string `json:"keyName"` + KeyName string `json:"keyName,omitempty"` // keyVersion contains the version of the key to use // +kubebuilder:validation:MaxLength=255 // +required - KeyVersion string `json:"keyVersion"` -} - -// AzureKMSKeyStatus contains identity fields for an Azure KMS key, sufficient to -// reconstruct the EncryptionConfiguration read provider. -// +k8s:deepcopy-gen=true -type AzureKMSKeyStatus struct { - // keyVaultName is the name of the Azure Key Vault. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - KeyVaultName string `json:"keyVaultName,omitempty"` - // keyName is the name of the key in the vault. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - KeyName string `json:"keyName,omitempty"` - // keyVersion is the version of the key. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 KeyVersion string `json:"keyVersion,omitempty"` } diff --git a/api/hypershift/v1beta1/hostedcluster_types.go b/api/hypershift/v1beta1/hostedcluster_types.go index 98b7c1e9ba9d..fedd090b1504 100644 --- a/api/hypershift/v1beta1/hostedcluster_types.go +++ b/api/hypershift/v1beta1/hostedcluster_types.go @@ -2116,8 +2116,7 @@ type SecretEncryptionStatus struct { History []EncryptionMigrationHistory `json:"history,omitempty"` } -// SecretEncryptionKeyStatus records the active key identity. Status-specific types are used -// instead of reusing the spec types directly, to decouple status serialization from spec type evolution. +// SecretEncryptionKeyStatus records the active key identity using the same types as the spec. // +k8s:deepcopy-gen=true // +kubebuilder:validation:XValidation:rule="self.provider == 'Azure' ? has(self.azure) : !has(self.azure)",message="azure is required when provider is Azure, and forbidden otherwise" // +kubebuilder:validation:XValidation:rule="self.provider == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws is required when provider is AWS, and forbidden otherwise" @@ -2133,15 +2132,15 @@ type SecretEncryptionKeyStatus struct { // azure holds the Azure KMS key identity fields. // +optional // +unionMember - Azure AzureKMSKeyStatus `json:"azure,omitzero"` + Azure AzureKMSKey `json:"azure,omitzero"` // aws holds the AWS KMS key identity fields. // +optional // +unionMember - AWS AWSKMSKeyStatus `json:"aws,omitzero"` + AWS AWSKMSKeyEntry `json:"aws,omitzero"` // ibmCloud holds the IBM Cloud KMS key identity fields. // +optional // +unionMember - IBMCloud IBMCloudKMSKeyStatus `json:"ibmCloud,omitzero"` + IBMCloud IBMCloudKMSKeyEntry `json:"ibmCloud,omitzero"` // aescbc holds a reference to the AESCBC key secret. // +optional // +unionMember diff --git a/api/hypershift/v1beta1/ibmcloud.go b/api/hypershift/v1beta1/ibmcloud.go index bad0e9c3c1c0..490256c3ab65 100644 --- a/api/hypershift/v1beta1/ibmcloud.go +++ b/api/hypershift/v1beta1/ibmcloud.go @@ -22,61 +22,26 @@ type IBMCloudKMSKeyEntry struct { // crkID is the customer rook key id // +kubebuilder:validation:MaxLength=255 // +required - CRKID string `json:"crkID"` + CRKID string `json:"crkID,omitempty"` // instanceID is the id for the key protect instance // +kubebuilder:validation:MaxLength=255 // +required - InstanceID string `json:"instanceID"` + InstanceID string `json:"instanceID,omitempty"` // correlationID is an identifier used to track all api call usage from hypershift // +kubebuilder:validation:MaxLength=255 // +required - CorrelationID string `json:"correlationID"` + CorrelationID string `json:"correlationID,omitempty"` // url is the url to call key protect apis over // +kubebuilder:validation:Pattern=`^https://` // +kubebuilder:validation:MaxLength=2048 // +required - URL string `json:"url"` + URL string `json:"url,omitempty"` // keyVersion is a unique number associated with the key. The number increments whenever a new // key is enabled for data encryption. // +kubebuilder:validation:Minimum=0 // +kubebuilder:validation:Maximum=2147483647 // +required - KeyVersion int `json:"keyVersion"` -} - -// IBMCloudKMSKeyStatus contains identity fields for an IBM Cloud KMS key list entry, -// sufficient to reconstruct the KP_DATA_JSON entry for the backup key. -// +k8s:deepcopy-gen=true -type IBMCloudKMSKeyStatus struct { - // crkID is the Customer Root Key ID. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - CRKID string `json:"crkID,omitempty"` - // instanceID is the KMS instance ID. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - InstanceID string `json:"instanceID,omitempty"` - // keyVersion is the key version number. - // +required - // +kubebuilder:validation:Minimum=0 - KeyVersion int32 `json:"keyVersion,omitempty"` - // region is the IBM Cloud region. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - Region string `json:"region,omitempty"` - // correlationID is the correlation ID for the key. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - CorrelationID string `json:"correlationID,omitempty"` - // url is the KMS endpoint URL. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=2048 - URL string `json:"url,omitempty"` + KeyVersion int `json:"keyVersion,omitempty"` } // IBMCloudKMSAuthSpec defines metadata for how authentication is done with IBM Cloud KMS diff --git a/api/hypershift/v1beta1/zz_generated.deepcopy.go b/api/hypershift/v1beta1/zz_generated.deepcopy.go index 33601892dd28..9dbd2eea6dc4 100644 --- a/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -272,21 +272,6 @@ func (in *AWSKMSKeyEntry) DeepCopy() *AWSKMSKeyEntry { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *AWSKMSKeyStatus) DeepCopyInto(out *AWSKMSKeyStatus) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSKMSKeyStatus. -func (in *AWSKMSKeyStatus) DeepCopy() *AWSKMSKeyStatus { - if in == nil { - return nil - } - out := new(AWSKMSKeyStatus) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AWSKMSSpec) DeepCopyInto(out *AWSKMSSpec) { *out = *in @@ -672,21 +657,6 @@ func (in *AzureKMSKey) DeepCopy() *AzureKMSKey { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *AzureKMSKeyStatus) DeepCopyInto(out *AzureKMSKeyStatus) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AzureKMSKeyStatus. -func (in *AzureKMSKeyStatus) DeepCopy() *AzureKMSKeyStatus { - if in == nil { - return nil - } - out := new(AzureKMSKeyStatus) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AzureKMSSpec) DeepCopyInto(out *AzureKMSSpec) { *out = *in @@ -2834,21 +2804,6 @@ func (in *IBMCloudKMSKeyEntry) DeepCopy() *IBMCloudKMSKeyEntry { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *IBMCloudKMSKeyStatus) DeepCopyInto(out *IBMCloudKMSKeyStatus) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IBMCloudKMSKeyStatus. -func (in *IBMCloudKMSKeyStatus) DeepCopy() *IBMCloudKMSKeyStatus { - if in == nil { - return nil - } - out := new(IBMCloudKMSKeyStatus) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *IBMCloudKMSManagedAuthSpec) DeepCopyInto(out *IBMCloudKMSManagedAuthSpec) { *out = *in diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml index 9550a6992ce2..a1357f81d054 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml @@ -7056,38 +7056,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7099,42 +7094,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7284,38 +7273,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7327,42 +7311,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index fea5196ecf83..970be8af6bc4 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -7039,38 +7039,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7082,42 +7077,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7267,38 +7256,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7310,42 +7294,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index 16ad0192fc0e..4bac83e16b4d 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -7059,38 +7059,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7102,42 +7097,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7287,38 +7276,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7330,42 +7314,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml index c3b19174d9d0..255b9ff1c6b8 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml @@ -7536,38 +7536,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7579,42 +7574,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7764,38 +7753,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7807,42 +7791,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index cec6736ddbb4..6bce82c2d9ca 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -7676,38 +7676,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7719,42 +7714,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7904,38 +7893,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7947,42 +7931,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index c62dd3d18d83..5552ee23d8cf 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -7502,38 +7502,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7545,42 +7540,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7730,38 +7719,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7773,42 +7757,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml index a47c6e4f7458..18fb61f574dc 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml @@ -7485,38 +7485,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7528,42 +7523,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7713,38 +7702,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7756,42 +7740,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml index 3ca56744ebd3..f7622f5f81ef 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -7116,38 +7116,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7159,42 +7154,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7344,38 +7333,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7387,42 +7371,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index cfdd95d57a99..2b187f273b8b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -7061,38 +7061,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7104,42 +7099,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7289,38 +7278,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7332,42 +7316,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml index 4504461be66a..234525904e2b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -7068,38 +7068,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7111,42 +7106,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7296,38 +7285,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7339,42 +7323,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml index daf3aac48042..fff71701f7b1 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -7115,38 +7115,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7158,42 +7153,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7343,38 +7332,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7386,42 +7370,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml index ab1ff8ad45c5..4fac3acebacc 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml @@ -7590,38 +7590,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7633,42 +7628,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7818,38 +7807,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7861,42 +7845,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml index d8b3291b5a15..eb01515671a7 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml @@ -7079,38 +7079,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7122,42 +7117,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7307,38 +7296,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7350,42 +7334,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml index b5b5eb86392a..9f427b02af63 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml @@ -6888,38 +6888,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -6931,42 +6926,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7116,38 +7105,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7159,42 +7143,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index 97f443cb0d21..e51e7253608d 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -6871,38 +6871,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -6914,42 +6909,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7099,38 +7088,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7142,42 +7126,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index d1f563f98d7b..7c7c8cfa0949 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -6891,38 +6891,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -6934,42 +6929,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7119,38 +7108,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7162,42 +7146,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml index 5a0a3088891e..c878d7be7d9b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml @@ -7368,38 +7368,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7411,42 +7406,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7596,38 +7585,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7639,42 +7623,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index 4c1d71b72f76..be8899cfa47b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -7508,38 +7508,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7551,42 +7546,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7736,38 +7725,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7779,42 +7763,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index 7e7a23418f13..a6e47cd7c4dd 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -7334,38 +7334,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7377,42 +7372,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7562,38 +7551,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7605,42 +7589,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml index 034333cd3535..ce4fbf2fc9e9 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml @@ -7317,38 +7317,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7360,42 +7355,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7545,38 +7534,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7588,42 +7572,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml index 26fe90e75e63..e5756d1e7331 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -6936,38 +6936,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -6979,42 +6974,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7164,38 +7153,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7207,42 +7191,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index 7d5de94eecd4..7b247b0ae73f 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -6893,38 +6893,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -6936,42 +6931,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7121,38 +7110,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7164,42 +7148,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml index 4327a332bc93..37c290db44ca 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -6900,38 +6900,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -6943,42 +6938,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7128,38 +7117,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7171,42 +7155,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml index fae5de3d2ce0..fc2cc1cf6932 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -6947,38 +6947,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -6990,42 +6985,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7175,38 +7164,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7218,42 +7202,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml index 63879512e486..47d266500749 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml @@ -7422,38 +7422,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7465,42 +7460,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7650,38 +7639,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7693,42 +7677,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml index 68fe67fe532d..97bc9afc60b2 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml @@ -6911,38 +6911,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -6954,42 +6949,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7139,38 +7128,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7182,42 +7166,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/client/applyconfiguration/hypershift/v1beta1/awskmskeystatus.go b/client/applyconfiguration/hypershift/v1beta1/awskmskeystatus.go deleted file mode 100644 index 337edbc9ea75..000000000000 --- a/client/applyconfiguration/hypershift/v1beta1/awskmskeystatus.go +++ /dev/null @@ -1,47 +0,0 @@ -/* - - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1beta1 - -// AWSKMSKeyStatusApplyConfiguration represents a declarative configuration of the AWSKMSKeyStatus type for use -// with apply. -type AWSKMSKeyStatusApplyConfiguration struct { - ARN *string `json:"arn,omitempty"` - Region *string `json:"region,omitempty"` -} - -// AWSKMSKeyStatusApplyConfiguration constructs a declarative configuration of the AWSKMSKeyStatus type for use with -// apply. -func AWSKMSKeyStatus() *AWSKMSKeyStatusApplyConfiguration { - return &AWSKMSKeyStatusApplyConfiguration{} -} - -// WithARN sets the ARN field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the ARN field is set to the value of the last call. -func (b *AWSKMSKeyStatusApplyConfiguration) WithARN(value string) *AWSKMSKeyStatusApplyConfiguration { - b.ARN = &value - return b -} - -// WithRegion sets the Region field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Region field is set to the value of the last call. -func (b *AWSKMSKeyStatusApplyConfiguration) WithRegion(value string) *AWSKMSKeyStatusApplyConfiguration { - b.Region = &value - return b -} diff --git a/client/applyconfiguration/hypershift/v1beta1/azurekmskeystatus.go b/client/applyconfiguration/hypershift/v1beta1/azurekmskeystatus.go deleted file mode 100644 index 29c942b8c66a..000000000000 --- a/client/applyconfiguration/hypershift/v1beta1/azurekmskeystatus.go +++ /dev/null @@ -1,56 +0,0 @@ -/* - - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1beta1 - -// AzureKMSKeyStatusApplyConfiguration represents a declarative configuration of the AzureKMSKeyStatus type for use -// with apply. -type AzureKMSKeyStatusApplyConfiguration struct { - KeyVaultName *string `json:"keyVaultName,omitempty"` - KeyName *string `json:"keyName,omitempty"` - KeyVersion *string `json:"keyVersion,omitempty"` -} - -// AzureKMSKeyStatusApplyConfiguration constructs a declarative configuration of the AzureKMSKeyStatus type for use with -// apply. -func AzureKMSKeyStatus() *AzureKMSKeyStatusApplyConfiguration { - return &AzureKMSKeyStatusApplyConfiguration{} -} - -// WithKeyVaultName sets the KeyVaultName field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the KeyVaultName field is set to the value of the last call. -func (b *AzureKMSKeyStatusApplyConfiguration) WithKeyVaultName(value string) *AzureKMSKeyStatusApplyConfiguration { - b.KeyVaultName = &value - return b -} - -// WithKeyName sets the KeyName field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the KeyName field is set to the value of the last call. -func (b *AzureKMSKeyStatusApplyConfiguration) WithKeyName(value string) *AzureKMSKeyStatusApplyConfiguration { - b.KeyName = &value - return b -} - -// WithKeyVersion sets the KeyVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the KeyVersion field is set to the value of the last call. -func (b *AzureKMSKeyStatusApplyConfiguration) WithKeyVersion(value string) *AzureKMSKeyStatusApplyConfiguration { - b.KeyVersion = &value - return b -} diff --git a/client/applyconfiguration/hypershift/v1beta1/ibmcloudkmskeystatus.go b/client/applyconfiguration/hypershift/v1beta1/ibmcloudkmskeystatus.go deleted file mode 100644 index 8c865d62888c..000000000000 --- a/client/applyconfiguration/hypershift/v1beta1/ibmcloudkmskeystatus.go +++ /dev/null @@ -1,83 +0,0 @@ -/* - - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1beta1 - -// IBMCloudKMSKeyStatusApplyConfiguration represents a declarative configuration of the IBMCloudKMSKeyStatus type for use -// with apply. -type IBMCloudKMSKeyStatusApplyConfiguration struct { - CRKID *string `json:"crkID,omitempty"` - InstanceID *string `json:"instanceID,omitempty"` - KeyVersion *int32 `json:"keyVersion,omitempty"` - Region *string `json:"region,omitempty"` - CorrelationID *string `json:"correlationID,omitempty"` - URL *string `json:"url,omitempty"` -} - -// IBMCloudKMSKeyStatusApplyConfiguration constructs a declarative configuration of the IBMCloudKMSKeyStatus type for use with -// apply. -func IBMCloudKMSKeyStatus() *IBMCloudKMSKeyStatusApplyConfiguration { - return &IBMCloudKMSKeyStatusApplyConfiguration{} -} - -// WithCRKID sets the CRKID field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the CRKID field is set to the value of the last call. -func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithCRKID(value string) *IBMCloudKMSKeyStatusApplyConfiguration { - b.CRKID = &value - return b -} - -// WithInstanceID sets the InstanceID field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the InstanceID field is set to the value of the last call. -func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithInstanceID(value string) *IBMCloudKMSKeyStatusApplyConfiguration { - b.InstanceID = &value - return b -} - -// WithKeyVersion sets the KeyVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the KeyVersion field is set to the value of the last call. -func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithKeyVersion(value int32) *IBMCloudKMSKeyStatusApplyConfiguration { - b.KeyVersion = &value - return b -} - -// WithRegion sets the Region field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Region field is set to the value of the last call. -func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithRegion(value string) *IBMCloudKMSKeyStatusApplyConfiguration { - b.Region = &value - return b -} - -// WithCorrelationID sets the CorrelationID field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the CorrelationID field is set to the value of the last call. -func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithCorrelationID(value string) *IBMCloudKMSKeyStatusApplyConfiguration { - b.CorrelationID = &value - return b -} - -// WithURL sets the URL field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the URL field is set to the value of the last call. -func (b *IBMCloudKMSKeyStatusApplyConfiguration) WithURL(value string) *IBMCloudKMSKeyStatusApplyConfiguration { - b.URL = &value - return b -} diff --git a/client/applyconfiguration/hypershift/v1beta1/secretencryptionkeystatus.go b/client/applyconfiguration/hypershift/v1beta1/secretencryptionkeystatus.go index 21174a8ce320..313fc03721ac 100644 --- a/client/applyconfiguration/hypershift/v1beta1/secretencryptionkeystatus.go +++ b/client/applyconfiguration/hypershift/v1beta1/secretencryptionkeystatus.go @@ -25,9 +25,9 @@ import ( // with apply. type SecretEncryptionKeyStatusApplyConfiguration struct { Provider *hypershiftv1beta1.SecretEncryptionProvider `json:"provider,omitempty"` - Azure *AzureKMSKeyStatusApplyConfiguration `json:"azure,omitempty"` - AWS *AWSKMSKeyStatusApplyConfiguration `json:"aws,omitempty"` - IBMCloud *IBMCloudKMSKeyStatusApplyConfiguration `json:"ibmCloud,omitempty"` + Azure *AzureKMSKeyApplyConfiguration `json:"azure,omitempty"` + AWS *AWSKMSKeyEntryApplyConfiguration `json:"aws,omitempty"` + IBMCloud *IBMCloudKMSKeyEntryApplyConfiguration `json:"ibmCloud,omitempty"` AESCBC *AESCBCKeyStatusApplyConfiguration `json:"aescbc,omitempty"` } @@ -48,7 +48,7 @@ func (b *SecretEncryptionKeyStatusApplyConfiguration) WithProvider(value hypersh // WithAzure sets the Azure field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Azure field is set to the value of the last call. -func (b *SecretEncryptionKeyStatusApplyConfiguration) WithAzure(value *AzureKMSKeyStatusApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { +func (b *SecretEncryptionKeyStatusApplyConfiguration) WithAzure(value *AzureKMSKeyApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { b.Azure = value return b } @@ -56,7 +56,7 @@ func (b *SecretEncryptionKeyStatusApplyConfiguration) WithAzure(value *AzureKMSK // WithAWS sets the AWS field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the AWS field is set to the value of the last call. -func (b *SecretEncryptionKeyStatusApplyConfiguration) WithAWS(value *AWSKMSKeyStatusApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { +func (b *SecretEncryptionKeyStatusApplyConfiguration) WithAWS(value *AWSKMSKeyEntryApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { b.AWS = value return b } @@ -64,7 +64,7 @@ func (b *SecretEncryptionKeyStatusApplyConfiguration) WithAWS(value *AWSKMSKeySt // WithIBMCloud sets the IBMCloud field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the IBMCloud field is set to the value of the last call. -func (b *SecretEncryptionKeyStatusApplyConfiguration) WithIBMCloud(value *IBMCloudKMSKeyStatusApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { +func (b *SecretEncryptionKeyStatusApplyConfiguration) WithIBMCloud(value *IBMCloudKMSKeyEntryApplyConfiguration) *SecretEncryptionKeyStatusApplyConfiguration { b.IBMCloud = value return b } diff --git a/client/applyconfiguration/utils.go b/client/applyconfiguration/utils.go index e2d56550593a..509c0d1b8811 100644 --- a/client/applyconfiguration/utils.go +++ b/client/applyconfiguration/utils.go @@ -89,8 +89,6 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.AWSKMSAuthSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AWSKMSKeyEntry"): return &hypershiftv1beta1.AWSKMSKeyEntryApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("AWSKMSKeyStatus"): - return &hypershiftv1beta1.AWSKMSKeyStatusApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AWSKMSSpec"): return &hypershiftv1beta1.AWSKMSSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AWSNodePoolPlatform"): @@ -115,8 +113,6 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.AzureAuthenticationConfigurationApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AzureKMSKey"): return &hypershiftv1beta1.AzureKMSKeyApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("AzureKMSKeyStatus"): - return &hypershiftv1beta1.AzureKMSKeyStatusApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AzureKMSSpec"): return &hypershiftv1beta1.AzureKMSSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("AzureMarketplaceImage"): @@ -259,8 +255,6 @@ func ForKind(kind schema.GroupVersionKind) interface{} { return &hypershiftv1beta1.IBMCloudKMSAuthSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("IBMCloudKMSKeyEntry"): return &hypershiftv1beta1.IBMCloudKMSKeyEntryApplyConfiguration{} - case v1beta1.SchemeGroupVersion.WithKind("IBMCloudKMSKeyStatus"): - return &hypershiftv1beta1.IBMCloudKMSKeyStatusApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("IBMCloudKMSSpec"): return &hypershiftv1beta1.IBMCloudKMSSpecApplyConfiguration{} case v1beta1.SchemeGroupVersion.WithKind("IBMCloudKMSUnmanagedAuthSpec"): diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml index 43da88bcb60f..54afe28d93a7 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml @@ -9065,38 +9065,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -9108,42 +9103,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -9293,38 +9282,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -9336,42 +9320,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml index e3e13d9085f6..4d4b1ef858e0 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml @@ -7713,38 +7713,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7756,42 +7751,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7941,38 +7930,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7984,42 +7968,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml index 396e8eebb4ac..35f5512b2e8b 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -8925,38 +8925,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -8968,42 +8963,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -9153,38 +9142,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -9196,42 +9180,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml index 23dee0c4929a..3e95916bbd3f 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml @@ -8885,38 +8885,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -8928,42 +8923,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -9113,38 +9102,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -9156,42 +9140,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml index d9f699d90075..cde0ea13824a 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml @@ -7545,38 +7545,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7588,42 +7583,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -7773,38 +7762,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -7816,42 +7800,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml index 8b87154523da..8b364ec148af 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -8745,38 +8745,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -8788,42 +8783,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: @@ -8973,38 +8962,33 @@ spec: description: aws holds the AWS KMS key identity fields. properties: arn: - description: arn is the Amazon Resource Name of the KMS - key. + description: arn is the Amazon Resource Name for the encryption + key maxLength: 2048 - minLength: 1 - type: string - region: - description: region is the AWS region of the KMS key. - maxLength: 255 - minLength: 1 + pattern: '^arn:' type: string required: - arn - - region type: object azure: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the key in the vault. + description: keyName is the name of the keyvault key used + for encrypt/decrypt maxLength: 255 - minLength: 1 type: string keyVaultName: - description: keyVaultName is the name of the Azure Key - Vault. + description: |- + keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the version of the key. + description: keyVersion contains the version of the key + to use maxLength: 255 - minLength: 1 type: string required: - keyName @@ -9016,42 +9000,36 @@ spec: fields. properties: correlationID: - description: correlationID is the correlation ID for the - key. + description: correlationID is an identifier used to track + all api call usage from hypershift maxLength: 255 - minLength: 1 type: string crkID: - description: crkID is the Customer Root Key ID. + description: crkID is the customer rook key id maxLength: 255 - minLength: 1 type: string instanceID: - description: instanceID is the KMS instance ID. + description: instanceID is the id for the key protect + instance maxLength: 255 - minLength: 1 type: string keyVersion: - description: keyVersion is the key version number. - format: int32 + description: |- + keyVersion is a unique number associated with the key. The number increments whenever a new + key is enabled for data encryption. + maximum: 2147483647 minimum: 0 type: integer - region: - description: region is the IBM Cloud region. - maxLength: 255 - minLength: 1 - type: string url: - description: url is the KMS endpoint URL. + description: url is the url to call key protect apis over maxLength: 2048 - minLength: 1 + pattern: ^https:// type: string required: - correlationID - crkID - instanceID - keyVersion - - region - url type: object provider: diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go index 569922f01123..b15d1f75b370 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go @@ -52,7 +52,7 @@ func TestDeriveKMSKeys(t *testing.T) { encStatus: &hyperv1.SecretEncryptionStatus{ ActiveKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAWS, - AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/current-key", Region: "us-east-1"}, + AWS: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/current-key"}, }, }, validate: func(g Gomega, keys kmsWriteReadKeys) { @@ -73,11 +73,11 @@ func TestDeriveKMSKeys(t *testing.T) { encStatus: &hyperv1.SecretEncryptionStatus{ ActiveKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAWS, - AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/old-key", Region: "us-east-1"}, + AWS: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/old-key"}, }, TargetKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAWS, - AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/new-key", Region: "us-east-1"}, + AWS: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/new-key"}, }, }, currentConfig: nil, @@ -98,11 +98,11 @@ func TestDeriveKMSKeys(t *testing.T) { encStatus: &hyperv1.SecretEncryptionStatus{ ActiveKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAWS, - AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/old-key", Region: "us-east-1"}, + AWS: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/old-key"}, }, TargetKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAWS, - AWS: hyperv1.AWSKMSKeyStatus{ARN: "arn:aws:kms:us-east-1:123456789:key/new-key", Region: "us-east-1"}, + AWS: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123456789:key/new-key"}, }, }, currentConfig: kmsEncryptionConfig( @@ -126,11 +126,11 @@ func TestDeriveKMSKeys(t *testing.T) { encStatus: &hyperv1.SecretEncryptionStatus{ ActiveKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAzure, - Azure: hyperv1.AzureKMSKeyStatus{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, }, TargetKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAzure, - Azure: hyperv1.AzureKMSKeyStatus{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, }, }, currentConfig: nil, diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go index 538b94652141..3f9d525fd3b1 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go @@ -182,8 +182,8 @@ func aescbcKeyStatus(secretName, dataHash string) *hyperv1.SecretEncryptionKeySt return secretencryption.KeyStatusFromAESCBCSpec(corev1.LocalObjectReference{Name: secretName}, dataHash) } -func awsKeyStatus(arn, region string) *hyperv1.SecretEncryptionKeyStatus { - return secretencryption.KeyStatusFromAWSSpec(hyperv1.AWSKMSKeyEntry{ARN: arn}, region) +func awsKeyStatus(arn string) *hyperv1.SecretEncryptionKeyStatus { + return secretencryption.KeyStatusFromAWSSpec(hyperv1.AWSKMSKeyEntry{ARN: arn}) } func aescbcKeySecret(name, namespace, keyData string) *corev1.Secret { @@ -699,7 +699,7 @@ func TestReconcile(t *testing.T) { { name: "When using AWS KMS and key ARN changes it should start rotation with 5 encrypted resources", cpObjects: func() []client.Object { - oldKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/old-key", "us-east-1") + oldKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/old-key") return []client.Object{ newHCP( withKMSEncryption(), @@ -722,8 +722,8 @@ func TestReconcile(t *testing.T) { { name: "When in Migrating phase with KMS and all 5 migrations complete it should complete rotation", cpObjects: func() []client.Object { - oldKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/old-key", "us-east-1") - newKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/test-key-1", "us-east-1") + oldKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/old-key") + newKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/test-key-1") return []client.Object{ newHCP( withKMSEncryption(), diff --git a/docs/content/reference/aggregated-docs.md b/docs/content/reference/aggregated-docs.md index 6a4e3d70a299..e725f608b88d 100644 --- a/docs/content/reference/aggregated-docs.md +++ b/docs/content/reference/aggregated-docs.md @@ -37365,7 +37365,8 @@ string ###AWSKMSKeyEntry { #hypershift.openshift.io/v1beta1.AWSKMSKeyEntry }

(Appears on: -AWSKMSSpec) +AWSKMSSpec, +SecretEncryptionKeyStatus)

AWSKMSKeyEntry defines metadata to locate the encryption key in AWS

@@ -37391,47 +37392,6 @@ string -###AWSKMSKeyStatus { #hypershift.openshift.io/v1beta1.AWSKMSKeyStatus } -

-(Appears on: -SecretEncryptionKeyStatus) -

-

-

AWSKMSKeyStatus contains identity fields for an AWS KMS key, sufficient to -reconstruct the backup sidecar container arguments.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-arn
- -string - -		 -

arn is the Amazon Resource Name of the KMS key.

-
-region
- -string - -		 -

region is the AWS region of the KMS key.

-
###AWSKMSSpec { #hypershift.openshift.io/v1beta1.AWSKMSSpec }

(Appears on: @@ -39124,7 +39084,8 @@ applications and dev/test.

###AzureKMSKey { #hypershift.openshift.io/v1beta1.AzureKMSKey }

(Appears on: -AzureKMSSpec) +AzureKMSSpec, +SecretEncryptionKeyStatus)

@@ -39173,58 +39134,6 @@ string -###AzureKMSKeyStatus { #hypershift.openshift.io/v1beta1.AzureKMSKeyStatus } -

-(Appears on: -SecretEncryptionKeyStatus) -

-

-

AzureKMSKeyStatus contains identity fields for an Azure KMS key, sufficient to -reconstruct the EncryptionConfiguration read provider.

-

- - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-keyVaultName
- -string - -		 -

keyVaultName is the name of the Azure Key Vault.

-
-keyName
- -string - -		 -

keyName is the name of the key in the vault.

-
-keyVersion
- -string - -		 -

keyVersion is the version of the key.

-
###AzureKMSSpec { #hypershift.openshift.io/v1beta1.AzureKMSSpec }

(Appears on: @@ -46531,7 +46440,8 @@ authentication to interact with IBM Cloud KMS APIs

###IBMCloudKMSKeyEntry { #hypershift.openshift.io/v1beta1.IBMCloudKMSKeyEntry }

(Appears on: -IBMCloudKMSSpec) +IBMCloudKMSSpec, +SecretEncryptionKeyStatus)

IBMCloudKMSKeyEntry defines metadata for an IBM Cloud KMS encryption key

@@ -46602,91 +46512,6 @@ key is enabled for data encryption.

-###IBMCloudKMSKeyStatus { #hypershift.openshift.io/v1beta1.IBMCloudKMSKeyStatus } -

-(Appears on: -SecretEncryptionKeyStatus) -

-

-

IBMCloudKMSKeyStatus contains identity fields for an IBM Cloud KMS key list entry, -sufficient to reconstruct the KP_DATA_JSON entry for the backup key.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-crkID
- -string - -		 -

crkID is the Customer Root Key ID.

-
-instanceID
- -string - -		 -

instanceID is the KMS instance ID.

-
-keyVersion
- -int32 - -		 -

keyVersion is the key version number.

-
-region
- -string - -		 -

region is the IBM Cloud region.

-
-correlationID
- -string - -		 -

correlationID is the correlation ID for the key.

-
-url
- -string - -		 -

url is the KMS endpoint URL.

-
###IBMCloudKMSManagedAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSManagedAuthSpec }

(Appears on: @@ -52094,8 +51919,7 @@ When omitted, the autoscaler defaults to 50%.

SecretEncryptionStatus)

-

SecretEncryptionKeyStatus records the active key identity. Status-specific types are used -instead of reusing the spec types directly, to decouple status serialization from spec type evolution.

+

SecretEncryptionKeyStatus records the active key identity using the same types as the spec.

@@ -52122,8 +51946,8 @@ SecretEncryptionProvider @@ -52136,8 +51960,8 @@ AzureKMSKeyStatus @@ -52150,8 +51974,8 @@ AWSKMSKeyStatus diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md index a25c11791714..a4ecd9a36d0a 100644 --- a/docs/content/reference/api.md +++ b/docs/content/reference/api.md @@ -1680,7 +1680,8 @@ string ###AWSKMSKeyEntry { #hypershift.openshift.io/v1beta1.AWSKMSKeyEntry }

(Appears on: -AWSKMSSpec) +AWSKMSSpec, +SecretEncryptionKeyStatus)

AWSKMSKeyEntry defines metadata to locate the encryption key in AWS

@@ -1706,47 +1707,6 @@ string
azure,omitzero
- -AzureKMSKeyStatus + +AzureKMSKey 		aws,omitzero
- -AWSKMSKeyStatus + +AWSKMSKeyEntry 		ibmCloud,omitzero
- -IBMCloudKMSKeyStatus + +IBMCloudKMSKeyEntry
-###AWSKMSKeyStatus { #hypershift.openshift.io/v1beta1.AWSKMSKeyStatus } -

-(Appears on: -SecretEncryptionKeyStatus) -

-

-

AWSKMSKeyStatus contains identity fields for an AWS KMS key, sufficient to -reconstruct the backup sidecar container arguments.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-arn
- -string - -		 -

arn is the Amazon Resource Name of the KMS key.

-
-region
- -string - -		 -

region is the AWS region of the KMS key.

-
###AWSKMSSpec { #hypershift.openshift.io/v1beta1.AWSKMSSpec }

(Appears on: @@ -3439,7 +3399,8 @@ applications and dev/test.

###AzureKMSKey { #hypershift.openshift.io/v1beta1.AzureKMSKey }

(Appears on: -AzureKMSSpec) +AzureKMSSpec, +SecretEncryptionKeyStatus)

@@ -3488,58 +3449,6 @@ string -###AzureKMSKeyStatus { #hypershift.openshift.io/v1beta1.AzureKMSKeyStatus } -

-(Appears on: -SecretEncryptionKeyStatus) -

-

-

AzureKMSKeyStatus contains identity fields for an Azure KMS key, sufficient to -reconstruct the EncryptionConfiguration read provider.

-

- - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-keyVaultName
- -string - -		 -

keyVaultName is the name of the Azure Key Vault.

-
-keyName
- -string - -		 -

keyName is the name of the key in the vault.

-
-keyVersion
- -string - -		 -

keyVersion is the version of the key.

-
###AzureKMSSpec { #hypershift.openshift.io/v1beta1.AzureKMSSpec }

(Appears on: @@ -10846,7 +10755,8 @@ authentication to interact with IBM Cloud KMS APIs

###IBMCloudKMSKeyEntry { #hypershift.openshift.io/v1beta1.IBMCloudKMSKeyEntry }

(Appears on: -IBMCloudKMSSpec) +IBMCloudKMSSpec, +SecretEncryptionKeyStatus)

IBMCloudKMSKeyEntry defines metadata for an IBM Cloud KMS encryption key

@@ -10917,91 +10827,6 @@ key is enabled for data encryption.

-###IBMCloudKMSKeyStatus { #hypershift.openshift.io/v1beta1.IBMCloudKMSKeyStatus } -

-(Appears on: -SecretEncryptionKeyStatus) -

-

-

IBMCloudKMSKeyStatus contains identity fields for an IBM Cloud KMS key list entry, -sufficient to reconstruct the KP_DATA_JSON entry for the backup key.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-crkID
- -string - -		 -

crkID is the Customer Root Key ID.

-
-instanceID
- -string - -		 -

instanceID is the KMS instance ID.

-
-keyVersion
- -int32 - -		 -

keyVersion is the key version number.

-
-region
- -string - -		 -

region is the IBM Cloud region.

-
-correlationID
- -string - -		 -

correlationID is the correlation ID for the key.

-
-url
- -string - -		 -

url is the KMS endpoint URL.

-
###IBMCloudKMSManagedAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSManagedAuthSpec }

(Appears on: @@ -16409,8 +16234,7 @@ When omitted, the autoscaler defaults to 50%.

SecretEncryptionStatus)

-

SecretEncryptionKeyStatus records the active key identity. Status-specific types are used -instead of reusing the spec types directly, to decouple status serialization from spec type evolution.

+

SecretEncryptionKeyStatus records the active key identity using the same types as the spec.

@@ -16437,8 +16261,8 @@ SecretEncryptionProvider @@ -16451,8 +16275,8 @@ AzureKMSKeyStatus @@ -16465,8 +16289,8 @@ AWSKMSKeyStatus diff --git a/support/secretencryption/fingerprint.go b/support/secretencryption/fingerprint.go index a8fff49955fa..8c233f25c93e 100644 --- a/support/secretencryption/fingerprint.go +++ b/support/secretencryption/fingerprint.go @@ -50,11 +50,7 @@ func FingerprintFromKeyStatus(status *hyperv1.SecretEncryptionKeyStatus) string if status.Azure.KeyVaultName == "" { return "" } - return FingerprintAzureKMSKey(hyperv1.AzureKMSKey{ - KeyVaultName: status.Azure.KeyVaultName, - KeyName: status.Azure.KeyName, - KeyVersion: status.Azure.KeyVersion, - }) + return FingerprintAzureKMSKey(status.Azure) case hyperv1.SecretEncryptionProviderAWS: if status.AWS.ARN == "" { return "" @@ -64,13 +60,7 @@ func FingerprintFromKeyStatus(status *hyperv1.SecretEncryptionKeyStatus) string if status.IBMCloud.CRKID == "" { return "" } - return FingerprintIBMCloudKMSKeyList([]hyperv1.IBMCloudKMSKeyEntry{ - { - CRKID: status.IBMCloud.CRKID, - InstanceID: status.IBMCloud.InstanceID, - KeyVersion: int(status.IBMCloud.KeyVersion), - }, - }) + return FingerprintIBMCloudKMSKeyList([]hyperv1.IBMCloudKMSKeyEntry{status.IBMCloud}) case hyperv1.SecretEncryptionProviderAESCBC: if status.AESCBC.DataHash == "" { return "" diff --git a/support/secretencryption/fingerprint_test.go b/support/secretencryption/fingerprint_test.go index ae1bbc109439..0ef680b9c9f9 100644 --- a/support/secretencryption/fingerprint_test.go +++ b/support/secretencryption/fingerprint_test.go @@ -114,7 +114,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { key := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"} status := &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAzure, - Azure: hyperv1.AzureKMSKeyStatus{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, } g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintAzureKMSKey(key))) }) @@ -124,7 +124,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { arn := "arn:aws:kms:us-east-1:123:key/test" status := &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAWS, - AWS: hyperv1.AWSKMSKeyStatus{ARN: arn, Region: "us-east-1"}, + AWS: hyperv1.AWSKMSKeyEntry{ARN: arn}, } g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintAWSKMSKey(arn))) }) diff --git a/support/secretencryption/keystatus.go b/support/secretencryption/keystatus.go index 661fa741ebec..d199f2eb442d 100644 --- a/support/secretencryption/keystatus.go +++ b/support/secretencryption/keystatus.go @@ -10,38 +10,27 @@ import ( func KeyStatusFromAzureSpec(key hyperv1.AzureKMSKey) *hyperv1.SecretEncryptionKeyStatus { return &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAzure, - Azure: hyperv1.AzureKMSKeyStatus(key), + Azure: key, } } // KeyStatusFromAWSSpec creates a SecretEncryptionKeyStatus from an AWS KMS key spec. -func KeyStatusFromAWSSpec(key hyperv1.AWSKMSKeyEntry, region string) *hyperv1.SecretEncryptionKeyStatus { +func KeyStatusFromAWSSpec(key hyperv1.AWSKMSKeyEntry) *hyperv1.SecretEncryptionKeyStatus { return &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAWS, - AWS: hyperv1.AWSKMSKeyStatus{ - ARN: key.ARN, - Region: region, - }, + AWS: key, } } // KeyStatusFromIBMCloudSpec creates a SecretEncryptionKeyStatus from IBM Cloud KMS key entries. // Uses the first entry in the key list as the representative key. -func KeyStatusFromIBMCloudSpec(entries []hyperv1.IBMCloudKMSKeyEntry, region string) *hyperv1.SecretEncryptionKeyStatus { +func KeyStatusFromIBMCloudSpec(entries []hyperv1.IBMCloudKMSKeyEntry) *hyperv1.SecretEncryptionKeyStatus { if len(entries) == 0 { return nil } - e := entries[0] return &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderIBMCloud, - IBMCloud: hyperv1.IBMCloudKMSKeyStatus{ - CRKID: e.CRKID, - InstanceID: e.InstanceID, - KeyVersion: int32(e.KeyVersion), - Region: region, - CorrelationID: e.CorrelationID, - URL: e.URL, - }, + IBMCloud: entries[0], } } @@ -77,12 +66,12 @@ func KeyStatusFromSpec(spec *hyperv1.SecretEncryptionSpec, aescbcDataHash string if spec.KMS.AWS == nil { return nil } - return KeyStatusFromAWSSpec(spec.KMS.AWS.ActiveKey, spec.KMS.AWS.Region) + return KeyStatusFromAWSSpec(spec.KMS.AWS.ActiveKey) case hyperv1.IBMCloud: if spec.KMS.IBMCloud == nil { return nil } - return KeyStatusFromIBMCloudSpec(spec.KMS.IBMCloud.KeyList, spec.KMS.IBMCloud.Region) + return KeyStatusFromIBMCloudSpec(spec.KMS.IBMCloud.KeyList) } case hyperv1.AESCBC: if spec.AESCBC == nil { diff --git a/support/secretencryption/keystatus_test.go b/support/secretencryption/keystatus_test.go index 9827f3a14ed7..1bf58686187b 100644 --- a/support/secretencryption/keystatus_test.go +++ b/support/secretencryption/keystatus_test.go @@ -76,7 +76,7 @@ func TestKeyReferenceFromStatus(t *testing.T) { g := NewWithT(t) status := &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAzure, - Azure: hyperv1.AzureKMSKeyStatus{KeyVaultName: "v", KeyName: "k", KeyVersion: "1"}, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "v", KeyName: "k", KeyVersion: "1"}, } ref := KeyReferenceFromStatus(status) g.Expect(ref.Provider).To(Equal(hyperv1.SecretEncryptionProviderAzure)) diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go index a5b9c824274c..5521f6f7d688 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go @@ -1082,23 +1082,7 @@ type AWSKMSKeyEntry struct { // +required // +kubebuilder:validation:Pattern=`^arn:` // +kubebuilder:validation:MaxLength=2048 - ARN string `json:"arn"` -} - -// AWSKMSKeyStatus contains identity fields for an AWS KMS key, sufficient to -// reconstruct the backup sidecar container arguments. -// +k8s:deepcopy-gen=true -type AWSKMSKeyStatus struct { - // arn is the Amazon Resource Name of the KMS key. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=2048 ARN string `json:"arn,omitempty"` - // region is the AWS region of the KMS key. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - Region string `json:"region,omitempty"` } // AWSPlatformStatus contains status specific to the AWS platform diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go index 71f7beea32a4..d9809f7627f0 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go @@ -892,37 +892,16 @@ type AzureKMSKey struct { // `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` // +kubebuilder:validation:MaxLength=255 // +required - KeyVaultName string `json:"keyVaultName"` + KeyVaultName string `json:"keyVaultName,omitempty"` // keyName is the name of the keyvault key used for encrypt/decrypt // +kubebuilder:validation:MaxLength=255 // +required - KeyName string `json:"keyName"` + KeyName string `json:"keyName,omitempty"` // keyVersion contains the version of the key to use // +kubebuilder:validation:MaxLength=255 // +required - KeyVersion string `json:"keyVersion"` -} - -// AzureKMSKeyStatus contains identity fields for an Azure KMS key, sufficient to -// reconstruct the EncryptionConfiguration read provider. -// +k8s:deepcopy-gen=true -type AzureKMSKeyStatus struct { - // keyVaultName is the name of the Azure Key Vault. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - KeyVaultName string `json:"keyVaultName,omitempty"` - // keyName is the name of the key in the vault. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - KeyName string `json:"keyName,omitempty"` - // keyVersion is the version of the key. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 KeyVersion string `json:"keyVersion,omitempty"` } diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go index 98b7c1e9ba9d..fedd090b1504 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go @@ -2116,8 +2116,7 @@ type SecretEncryptionStatus struct { History []EncryptionMigrationHistory `json:"history,omitempty"` } -// SecretEncryptionKeyStatus records the active key identity. Status-specific types are used -// instead of reusing the spec types directly, to decouple status serialization from spec type evolution. +// SecretEncryptionKeyStatus records the active key identity using the same types as the spec. // +k8s:deepcopy-gen=true // +kubebuilder:validation:XValidation:rule="self.provider == 'Azure' ? has(self.azure) : !has(self.azure)",message="azure is required when provider is Azure, and forbidden otherwise" // +kubebuilder:validation:XValidation:rule="self.provider == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws is required when provider is AWS, and forbidden otherwise" @@ -2133,15 +2132,15 @@ type SecretEncryptionKeyStatus struct { // azure holds the Azure KMS key identity fields. // +optional // +unionMember - Azure AzureKMSKeyStatus `json:"azure,omitzero"` + Azure AzureKMSKey `json:"azure,omitzero"` // aws holds the AWS KMS key identity fields. // +optional // +unionMember - AWS AWSKMSKeyStatus `json:"aws,omitzero"` + AWS AWSKMSKeyEntry `json:"aws,omitzero"` // ibmCloud holds the IBM Cloud KMS key identity fields. // +optional // +unionMember - IBMCloud IBMCloudKMSKeyStatus `json:"ibmCloud,omitzero"` + IBMCloud IBMCloudKMSKeyEntry `json:"ibmCloud,omitzero"` // aescbc holds a reference to the AESCBC key secret. // +optional // +unionMember diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go index bad0e9c3c1c0..490256c3ab65 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go @@ -22,61 +22,26 @@ type IBMCloudKMSKeyEntry struct { // crkID is the customer rook key id // +kubebuilder:validation:MaxLength=255 // +required - CRKID string `json:"crkID"` + CRKID string `json:"crkID,omitempty"` // instanceID is the id for the key protect instance // +kubebuilder:validation:MaxLength=255 // +required - InstanceID string `json:"instanceID"` + InstanceID string `json:"instanceID,omitempty"` // correlationID is an identifier used to track all api call usage from hypershift // +kubebuilder:validation:MaxLength=255 // +required - CorrelationID string `json:"correlationID"` + CorrelationID string `json:"correlationID,omitempty"` // url is the url to call key protect apis over // +kubebuilder:validation:Pattern=`^https://` // +kubebuilder:validation:MaxLength=2048 // +required - URL string `json:"url"` + URL string `json:"url,omitempty"` // keyVersion is a unique number associated with the key. The number increments whenever a new // key is enabled for data encryption. // +kubebuilder:validation:Minimum=0 // +kubebuilder:validation:Maximum=2147483647 // +required - KeyVersion int `json:"keyVersion"` -} - -// IBMCloudKMSKeyStatus contains identity fields for an IBM Cloud KMS key list entry, -// sufficient to reconstruct the KP_DATA_JSON entry for the backup key. -// +k8s:deepcopy-gen=true -type IBMCloudKMSKeyStatus struct { - // crkID is the Customer Root Key ID. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - CRKID string `json:"crkID,omitempty"` - // instanceID is the KMS instance ID. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - InstanceID string `json:"instanceID,omitempty"` - // keyVersion is the key version number. - // +required - // +kubebuilder:validation:Minimum=0 - KeyVersion int32 `json:"keyVersion,omitempty"` - // region is the IBM Cloud region. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - Region string `json:"region,omitempty"` - // correlationID is the correlation ID for the key. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=255 - CorrelationID string `json:"correlationID,omitempty"` - // url is the KMS endpoint URL. - // +required - // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=2048 - URL string `json:"url,omitempty"` + KeyVersion int `json:"keyVersion,omitempty"` } // IBMCloudKMSAuthSpec defines metadata for how authentication is done with IBM Cloud KMS diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go index 33601892dd28..9dbd2eea6dc4 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -272,21 +272,6 @@ func (in *AWSKMSKeyEntry) DeepCopy() *AWSKMSKeyEntry { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *AWSKMSKeyStatus) DeepCopyInto(out *AWSKMSKeyStatus) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSKMSKeyStatus. -func (in *AWSKMSKeyStatus) DeepCopy() *AWSKMSKeyStatus { - if in == nil { - return nil - } - out := new(AWSKMSKeyStatus) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AWSKMSSpec) DeepCopyInto(out *AWSKMSSpec) { *out = *in @@ -672,21 +657,6 @@ func (in *AzureKMSKey) DeepCopy() *AzureKMSKey { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *AzureKMSKeyStatus) DeepCopyInto(out *AzureKMSKeyStatus) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AzureKMSKeyStatus. -func (in *AzureKMSKeyStatus) DeepCopy() *AzureKMSKeyStatus { - if in == nil { - return nil - } - out := new(AzureKMSKeyStatus) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AzureKMSSpec) DeepCopyInto(out *AzureKMSSpec) { *out = *in @@ -2834,21 +2804,6 @@ func (in *IBMCloudKMSKeyEntry) DeepCopy() *IBMCloudKMSKeyEntry { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *IBMCloudKMSKeyStatus) DeepCopyInto(out *IBMCloudKMSKeyStatus) { - *out = *in -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IBMCloudKMSKeyStatus. -func (in *IBMCloudKMSKeyStatus) DeepCopy() *IBMCloudKMSKeyStatus { - if in == nil { - return nil - } - out := new(IBMCloudKMSKeyStatus) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *IBMCloudKMSManagedAuthSpec) DeepCopyInto(out *IBMCloudKMSManagedAuthSpec) { *out = *in From 0f190129d87871c9390c471329fa8abc85b113b4 Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Tue, 26 May 2026 13:26:50 +0200 Subject: [PATCH 09/12] refactor(api): change CompletionTime from pointer to value type with omitzero Use metav1.Time (non-pointer) with omitzero instead of *metav1.Time with omitempty. The IsZero() method on metav1.Time makes omitzero correctly omit the field when unset, removing the need for a pointer. Co-Authored-By: Claude Opus 4.6 (1M context) --- api/hypershift/v1beta1/hostedcluster_types.go | 2 +- api/hypershift/v1beta1/zz_generated.deepcopy.go | 5 +---- .../controllers/reencryption/metrics.go | 2 +- .../controllers/reencryption/reencryption.go | 3 +-- .../controllers/reencryption/reencryption_test.go | 4 ++-- docs/content/reference/aggregated-docs.md | 2 +- docs/content/reference/api.md | 2 +- .../hypershift/api/hypershift/v1beta1/hostedcluster_types.go | 2 +- .../api/hypershift/v1beta1/zz_generated.deepcopy.go | 5 +---- 9 files changed, 10 insertions(+), 17 deletions(-) diff --git a/api/hypershift/v1beta1/hostedcluster_types.go b/api/hypershift/v1beta1/hostedcluster_types.go index fedd090b1504..81b9415cf087 100644 --- a/api/hypershift/v1beta1/hostedcluster_types.go +++ b/api/hypershift/v1beta1/hostedcluster_types.go @@ -2214,7 +2214,7 @@ type EncryptionMigrationHistory struct { StartedTime metav1.Time `json:"startedTime,omitempty"` // completionTime is when the rotation finished. Not set while the rotation is in progress. // +optional - CompletionTime *metav1.Time `json:"completionTime,omitempty"` + CompletionTime metav1.Time `json:"completionTime,omitzero"` } type PayloadArchType string diff --git a/api/hypershift/v1beta1/zz_generated.deepcopy.go b/api/hypershift/v1beta1/zz_generated.deepcopy.go index 9dbd2eea6dc4..e848b2d8a340 100644 --- a/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -1652,10 +1652,7 @@ func (in *EncryptionMigrationHistory) DeepCopyInto(out *EncryptionMigrationHisto out.From = in.From out.To = in.To in.StartedTime.DeepCopyInto(&out.StartedTime) - if in.CompletionTime != nil { - in, out := &in.CompletionTime, &out.CompletionTime - *out = (*in).DeepCopy() - } + in.CompletionTime.DeepCopyInto(&out.CompletionTime) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionMigrationHistory. diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/metrics.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/metrics.go index 0a51602ba639..16bc54de8b65 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/metrics.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/metrics.go @@ -61,7 +61,7 @@ func recordMigrationDuration(namespace, name string, status hyperv1.SecretEncryp return } h := status.History[0] - if h.State == hyperv1.EncryptionMigrationStateCompleted && h.CompletionTime != nil { + if h.State == hyperv1.EncryptionMigrationStateCompleted && !h.CompletionTime.IsZero() { duration := h.CompletionTime.Sub(h.StartedTime.Time).Seconds() migrationDurationHistogram.WithLabelValues(namespace, name).Observe(duration) } diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go index f1cdfbb3c2cf..df6bb99cfbce 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go @@ -416,8 +416,7 @@ func (r *Reconciler) handleMigratingPhase(_ context.Context, log logr.Logger, hc log.Info("All StorageVersionMigrations completed successfully") r.setHistoryState(hcp, hyperv1.EncryptionMigrationStateCompleted) if len(hcp.Status.SecretEncryption.History) > 0 { - now := metav1.Time{Time: r.now()} - hcp.Status.SecretEncryption.History[0].CompletionTime = &now + hcp.Status.SecretEncryption.History[0].CompletionTime = metav1.Time{Time: r.now()} } return r.completeRotation(log, hcp) diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go index 3f9d525fd3b1..70a3208fdbbb 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go @@ -437,7 +437,7 @@ func TestReconcile(t *testing.T) { g.Expect(hcp.Status.SecretEncryption.History).To(HaveLen(1)) g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateReadOnlyDeploy)) - g.Expect(hcp.Status.SecretEncryption.History[0].CompletionTime).To(BeNil()) + g.Expect(hcp.Status.SecretEncryption.History[0].CompletionTime.IsZero()).To(BeTrue()) cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) g.Expect(cond).ToNot(BeNil()) @@ -642,7 +642,7 @@ func TestReconcile(t *testing.T) { g.Expect(hcp.Status.SecretEncryption.ActiveKey.AESCBC.DataHash).To(Equal(newHash)) g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateCompleted)) - g.Expect(hcp.Status.SecretEncryption.History[0].CompletionTime).ToNot(BeNil()) + g.Expect(hcp.Status.SecretEncryption.History[0].CompletionTime.IsZero()).To(BeFalse()) cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) g.Expect(cond).ToNot(BeNil()) diff --git a/docs/content/reference/aggregated-docs.md b/docs/content/reference/aggregated-docs.md index e725f608b88d..a7ddc8cefd9d 100644 --- a/docs/content/reference/aggregated-docs.md +++ b/docs/content/reference/aggregated-docs.md @@ -42700,7 +42700,7 @@ Kubernetes meta/v1.Time @@ -42687,7 +42687,7 @@ EncryptionMigrationState @@ -7002,7 +7002,7 @@ EncryptionMigrationState
azure,omitzero
- -AzureKMSKeyStatus + +AzureKMSKey 		aws,omitzero
- -AWSKMSKeyStatus + +AWSKMSKeyEntry 		ibmCloud,omitzero
- -IBMCloudKMSKeyStatus + +IBMCloudKMSKeyEntry
-completionTime
+completionTime,omitzero
Kubernetes meta/v1.Time diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md index a4ecd9a36d0a..975a845d8986 100644 --- a/docs/content/reference/api.md +++ b/docs/content/reference/api.md @@ -7015,7 +7015,7 @@ Kubernetes meta/v1.Time
-completionTime
+completionTime,omitzero
Kubernetes meta/v1.Time diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go index fedd090b1504..81b9415cf087 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go @@ -2214,7 +2214,7 @@ type EncryptionMigrationHistory struct { StartedTime metav1.Time `json:"startedTime,omitempty"` // completionTime is when the rotation finished. Not set while the rotation is in progress. // +optional - CompletionTime *metav1.Time `json:"completionTime,omitempty"` + CompletionTime metav1.Time `json:"completionTime,omitzero"` } type PayloadArchType string diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go index 9dbd2eea6dc4..e848b2d8a340 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go @@ -1652,10 +1652,7 @@ func (in *EncryptionMigrationHistory) DeepCopyInto(out *EncryptionMigrationHisto out.From = in.From out.To = in.To in.StartedTime.DeepCopyInto(&out.StartedTime) - if in.CompletionTime != nil { - in, out := &in.CompletionTime, &out.CompletionTime - *out = (*in).DeepCopy() - } + in.CompletionTime.DeepCopyInto(&out.CompletionTime) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionMigrationHistory. From b169cfef0e80b22bbf815c22b06c4e6a9624cee5 Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Mon, 1 Jun 2026 18:19:05 +0200 Subject: [PATCH 10/12] fix: address code review feedback - Fix duplicate Azure KMS token minter container (copy-paste bug) - Revert omitempty on IBMCloudKMSKeyEntry.KeyVersion (0 is valid) - Add MinLength=1 to existing KMS key spec types alongside omitempty - Use omitzero for AESCBCKeyStatus.Secret and StartedTime struct fields - Remove unnecessary +k8s:deepcopy-gen=true markers on value-only types - Remove unused ReEncryptionPersistentFailureReason constant - Handle IsNotFound in HCCO isKASConverged and deriveTargetKeyRole - Filter watches in setup.go by KAS deployment and encryption config secret - Extract requeue interval constants - Remove unused context parameter from handleMigratingPhase - Gate recordMigrationDuration on state transition to avoid histogram inflation - Add unit tests for DecodeEncryptionConfiguration, FingerprintFromKeyStatus (IBMCloud, AESCBC, empty-field branches), and KeyStatusFromSpec (AWS, IBMCloud) Co-Authored-By: Claude Opus 4.6 (1M context) --- api/.golangci.yml | 18 ++++ api/hypershift/v1beta1/aws.go | 3 +- api/hypershift/v1beta1/azure.go | 3 + .../v1beta1/hostedcluster_conditions.go | 13 ++- api/hypershift/v1beta1/hostedcluster_types.go | 7 +- api/hypershift/v1beta1/ibmcloud.go | 8 +- .../AAA_ungated.yaml | 96 +++++++++++++++---- .../ClusterUpdateAcceptRisks.yaml | 96 +++++++++++++++---- .../ClusterVersionOperatorConfiguration.yaml | 96 +++++++++++++++---- .../ExternalOIDC.yaml | 96 +++++++++++++++---- ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 96 +++++++++++++++---- .../ExternalOIDCWithUpstreamParity.yaml | 96 +++++++++++++++---- .../GCPPlatform.yaml | 96 +++++++++++++++---- .../HCPEtcdBackup.yaml | 96 +++++++++++++++---- ...perShiftOnlyDynamicResourceAllocation.yaml | 96 +++++++++++++++---- .../ImageStreamImportMode.yaml | 96 +++++++++++++++---- .../KMSEncryptionProvider.yaml | 96 +++++++++++++++---- .../OpenStack.yaml | 96 +++++++++++++++---- .../TLSAdherence.yaml | 96 +++++++++++++++---- .../AAA_ungated.yaml | 96 +++++++++++++++---- .../ClusterUpdateAcceptRisks.yaml | 96 +++++++++++++++---- .../ClusterVersionOperatorConfiguration.yaml | 96 +++++++++++++++---- .../ExternalOIDC.yaml | 96 +++++++++++++++---- ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 96 +++++++++++++++---- .../ExternalOIDCWithUpstreamParity.yaml | 96 +++++++++++++++---- .../GCPPlatform.yaml | 96 +++++++++++++++---- .../HCPEtcdBackup.yaml | 96 +++++++++++++++---- ...perShiftOnlyDynamicResourceAllocation.yaml | 96 +++++++++++++++---- .../ImageStreamImportMode.yaml | 96 +++++++++++++++---- .../KMSEncryptionProvider.yaml | 96 +++++++++++++++---- .../OpenStack.yaml | 96 +++++++++++++++---- .../TLSAdherence.yaml | 96 +++++++++++++++---- .../hypershift/v1beta1/aescbckeystatus.go | 12 +-- ...usters-Hypershift-CustomNoUpgrade.crd.yaml | 96 +++++++++++++++---- ...hostedclusters-Hypershift-Default.crd.yaml | 96 +++++++++++++++---- ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 96 +++++++++++++++---- ...planes-Hypershift-CustomNoUpgrade.crd.yaml | 96 +++++++++++++++---- ...dcontrolplanes-Hypershift-Default.crd.yaml | 96 +++++++++++++++---- ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 96 +++++++++++++++---- .../hostedcontrolplane/v2/kas/kms/azure.go | 6 -- .../v2/kas/secretencryption_test.go | 96 ++++++++----------- .../controllers/reencryption/reencryption.go | 44 ++++++--- .../reencryption/reencryption_test.go | 2 +- .../controllers/reencryption/setup.go | 31 +++--- docs/content/reference/aggregated-docs.md | 9 +- docs/content/reference/api.md | 9 +- .../secretencryption/encryptionconfig_test.go | 49 ++++++++++ support/secretencryption/fingerprint_test.go | 54 +++++++++++ support/secretencryption/keystatus.go | 8 +- support/secretencryption/keystatus_test.go | 52 ++++++++++ test/e2e/v2/internal/workload_registry.go | 7 ++ .../hypershift/api/hypershift/v1beta1/aws.go | 3 +- .../api/hypershift/v1beta1/azure.go | 3 + .../v1beta1/hostedcluster_conditions.go | 13 ++- .../hypershift/v1beta1/hostedcluster_types.go | 7 +- .../api/hypershift/v1beta1/ibmcloud.go | 8 +- 56 files changed, 2729 insertions(+), 808 deletions(-) diff --git a/api/.golangci.yml b/api/.golangci.yml index 6a6b91242230..116293076eb4 100644 --- a/api/.golangci.yml +++ b/api/.golangci.yml @@ -2075,6 +2075,24 @@ linters: path: hypershift/v1beta1/hosted_controlplane.go text: 'statusoptional: status field "Ready" must be marked as optional, not required' + # requiredfields/optionalfields false positives on well-known k8s types (https://github.com/kubernetes-sigs/kube-api-linter/issues/249) + - linters: + - kubeapilinter + path: hypershift/v1beta1/hostedcluster_types.go + text: 'requiredfields: field EncryptionMigrationHistory.StartedTime has a valid zero value' + - linters: + - kubeapilinter + path: hypershift/v1beta1/hostedcluster_types.go + text: 'requiredfields: field EncryptionMigrationHistory.StartedTime should have the omitempty tag' + - linters: + - kubeapilinter + path: hypershift/v1beta1/hostedcluster_types.go + text: 'optionalfields: field EncryptionMigrationHistory.CompletionTime has a valid zero value' + - linters: + - kubeapilinter + path: hypershift/v1beta1/hostedcluster_types.go + text: 'optionalfields: field EncryptionMigrationHistory.CompletionTime should have the omitempty tag' + # uniquemarkers (3 issues) - linters: - kubeapilinter diff --git a/api/hypershift/v1beta1/aws.go b/api/hypershift/v1beta1/aws.go index 5521f6f7d688..a6f689d3e4d1 100644 --- a/api/hypershift/v1beta1/aws.go +++ b/api/hypershift/v1beta1/aws.go @@ -1080,7 +1080,8 @@ type AWSKMSAuthSpec struct { type AWSKMSKeyEntry struct { // arn is the Amazon Resource Name for the encryption key // +required - // +kubebuilder:validation:Pattern=`^arn:` + // +kubebuilder:validation:XValidation:rule="self.startsWith('arn:')",message="arn must start with 'arn:'" + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=2048 ARN string `json:"arn,omitempty"` } diff --git a/api/hypershift/v1beta1/azure.go b/api/hypershift/v1beta1/azure.go index d9809f7627f0..382dd669ff95 100644 --- a/api/hypershift/v1beta1/azure.go +++ b/api/hypershift/v1beta1/azure.go @@ -890,16 +890,19 @@ type AzureKMSKey struct { // keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name // Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: // `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required KeyVaultName string `json:"keyVaultName,omitempty"` // keyName is the name of the keyvault key used for encrypt/decrypt + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required KeyName string `json:"keyName,omitempty"` // keyVersion contains the version of the key to use + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required KeyVersion string `json:"keyVersion,omitempty"` diff --git a/api/hypershift/v1beta1/hostedcluster_conditions.go b/api/hypershift/v1beta1/hostedcluster_conditions.go index 374e52a4fefc..5327a67edacc 100644 --- a/api/hypershift/v1beta1/hostedcluster_conditions.go +++ b/api/hypershift/v1beta1/hostedcluster_conditions.go @@ -356,13 +356,12 @@ const ( AutoNodeProgressingReason = "AutoNodeProgressing" AutoNodeEvaluationFailedReason = "AutoNodeEvaluationFailed" - ReadOnlyRolloutInProgressReason = "ReadOnlyRolloutInProgress" - WritePromotionInProgressReason = "WritePromotionInProgress" - ReEncryptionInProgressReason = "ReEncryptionInProgress" - ReEncryptionCompletedReason = "ReEncryptionCompleted" - ReEncryptionFailedReason = "ReEncryptionFailed" - ReEncryptionWaitingForKASReason = "ReEncryptionWaitingForKASConvergence" - ReEncryptionPersistentFailureReason = "ReEncryptionPersistentFailure" + ReadOnlyRolloutInProgressReason = "ReadOnlyRolloutInProgress" + WritePromotionInProgressReason = "WritePromotionInProgress" + ReEncryptionInProgressReason = "ReEncryptionInProgress" + ReEncryptionCompletedReason = "ReEncryptionCompleted" + ReEncryptionFailedReason = "ReEncryptionFailed" + ReEncryptionWaitingForKASReason = "ReEncryptionWaitingForKASConvergence" ) // Messages. diff --git a/api/hypershift/v1beta1/hostedcluster_types.go b/api/hypershift/v1beta1/hostedcluster_types.go index 81b9415cf087..a1da814d75d4 100644 --- a/api/hypershift/v1beta1/hostedcluster_types.go +++ b/api/hypershift/v1beta1/hostedcluster_types.go @@ -2117,7 +2117,6 @@ type SecretEncryptionStatus struct { } // SecretEncryptionKeyStatus records the active key identity using the same types as the spec. -// +k8s:deepcopy-gen=true // +kubebuilder:validation:XValidation:rule="self.provider == 'Azure' ? has(self.azure) : !has(self.azure)",message="azure is required when provider is Azure, and forbidden otherwise" // +kubebuilder:validation:XValidation:rule="self.provider == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws is required when provider is AWS, and forbidden otherwise" // +kubebuilder:validation:XValidation:rule="self.provider == 'IBMCloud' ? has(self.ibmCloud) : !has(self.ibmCloud)",message="ibmCloud is required when provider is IBMCloud, and forbidden otherwise" @@ -2149,11 +2148,10 @@ type SecretEncryptionKeyStatus struct { // AESCBCKeyStatus contains a reference to the AESCBC key secret and a SHA-256 hash // of its contents for fingerprinting. -// +k8s:deepcopy-gen=true type AESCBCKeyStatus struct { // secret is a reference to the secret containing the AESCBC key. // +required - Secret corev1.LocalObjectReference `json:"secret,omitempty"` + Secret SecretReference `json:"secret,omitzero"` // dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field // at the time re-encryption completed. // +required @@ -2163,7 +2161,6 @@ type AESCBCKeyStatus struct { } // EncryptionKeyReference identifies an encryption key by its provider and fingerprint. -// +k8s:deepcopy-gen=true type EncryptionKeyReference struct { // provider identifies the encryption provider. // +required @@ -2211,7 +2208,7 @@ type EncryptionMigrationHistory struct { State EncryptionMigrationState `json:"state,omitempty"` // startedTime is when the rotation was initiated. // +required - StartedTime metav1.Time `json:"startedTime,omitempty"` + StartedTime metav1.Time `json:"startedTime,omitzero"` // completionTime is when the rotation finished. Not set while the rotation is in progress. // +optional CompletionTime metav1.Time `json:"completionTime,omitzero"` diff --git a/api/hypershift/v1beta1/ibmcloud.go b/api/hypershift/v1beta1/ibmcloud.go index 490256c3ab65..7c06d5b46d66 100644 --- a/api/hypershift/v1beta1/ibmcloud.go +++ b/api/hypershift/v1beta1/ibmcloud.go @@ -20,19 +20,23 @@ type IBMCloudKMSSpec struct { // IBMCloudKMSKeyEntry defines metadata for an IBM Cloud KMS encryption key type IBMCloudKMSKeyEntry struct { // crkID is the customer rook key id + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required CRKID string `json:"crkID,omitempty"` // instanceID is the id for the key protect instance + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required InstanceID string `json:"instanceID,omitempty"` // correlationID is an identifier used to track all api call usage from hypershift + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required CorrelationID string `json:"correlationID,omitempty"` // url is the url to call key protect apis over - // +kubebuilder:validation:Pattern=`^https://` + // +kubebuilder:validation:XValidation:rule="self.startsWith('https://')",message="url must start with 'https://'" + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=2048 // +required URL string `json:"url,omitempty"` @@ -41,7 +45,7 @@ type IBMCloudKMSKeyEntry struct { // +kubebuilder:validation:Minimum=0 // +kubebuilder:validation:Maximum=2147483647 // +required - KeyVersion int `json:"keyVersion,omitempty"` + KeyVersion int `json:"keyVersion"` } // IBMCloudKMSAuthSpec defines metadata for how authentication is done with IBM Cloud KMS diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml index a1357f81d054..693b45846202 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml @@ -6056,8 +6056,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6090,8 +6093,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6117,6 +6123,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6124,11 +6131,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6147,6 +6156,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6154,11 +6164,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6322,15 +6334,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6343,8 +6358,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7038,16 +7056,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7059,8 +7083,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7071,6 +7098,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7078,11 +7106,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7097,15 +7127,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7117,8 +7150,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7255,16 +7291,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7276,8 +7318,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7288,6 +7333,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7295,11 +7341,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7314,15 +7362,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7334,8 +7385,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index 970be8af6bc4..cf434c88f2c7 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -6039,8 +6039,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6073,8 +6076,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6100,6 +6106,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6107,11 +6114,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6130,6 +6139,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6137,11 +6147,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6305,15 +6317,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6326,8 +6341,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7021,16 +7039,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7042,8 +7066,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7054,6 +7081,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7061,11 +7089,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7080,15 +7110,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7100,8 +7133,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7238,16 +7274,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7259,8 +7301,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7271,6 +7316,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7278,11 +7324,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7297,15 +7345,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7317,8 +7368,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index 4bac83e16b4d..ce24cafdbf15 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -6059,8 +6059,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6093,8 +6096,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6120,6 +6126,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6127,11 +6134,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6150,6 +6159,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6157,11 +6167,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6325,15 +6337,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6346,8 +6361,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7041,16 +7059,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7062,8 +7086,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7074,6 +7101,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7081,11 +7109,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7100,15 +7130,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7120,8 +7153,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7258,16 +7294,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7279,8 +7321,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7291,6 +7336,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7298,11 +7344,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7317,15 +7365,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7337,8 +7388,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml index 255b9ff1c6b8..2d59a7b0e49e 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml @@ -6371,8 +6371,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6405,8 +6408,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6432,6 +6438,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6439,11 +6446,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6462,6 +6471,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6469,11 +6479,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6637,15 +6649,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6658,8 +6673,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7518,16 +7536,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7539,8 +7563,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7551,6 +7578,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7558,11 +7586,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7577,15 +7607,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7597,8 +7630,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7735,16 +7771,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7756,8 +7798,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7768,6 +7813,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7775,11 +7821,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7794,15 +7842,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7814,8 +7865,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index 6bce82c2d9ca..e31e19357c6e 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -6511,8 +6511,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6545,8 +6548,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6572,6 +6578,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6579,11 +6586,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6602,6 +6611,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6609,11 +6619,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6777,15 +6789,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6798,8 +6813,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7658,16 +7676,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7679,8 +7703,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7691,6 +7718,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7698,11 +7726,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7717,15 +7747,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7737,8 +7770,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7875,16 +7911,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7896,8 +7938,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7908,6 +7953,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7915,11 +7961,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7934,15 +7982,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7954,8 +8005,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index 5552ee23d8cf..e009c0d4ebfb 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -6502,8 +6502,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6536,8 +6539,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6563,6 +6569,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6570,11 +6577,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6593,6 +6602,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6600,11 +6610,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6768,15 +6780,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6789,8 +6804,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7484,16 +7502,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7505,8 +7529,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7517,6 +7544,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7524,11 +7552,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7543,15 +7573,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7563,8 +7596,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7701,16 +7737,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7722,8 +7764,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7734,6 +7779,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7741,11 +7787,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7760,15 +7808,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7780,8 +7831,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml index 18fb61f574dc..fd0faf247ee2 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml @@ -6485,8 +6485,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6519,8 +6522,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6546,6 +6552,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6553,11 +6560,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6576,6 +6585,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6583,11 +6593,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6751,15 +6763,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6772,8 +6787,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7467,16 +7485,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7488,8 +7512,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7500,6 +7527,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7507,11 +7535,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7526,15 +7556,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7546,8 +7579,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7684,16 +7720,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7705,8 +7747,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7717,6 +7762,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7724,11 +7770,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7743,15 +7791,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7763,8 +7814,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml index f7622f5f81ef..80cfc83a5334 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -6104,8 +6104,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6138,8 +6141,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6165,6 +6171,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6172,11 +6179,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6195,6 +6204,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6202,11 +6212,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6370,15 +6382,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6391,8 +6406,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7098,16 +7116,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7119,8 +7143,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7131,6 +7158,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7138,11 +7166,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7157,15 +7187,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7177,8 +7210,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7315,16 +7351,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7336,8 +7378,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7348,6 +7393,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7355,11 +7401,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7374,15 +7422,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7394,8 +7445,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index 2b187f273b8b..0f1f5e15a70b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -6061,8 +6061,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6095,8 +6098,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6122,6 +6128,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6129,11 +6136,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6152,6 +6161,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6159,11 +6169,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6327,15 +6339,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6348,8 +6363,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7043,16 +7061,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7064,8 +7088,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7076,6 +7103,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7083,11 +7111,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7102,15 +7132,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7122,8 +7155,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7260,16 +7296,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7281,8 +7323,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7293,6 +7338,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7300,11 +7346,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7319,15 +7367,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7339,8 +7390,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml index 234525904e2b..ad31e4c33c7f 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -6057,8 +6057,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6091,8 +6094,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6118,6 +6124,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6125,11 +6132,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6148,6 +6157,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6155,11 +6165,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6323,15 +6335,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6344,8 +6359,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7050,16 +7068,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7071,8 +7095,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7083,6 +7110,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7090,11 +7118,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7109,15 +7139,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7129,8 +7162,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7267,16 +7303,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7288,8 +7330,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7300,6 +7345,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7307,11 +7353,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7326,15 +7374,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7346,8 +7397,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml index fff71701f7b1..9655509e7d4f 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -6115,8 +6115,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6149,8 +6152,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6176,6 +6182,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6183,11 +6190,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6206,6 +6215,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6213,11 +6223,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6381,15 +6393,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6402,8 +6417,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7097,16 +7115,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7118,8 +7142,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7130,6 +7157,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7137,11 +7165,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7156,15 +7186,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7176,8 +7209,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7314,16 +7350,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7335,8 +7377,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7347,6 +7392,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7354,11 +7400,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7373,15 +7421,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7393,8 +7444,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml index 4fac3acebacc..d7aad14123c9 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml @@ -6590,8 +6590,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6624,8 +6627,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6651,6 +6657,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6658,11 +6665,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6681,6 +6690,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6688,11 +6698,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6856,15 +6868,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6877,8 +6892,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7572,16 +7590,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7593,8 +7617,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7605,6 +7632,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7612,11 +7640,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7631,15 +7661,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7651,8 +7684,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7789,16 +7825,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7810,8 +7852,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7822,6 +7867,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7829,11 +7875,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7848,15 +7896,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7868,8 +7919,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml index eb01515671a7..88e2ab796063 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml @@ -6079,8 +6079,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6113,8 +6116,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6140,6 +6146,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6147,11 +6154,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6170,6 +6179,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6177,11 +6187,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6345,15 +6357,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6366,8 +6381,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7061,16 +7079,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7082,8 +7106,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7094,6 +7121,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7101,11 +7129,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7120,15 +7150,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7140,8 +7173,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7278,16 +7314,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7299,8 +7341,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7311,6 +7356,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7318,11 +7364,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7337,15 +7385,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7357,8 +7408,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml index 9f427b02af63..c0767015e625 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml @@ -5911,8 +5911,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5945,8 +5948,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5972,6 +5978,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -5979,11 +5986,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6002,6 +6011,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6009,11 +6019,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6177,15 +6189,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6198,8 +6213,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -6870,16 +6888,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -6891,8 +6915,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6903,6 +6930,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6910,11 +6938,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6929,15 +6959,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6949,8 +6982,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7087,16 +7123,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7108,8 +7150,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7120,6 +7165,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7127,11 +7173,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7146,15 +7194,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7166,8 +7217,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index e51e7253608d..f4534d57809a 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -5894,8 +5894,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5928,8 +5931,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5955,6 +5961,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -5962,11 +5969,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -5985,6 +5994,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -5992,11 +6002,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6160,15 +6172,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6181,8 +6196,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -6853,16 +6871,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -6874,8 +6898,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6886,6 +6913,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6893,11 +6921,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6912,15 +6942,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6932,8 +6965,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7070,16 +7106,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7091,8 +7133,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7103,6 +7148,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7110,11 +7156,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7129,15 +7177,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7149,8 +7200,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index 7c7c8cfa0949..ec97711d6ee2 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -5914,8 +5914,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5948,8 +5951,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5975,6 +5981,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -5982,11 +5989,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6005,6 +6014,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6012,11 +6022,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6180,15 +6192,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6201,8 +6216,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -6873,16 +6891,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -6894,8 +6918,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6906,6 +6933,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6913,11 +6941,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6932,15 +6962,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6952,8 +6985,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7090,16 +7126,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7111,8 +7153,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7123,6 +7168,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7130,11 +7176,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7149,15 +7197,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7169,8 +7220,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml index c878d7be7d9b..fab83ba3783a 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml @@ -6226,8 +6226,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6260,8 +6263,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6287,6 +6293,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6294,11 +6301,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6317,6 +6326,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6324,11 +6334,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6492,15 +6504,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6513,8 +6528,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7350,16 +7368,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7371,8 +7395,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7383,6 +7410,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7390,11 +7418,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7409,15 +7439,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7429,8 +7462,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7567,16 +7603,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7588,8 +7630,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7600,6 +7645,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7607,11 +7653,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7626,15 +7674,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7646,8 +7697,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index be8899cfa47b..4bcb3fa44fba 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -6366,8 +6366,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6400,8 +6403,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6427,6 +6433,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6434,11 +6441,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6457,6 +6466,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6464,11 +6474,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6632,15 +6644,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6653,8 +6668,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7490,16 +7508,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7511,8 +7535,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7523,6 +7550,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7530,11 +7558,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7549,15 +7579,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7569,8 +7602,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7707,16 +7743,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7728,8 +7770,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7740,6 +7785,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7747,11 +7793,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7766,15 +7814,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7786,8 +7837,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index a6e47cd7c4dd..d631d1a9f508 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -6357,8 +6357,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6391,8 +6394,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6418,6 +6424,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6425,11 +6432,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6448,6 +6457,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6455,11 +6465,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6623,15 +6635,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6644,8 +6659,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7316,16 +7334,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7337,8 +7361,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7349,6 +7376,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7356,11 +7384,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7375,15 +7405,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7395,8 +7428,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7533,16 +7569,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7554,8 +7596,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7566,6 +7611,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7573,11 +7619,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7592,15 +7640,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7612,8 +7663,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml index ce4fbf2fc9e9..384e2d21e04a 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml @@ -6340,8 +6340,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6374,8 +6377,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6401,6 +6407,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6408,11 +6415,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6431,6 +6440,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6438,11 +6448,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6606,15 +6618,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6627,8 +6642,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7299,16 +7317,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7320,8 +7344,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7332,6 +7359,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7339,11 +7367,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7358,15 +7388,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7378,8 +7411,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7516,16 +7552,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7537,8 +7579,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7549,6 +7594,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7556,11 +7602,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7575,15 +7623,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7595,8 +7646,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml index e5756d1e7331..bc681a8e33ea 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -5959,8 +5959,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5993,8 +5996,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6020,6 +6026,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6027,11 +6034,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6050,6 +6059,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6057,11 +6067,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6225,15 +6237,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6246,8 +6261,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -6918,16 +6936,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -6939,8 +6963,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6951,6 +6978,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6958,11 +6986,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6977,15 +7007,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6997,8 +7030,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7135,16 +7171,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7156,8 +7198,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7168,6 +7213,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7175,11 +7221,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7194,15 +7242,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7214,8 +7265,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index 7b247b0ae73f..872b96ae31fd 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -5916,8 +5916,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5950,8 +5953,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5977,6 +5983,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -5984,11 +5991,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6007,6 +6016,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6014,11 +6024,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6182,15 +6194,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6203,8 +6218,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -6875,16 +6893,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -6896,8 +6920,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6908,6 +6935,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6915,11 +6943,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6934,15 +6964,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6954,8 +6987,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7092,16 +7128,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7113,8 +7155,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7125,6 +7170,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7132,11 +7178,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7151,15 +7199,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7171,8 +7222,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml index 37c290db44ca..29aa831a5f47 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -5912,8 +5912,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5946,8 +5949,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5973,6 +5979,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -5980,11 +5987,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6003,6 +6012,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6010,11 +6020,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6178,15 +6190,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6199,8 +6214,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -6882,16 +6900,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -6903,8 +6927,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6915,6 +6942,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6922,11 +6950,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6941,15 +6971,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6961,8 +6994,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7099,16 +7135,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7120,8 +7162,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7132,6 +7177,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7139,11 +7185,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7158,15 +7206,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7178,8 +7229,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml index fc2cc1cf6932..2aa74cb943bb 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -5970,8 +5970,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6004,8 +6007,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6031,6 +6037,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6038,11 +6045,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6061,6 +6070,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6068,11 +6078,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6236,15 +6248,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6257,8 +6272,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -6929,16 +6947,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -6950,8 +6974,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6962,6 +6989,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6969,11 +6997,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6988,15 +7018,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7008,8 +7041,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7146,16 +7182,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7167,8 +7209,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7179,6 +7224,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7186,11 +7232,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7205,15 +7253,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7225,8 +7276,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml index 47d266500749..ca2aa6dea3b3 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml @@ -6445,8 +6445,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6479,8 +6482,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6506,6 +6512,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6513,11 +6520,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6536,6 +6545,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6543,11 +6553,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6711,15 +6723,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6732,8 +6747,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7404,16 +7422,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7425,8 +7449,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7437,6 +7464,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7444,11 +7472,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7463,15 +7493,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7483,8 +7516,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7621,16 +7657,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7642,8 +7684,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7654,6 +7699,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7661,11 +7707,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7680,15 +7728,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7700,8 +7751,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml index 97bc9afc60b2..7d9faf4ad985 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml @@ -5934,8 +5934,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5968,8 +5971,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -5995,6 +6001,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6002,11 +6009,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6025,6 +6034,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6032,11 +6042,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6200,15 +6212,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6221,8 +6236,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -6893,16 +6911,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -6914,8 +6938,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6926,6 +6953,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6933,11 +6961,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6952,15 +6982,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6972,8 +7005,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7110,16 +7146,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7131,8 +7173,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7143,6 +7188,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7150,11 +7196,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7169,15 +7217,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7189,8 +7240,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/client/applyconfiguration/hypershift/v1beta1/aescbckeystatus.go b/client/applyconfiguration/hypershift/v1beta1/aescbckeystatus.go index 414a0f19836e..b66f26ac2eef 100644 --- a/client/applyconfiguration/hypershift/v1beta1/aescbckeystatus.go +++ b/client/applyconfiguration/hypershift/v1beta1/aescbckeystatus.go @@ -17,15 +17,11 @@ limitations under the License. package v1beta1 -import ( - v1 "k8s.io/api/core/v1" -) - // AESCBCKeyStatusApplyConfiguration represents a declarative configuration of the AESCBCKeyStatus type for use // with apply. type AESCBCKeyStatusApplyConfiguration struct { - Secret *v1.LocalObjectReference `json:"secret,omitempty"` - DataHash *string `json:"dataHash,omitempty"` + Secret *SecretReferenceApplyConfiguration `json:"secret,omitempty"` + DataHash *string `json:"dataHash,omitempty"` } // AESCBCKeyStatusApplyConfiguration constructs a declarative configuration of the AESCBCKeyStatus type for use with @@ -37,8 +33,8 @@ func AESCBCKeyStatus() *AESCBCKeyStatusApplyConfiguration { // WithSecret sets the Secret field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Secret field is set to the value of the last call. -func (b *AESCBCKeyStatusApplyConfiguration) WithSecret(value v1.LocalObjectReference) *AESCBCKeyStatusApplyConfiguration { - b.Secret = &value +func (b *AESCBCKeyStatusApplyConfiguration) WithSecret(value *SecretReferenceApplyConfiguration) *AESCBCKeyStatusApplyConfiguration { + b.Secret = value return b } diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml index 54afe28d93a7..98adb08df66b 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml @@ -7877,8 +7877,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7911,8 +7914,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7938,6 +7944,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7945,11 +7952,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7968,6 +7977,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7975,11 +7985,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -8143,15 +8155,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -8164,8 +8179,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -9047,16 +9065,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -9068,8 +9092,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -9080,6 +9107,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -9087,11 +9115,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -9106,15 +9136,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -9126,8 +9159,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -9264,16 +9300,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -9285,8 +9327,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -9297,6 +9342,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -9304,11 +9350,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -9323,15 +9371,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -9343,8 +9394,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml index 4d4b1ef858e0..9452aa371728 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml @@ -6548,8 +6548,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6582,8 +6585,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6609,6 +6615,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6616,11 +6623,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6639,6 +6648,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6646,11 +6656,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6814,15 +6826,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6835,8 +6850,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7695,16 +7713,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7716,8 +7740,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7728,6 +7755,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7735,11 +7763,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7754,15 +7784,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7774,8 +7807,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7912,16 +7948,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7933,8 +7975,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7945,6 +7990,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7952,11 +7998,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7971,15 +8019,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7991,8 +8042,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml index 35f5512b2e8b..7502f341bb8d 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -7748,8 +7748,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7782,8 +7785,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7809,6 +7815,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7816,11 +7823,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7839,6 +7848,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7846,11 +7856,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -8014,15 +8026,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -8035,8 +8050,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -8907,16 +8925,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -8928,8 +8952,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -8940,6 +8967,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -8947,11 +8975,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -8966,15 +8996,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -8986,8 +9019,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -9124,16 +9160,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -9145,8 +9187,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -9157,6 +9202,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -9164,11 +9210,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -9183,15 +9231,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -9203,8 +9254,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml index 3e95916bbd3f..455243878fe1 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml @@ -7732,8 +7732,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7766,8 +7769,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7793,6 +7799,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7800,11 +7807,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7823,6 +7832,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7830,11 +7840,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7998,15 +8010,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -8019,8 +8034,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -8867,16 +8885,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -8888,8 +8912,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -8900,6 +8927,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -8907,11 +8935,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -8926,15 +8956,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -8946,8 +8979,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -9084,16 +9120,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -9105,8 +9147,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -9117,6 +9162,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -9124,11 +9170,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -9143,15 +9191,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -9163,8 +9214,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml index cde0ea13824a..56b37974ee7c 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml @@ -6403,8 +6403,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6437,8 +6440,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -6464,6 +6470,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6471,11 +6478,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6494,6 +6503,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -6501,11 +6511,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -6669,15 +6681,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -6690,8 +6705,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7527,16 +7545,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7548,8 +7572,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7560,6 +7587,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7567,11 +7595,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7586,15 +7616,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7606,8 +7639,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -7744,16 +7780,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -7765,8 +7807,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7777,6 +7822,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7784,11 +7830,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7803,15 +7851,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7823,8 +7874,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml index 8b364ec148af..9aef745b3d67 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -7603,8 +7603,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7637,8 +7640,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -7664,6 +7670,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7671,11 +7678,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7694,6 +7703,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -7701,11 +7711,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -7869,15 +7881,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -7890,8 +7905,11 @@ spec: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -8727,16 +8745,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -8748,8 +8772,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -8760,6 +8787,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -8767,11 +8795,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -8786,15 +8816,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -8806,8 +8839,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID @@ -8944,16 +8980,22 @@ spec: the AESCBC key. properties: name: - default: "" description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most + 253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods. + Each period-separated segment must start and end with an alphanumeric character. + maxLength: 253 + minLength: 1 type: string + x-kubernetes-validations: + - message: name must consist only of lowercase alphanumeric + characters, hyphens, and periods. Each period-separated + segment must start and end with an alphanumeric + character. + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + required: + - name type: object - x-kubernetes-map-type: atomic required: - dataHash - secret @@ -8965,8 +9007,11 @@ spec: description: arn is the Amazon Resource Name for the encryption key maxLength: 2048 - pattern: '^arn:' + minLength: 1 type: string + x-kubernetes-validations: + - message: arn must start with 'arn:' + rule: self.startsWith('arn:') required: - arn type: object @@ -8977,6 +9022,7 @@ spec: description: keyName is the name of the keyvault key used for encrypt/decrypt maxLength: 255 + minLength: 1 type: string keyVaultName: description: |- @@ -8984,11 +9030,13 @@ spec: Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 + minLength: 1 type: string keyVersion: description: keyVersion contains the version of the key to use maxLength: 255 + minLength: 1 type: string required: - keyName @@ -9003,15 +9051,18 @@ spec: description: correlationID is an identifier used to track all api call usage from hypershift maxLength: 255 + minLength: 1 type: string crkID: description: crkID is the customer rook key id maxLength: 255 + minLength: 1 type: string instanceID: description: instanceID is the id for the key protect instance maxLength: 255 + minLength: 1 type: string keyVersion: description: |- @@ -9023,8 +9074,11 @@ spec: url: description: url is the url to call key protect apis over maxLength: 2048 - pattern: ^https:// + minLength: 1 type: string + x-kubernetes-validations: + - message: url must start with 'https://' + rule: self.startsWith('https://') required: - correlationID - crkID diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go index 242950545543..7ba662811f5d 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go @@ -195,12 +195,6 @@ func (p *azureKMSProvider) GenerateKMSPodConfig() (*KMSPodConfig, error) { ) } - if p.isSelfManaged { - podConfig.Containers = append(podConfig.Containers, - podspec.BuildContainer(kasContainerAzureKMSTokenMinter(), p.buildKASContainerAzureKMSTokenMinter()), - ) - } - podConfig.KASContainerMutate = func(c *corev1.Container) { c.VolumeMounts = append(c.VolumeMounts, azureKMSVolumeMounts.ContainerMounts(KasMainContainerName)...) } diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption_test.go index a3037fe631e0..09206f0a1b25 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption_test.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/secretencryption_test.go @@ -2,9 +2,7 @@ package kas import ( "bytes" - "context" "encoding/base64" - "fmt" "testing" "time" @@ -22,9 +20,7 @@ import ( v1 "k8s.io/apiserver/pkg/apis/apiserver/v1" "k8s.io/utils/ptr" - "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/client/fake" - "sigs.k8s.io/controller-runtime/pkg/client/interceptor" "github.com/google/go-cmp/cmp" ) @@ -393,40 +389,50 @@ func TestGetKMSAPIVersion(t *testing.T) { t.Parallel() tests := []struct { name string - secret *corev1.Secret - client client.Client - wantErr bool - errSubstr string + config *v1.EncryptionConfiguration wantResult string }{ { - name: "When client Get returns a non-NotFound error, it should return a wrapped error", - secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{Name: "encryption-config", Namespace: "test-ns"}, - }, - client: fake.NewClientBuilder().WithInterceptorFuncs(interceptor.Funcs{ - Get: func(_ context.Context, _ client.WithWatch, _ client.ObjectKey, _ client.Object, _ ...client.GetOption) error { - return fmt.Errorf("connection refused") + name: "When config is nil it should return default v2", + config: nil, + wantResult: "v2", + }, + { + name: "When config has no KMS provider it should return default v2", + config: &v1.EncryptionConfiguration{ + Resources: []v1.ResourceConfiguration{ + { + Providers: []v1.ProviderConfiguration{ + {Identity: &v1.IdentityConfiguration{}}, + }, + }, }, - }).Build(), - wantErr: true, - errSubstr: "failed to get existing secret encryption config", + }, + wantResult: "v2", }, { - name: "When secret contains invalid YAML, it should return a decode error", - secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{Name: "encryption-config", Namespace: "test-ns"}, - Data: map[string][]byte{ - secretEncryptionConfigurationKey: []byte("not-valid-yaml: {{{"), + name: "When config has KMS v1 provider it should return v1", + config: &v1.EncryptionConfiguration{ + Resources: []v1.ResourceConfiguration{ + { + Providers: []v1.ProviderConfiguration{ + {KMS: &v1.KMSConfiguration{APIVersion: "v1"}}, + }, + }, }, }, - wantErr: true, - errSubstr: "cannot decode resource", + wantResult: "v1", }, { - name: "When secret does not exist, it should return default v2", - secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{Name: "encryption-config", Namespace: "test-ns"}, + name: "When config has KMS v2 provider it should return v2", + config: &v1.EncryptionConfiguration{ + Resources: []v1.ResourceConfiguration{ + { + Providers: []v1.ProviderConfiguration{ + {KMS: &v1.KMSConfiguration{APIVersion: "v2"}}, + }, + }, + }, }, wantResult: "v2", }, @@ -435,28 +441,8 @@ func TestGetKMSAPIVersion(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { g := NewWithT(t) - - c := tt.client - if c == nil { - c = fake.NewClientBuilder().Build() - } - if tt.secret.Data != nil && tt.client == nil { - c = fake.NewClientBuilder().WithObjects(tt.secret).Build() - } - - cpContext := controlplanecomponent.WorkloadContext{ - Context: t.Context(), - Client: c, - } - - result, err := getKMSAPIVersion(cpContext, tt.secret) - if tt.wantErr { - g.Expect(err).To(HaveOccurred()) - g.Expect(err.Error()).To(ContainSubstring(tt.errSubstr)) - } else { - g.Expect(err).ToNot(HaveOccurred()) - g.Expect(result).To(Equal(tt.wantResult)) - } + result := getKMSAPIVersion(tt.config) + g.Expect(result).To(Equal(tt.wantResult)) }) } } @@ -648,7 +634,7 @@ func TestDeriveAESCBCEncryptionConfig(t *testing.T) { ActiveKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAESCBC, AESCBC: hyperv1.AESCBCKeyStatus{ - Secret: corev1.LocalObjectReference{Name: "aescbc-key-1"}, + Secret: hyperv1.SecretReference{Name: "aescbc-key-1"}, DataHash: "activehash", }, }, @@ -682,14 +668,14 @@ func TestDeriveAESCBCEncryptionConfig(t *testing.T) { ActiveKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAESCBC, AESCBC: hyperv1.AESCBCKeyStatus{ - Secret: corev1.LocalObjectReference{Name: "old-key-secret"}, + Secret: hyperv1.SecretReference{Name: "old-key-secret"}, DataHash: "oldhash", }, }, TargetKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAESCBC, AESCBC: hyperv1.AESCBCKeyStatus{ - Secret: corev1.LocalObjectReference{Name: "new-key-secret"}, + Secret: hyperv1.SecretReference{Name: "new-key-secret"}, DataHash: "newhash", }, }, @@ -742,14 +728,14 @@ func TestDeriveAESCBCEncryptionConfig(t *testing.T) { ActiveKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAESCBC, AESCBC: hyperv1.AESCBCKeyStatus{ - Secret: corev1.LocalObjectReference{Name: "old-key-secret"}, + Secret: hyperv1.SecretReference{Name: "old-key-secret"}, DataHash: "oldhash", }, }, TargetKey: hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAESCBC, AESCBC: hyperv1.AESCBCKeyStatus{ - Secret: corev1.LocalObjectReference{Name: "new-key-secret"}, + Secret: hyperv1.SecretReference{Name: "new-key-secret"}, DataHash: "newhash", }, }, diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go index df6bb99cfbce..63d2059c3e44 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go @@ -21,6 +21,7 @@ import ( appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/equality" + apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/meta" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime/schema" @@ -36,6 +37,10 @@ import ( const ( // maxHistoryEntries is the maximum number of entries kept in the rotation history. maxHistoryEntries = 5 + + requeueWaitingForKAS = 30 * time.Second + requeueMigrationProgress = 10 * time.Second + requeueMigrationFailure = 60 * time.Second ) // Reconciler watches for encryption key changes on the HCP spec and drives the @@ -71,7 +76,11 @@ func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reco } log.Info("Successfully patched HCP status") recordMigrationState(r.hcpNamespace, r.hcpName, hcp.Status.SecretEncryption) - recordMigrationDuration(r.hcpNamespace, r.hcpName, hcp.Status.SecretEncryption) + previousState := encryptionHistoryState(originalHCP.Status.SecretEncryption) + currentState := encryptionHistoryState(hcp.Status.SecretEncryption) + if currentState == hyperv1.EncryptionMigrationStateCompleted && previousState != currentState { + recordMigrationDuration(r.hcpNamespace, r.hcpName, hcp.Status.SecretEncryption) + } } return result, nil @@ -104,7 +113,7 @@ func (r *Reconciler) reconcile(ctx context.Context, log logr.Logger, hcp *hyperv // Case 2: A rotation is already in progress (targetKey is set). if hcp.Status.SecretEncryption.TargetKey.Provider != "" { - return r.handleInProgressRotation(ctx, log, hcp, specKeyStatus, specFingerprint) + return r.handleInProgressRotation(ctx, log, hcp, specFingerprint) } // Case 3: No rotation in progress and spec matches status -> steady state. @@ -117,6 +126,13 @@ func (r *Reconciler) reconcile(ctx context.Context, log logr.Logger, hcp *hyperv return r.startNewRotation(log, hcp, specKeyStatus, specFingerprint, statusActiveFingerprint) } +func encryptionHistoryState(status hyperv1.SecretEncryptionStatus) hyperv1.EncryptionMigrationState { + if len(status.History) == 0 { + return "" + } + return status.History[0].State +} + // handleEncryptionNotConfigured clears the targetKey and removes the EtcdDataEncryptionUpToDate condition. func (r *Reconciler) handleEncryptionNotConfigured(hcp *hyperv1.HostedControlPlane) (reconcile.Result, error) { hcp.Status.SecretEncryption.TargetKey = hyperv1.SecretEncryptionKeyStatus{} @@ -174,7 +190,7 @@ func (r *Reconciler) startNewRotation(log logr.Logger, hcp *hyperv1.HostedContro // handleInProgressRotation derives the current phase from observable state and acts accordingly. // It inspects the EncryptionConfiguration and KAS Deployment convergence rather than // reading history[0].state. The history state is updated for observability only. -func (r *Reconciler) handleInProgressRotation(ctx context.Context, log logr.Logger, hcp *hyperv1.HostedControlPlane, _ *hyperv1.SecretEncryptionKeyStatus, specFingerprint string) (reconcile.Result, error) { +func (r *Reconciler) handleInProgressRotation(ctx context.Context, log logr.Logger, hcp *hyperv1.HostedControlPlane, specFingerprint string) (reconcile.Result, error) { targetFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.TargetKey) if specFingerprint != targetFingerprint { @@ -219,7 +235,7 @@ func (r *Reconciler) handleInProgressRotation(ctx context.Context, log logr.Logg Message: "Waiting for new encryption key to be added to EncryptionConfiguration", ObservedGeneration: hcp.Generation, }) - return reconcile.Result{RequeueAfter: 30 * time.Second}, nil + return reconcile.Result{RequeueAfter: requeueWaitingForKAS}, nil case role == secretencryption.TargetKeyReadOnly && !converged: // Target key is read-only but KAS hasn't fully rolled out with it. @@ -232,7 +248,7 @@ func (r *Reconciler) handleInProgressRotation(ctx context.Context, log logr.Logg Message: "Waiting for KAS to converge with new encryption key in read-only mode", ObservedGeneration: hcp.Generation, }) - return reconcile.Result{RequeueAfter: 30 * time.Second}, nil + return reconcile.Result{RequeueAfter: requeueWaitingForKAS}, nil case role == secretencryption.TargetKeyReadOnly && converged: // KAS converged with target key as read-only — ready for write promotion. @@ -258,13 +274,13 @@ func (r *Reconciler) handleInProgressRotation(ctx context.Context, log logr.Logg Message: "Waiting for KAS to converge with new encryption key as write provider", ObservedGeneration: hcp.Generation, }) - return reconcile.Result{RequeueAfter: 30 * time.Second}, nil + return reconcile.Result{RequeueAfter: requeueWaitingForKAS}, nil case role == secretencryption.TargetKeyWrite && converged: // Target key is write provider and KAS converged — run migrations. log.Info("KAS converged with target key as write provider, running migrations") r.setHistoryState(hcp, hyperv1.EncryptionMigrationStateMigrating) - return r.handleMigratingPhase(ctx, log, hcp) + return r.handleMigratingPhase(log, hcp) default: return reconcile.Result{}, nil @@ -280,6 +296,9 @@ func (r *Reconciler) deriveTargetKeyRole(ctx context.Context, hcp *hyperv1.Hoste Name: manifests.KASSecretEncryptionConfigFile("").Name, } if err := r.cpClient.Get(ctx, secretKey, secret); err != nil { + if apierrors.IsNotFound(err) { + return secretencryption.TargetKeyAbsent, nil + } return secretencryption.TargetKeyAbsent, fmt.Errorf("failed to get encryption config secret: %w", err) } @@ -359,10 +378,10 @@ func (r *Reconciler) setHistoryState(hcp *hyperv1.HostedControlPlane, state hype } // handleMigratingPhase creates/monitors StorageVersionMigration CRs for each encrypted resource. -func (r *Reconciler) handleMigratingPhase(_ context.Context, log logr.Logger, hcp *hyperv1.HostedControlPlane) (reconcile.Result, error) { +func (r *Reconciler) handleMigratingPhase(log logr.Logger, hcp *hyperv1.HostedControlPlane) (reconcile.Result, error) { if !r.migrator.HasSynced() { log.Info("Migrator cache not yet synced, requeuing") - return reconcile.Result{RequeueAfter: 10 * time.Second}, nil + return reconcile.Result{RequeueAfter: requeueMigrationProgress}, nil } resources := r.encryptedResources(hcp) @@ -397,7 +416,7 @@ func (r *Reconciler) handleMigratingPhase(_ context.Context, log logr.Logger, hc ObservedGeneration: hcp.Generation, }) recordMigrationFailure(r.hcpNamespace, r.hcpName) - return reconcile.Result{RequeueAfter: 60 * time.Second}, nil + return reconcile.Result{RequeueAfter: requeueMigrationFailure}, nil } if !allFinished { @@ -409,7 +428,7 @@ func (r *Reconciler) handleMigratingPhase(_ context.Context, log logr.Logger, hc Message: "Re-encrypting etcd data with new encryption key", ObservedGeneration: hcp.Generation, }) - return reconcile.Result{RequeueAfter: 30 * time.Second}, nil + return reconcile.Result{RequeueAfter: requeueWaitingForKAS}, nil } // All migrations completed successfully. @@ -446,6 +465,9 @@ func (r *Reconciler) isKASConverged(ctx context.Context, log logr.Logger, hcp *h deployment := &appsv1.Deployment{} kasRef := manifests.KASDeployment(hcp.Namespace) if err := r.cpClient.Get(ctx, crclient.ObjectKeyFromObject(kasRef), deployment); err != nil { + if apierrors.IsNotFound(err) { + return false, nil + } return false, fmt.Errorf("failed to get KAS deployment: %w", err) } diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go index 70a3208fdbbb..577e23661c13 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go @@ -179,7 +179,7 @@ func withHistory(entries ...hyperv1.EncryptionMigrationHistory) func(*hyperv1.Ho } func aescbcKeyStatus(secretName, dataHash string) *hyperv1.SecretEncryptionKeyStatus { - return secretencryption.KeyStatusFromAESCBCSpec(corev1.LocalObjectReference{Name: secretName}, dataHash) + return secretencryption.KeyStatusFromAESCBCSpec(secretName, dataHash) } func awsKeyStatus(arn string) *hyperv1.SecretEncryptionKeyStatus { diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/setup.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/setup.go index b7d4dd5fc5ed..90df1299b84d 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/setup.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/setup.go @@ -6,6 +6,7 @@ import ( "time" hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/manifests" "github.com/openshift/hypershift/control-plane-operator/hostedclusterconfigoperator/operator" "github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators" @@ -69,24 +70,30 @@ func Setup(ctx context.Context, opts *operator.HostedClusterConfigOperatorConfig return fmt.Errorf("failed to watch HostedControlPlane: %w", err) } + hcpRequest := []reconcile.Request{{NamespacedName: types.NamespacedName{ + Namespace: opts.Namespace, + Name: opts.HCPName, + }}} + // Watch KAS Deployment in the CP cluster for convergence detection. - hcpMapper := func(_ context.Context, obj crclient.Object) []reconcile.Request { - if obj.GetNamespace() == opts.Namespace { - return []reconcile.Request{{NamespacedName: types.NamespacedName{ - Namespace: opts.Namespace, - Name: opts.HCPName, - }}} - } - return nil - } if err := c.Watch(source.Kind[crclient.Object](opts.CPCluster.GetCache(), &appsv1.Deployment{}, - handler.EnqueueRequestsFromMapFunc(hcpMapper))); err != nil { + handler.EnqueueRequestsFromMapFunc(func(_ context.Context, obj crclient.Object) []reconcile.Request { + if obj.GetNamespace() == opts.Namespace && obj.GetName() == manifests.KASDeployment("").Name { + return hcpRequest + } + return nil + }))); err != nil { return fmt.Errorf("failed to watch KAS Deployment: %w", err) } - // Watch Secrets in the CP cluster namespace (for AESCBC key changes). + // Watch the encryption config Secret in the CP cluster namespace. if err := c.Watch(source.Kind[crclient.Object](opts.CPCluster.GetCache(), &corev1.Secret{}, - handler.EnqueueRequestsFromMapFunc(hcpMapper))); err != nil { + handler.EnqueueRequestsFromMapFunc(func(_ context.Context, obj crclient.Object) []reconcile.Request { + if obj.GetNamespace() == opts.Namespace && obj.GetName() == manifests.KASSecretEncryptionConfigFile("").Name { + return hcpRequest + } + return nil + }))); err != nil { return fmt.Errorf("failed to watch Secrets: %w", err) } diff --git a/docs/content/reference/aggregated-docs.md b/docs/content/reference/aggregated-docs.md index a7ddc8cefd9d..ee9e2c5e1648 100644 --- a/docs/content/reference/aggregated-docs.md +++ b/docs/content/reference/aggregated-docs.md @@ -37066,10 +37066,10 @@ of its contents for fingerprinting.
-secret
+secret,omitzero
- -Kubernetes core/v1.LocalObjectReference + +SecretReference
-startedTime
+startedTime,omitzero
Kubernetes meta/v1.Time @@ -52182,6 +52182,7 @@ history[0] is not Completed or Interrupted.

###SecretReference { #hypershift.openshift.io/v1beta1.SecretReference }

(Appears on: +AESCBCKeyStatus, HCPEtcdBackupAzureBlob, HCPEtcdBackupS3)

diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md index 975a845d8986..a7402e60cc9f 100644 --- a/docs/content/reference/api.md +++ b/docs/content/reference/api.md @@ -1381,10 +1381,10 @@ of its contents for fingerprinting.
-secret
+secret,omitzero
- -Kubernetes core/v1.LocalObjectReference + +SecretReference
-startedTime
+startedTime,omitzero
Kubernetes meta/v1.Time @@ -16497,6 +16497,7 @@ history[0] is not Completed or Interrupted.

###SecretReference { #hypershift.openshift.io/v1beta1.SecretReference }

(Appears on: +AESCBCKeyStatus, HCPEtcdBackupAzureBlob, HCPEtcdBackupS3)

diff --git a/support/secretencryption/encryptionconfig_test.go b/support/secretencryption/encryptionconfig_test.go index 6d631f7f3ef2..5960bc6f7514 100644 --- a/support/secretencryption/encryptionconfig_test.go +++ b/support/secretencryption/encryptionconfig_test.go @@ -10,6 +10,55 @@ import ( apiserverv1 "k8s.io/apiserver/pkg/apis/apiserver/v1" ) +func TestDecodeEncryptionConfiguration(t *testing.T) { + t.Parallel() + + t.Run("When given valid YAML it should parse correctly", func(t *testing.T) { + g := NewWithT(t) + yaml := `apiVersion: apiserver.config.k8s.io/v1 +kind: EncryptionConfiguration +resources: + - resources: + - secrets + providers: + - kms: + name: my-kms + apiVersion: v2 + endpoint: unix:///tmp/kms.sock + - identity: {} +` + cfg, err := DecodeEncryptionConfiguration([]byte(yaml)) + g.Expect(err).ToNot(HaveOccurred()) + g.Expect(cfg.Resources).To(HaveLen(1)) + g.Expect(cfg.Resources[0].Providers).To(HaveLen(2)) + g.Expect(cfg.Resources[0].Providers[0].KMS.Name).To(Equal("my-kms")) + }) + + t.Run("When given empty bytes it should return an empty config", func(t *testing.T) { + g := NewWithT(t) + cfg, err := DecodeEncryptionConfiguration([]byte{}) + g.Expect(err).ToNot(HaveOccurred()) + g.Expect(cfg.Resources).To(BeEmpty()) + }) + + t.Run("When given malformed YAML it should return an error", func(t *testing.T) { + g := NewWithT(t) + _, err := DecodeEncryptionConfiguration([]byte("not: valid: yaml: {{")) + g.Expect(err).To(HaveOccurred()) + }) + + t.Run("When given YAML with wrong kind it should return an error", func(t *testing.T) { + g := NewWithT(t) + yaml := `apiVersion: v1 +kind: ConfigMap +metadata: + name: test +` + _, err := DecodeEncryptionConfiguration([]byte(yaml)) + g.Expect(err).To(HaveOccurred()) + }) +} + func kmsConfig(providers ...apiserverv1.ProviderConfiguration) *apiserverv1.EncryptionConfiguration { return &apiserverv1.EncryptionConfiguration{ Resources: []apiserverv1.ResourceConfiguration{ diff --git a/support/secretencryption/fingerprint_test.go b/support/secretencryption/fingerprint_test.go index 0ef680b9c9f9..d6c4dfc8b698 100644 --- a/support/secretencryption/fingerprint_test.go +++ b/support/secretencryption/fingerprint_test.go @@ -128,4 +128,58 @@ func TestFingerprintFromKeyStatus(t *testing.T) { } g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintAWSKMSKey(arn))) }) + + t.Run("When IBMCloud status is provided it should match spec fingerprint", func(t *testing.T) { + g := NewWithT(t) + entry := hyperv1.IBMCloudKMSKeyEntry{CRKID: "crk1", InstanceID: "inst1", KeyVersion: 1} + status := &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderIBMCloud, + IBMCloud: entry, + } + g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintIBMCloudKMSKeyList([]hyperv1.IBMCloudKMSKeyEntry{entry}))) + }) + + t.Run("When AESCBC status is provided it should match spec fingerprint", func(t *testing.T) { + g := NewWithT(t) + status := &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAESCBC, + AESCBC: hyperv1.AESCBCKeyStatus{ + Secret: hyperv1.SecretReference{Name: "my-secret"}, + DataHash: "abc123", + }, + } + g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintAESCBCKey("my-secret", "abc123"))) + }) + + t.Run("When Azure status has empty fields it should return empty string", func(t *testing.T) { + g := NewWithT(t) + status := &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + } + g.Expect(FingerprintFromKeyStatus(status)).To(BeEmpty()) + }) + + t.Run("When AWS status has empty ARN it should return empty string", func(t *testing.T) { + g := NewWithT(t) + status := &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAWS, + } + g.Expect(FingerprintFromKeyStatus(status)).To(BeEmpty()) + }) + + t.Run("When IBMCloud status has empty CRKID it should return empty string", func(t *testing.T) { + g := NewWithT(t) + status := &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderIBMCloud, + } + g.Expect(FingerprintFromKeyStatus(status)).To(BeEmpty()) + }) + + t.Run("When AESCBC status has empty data hash it should return empty string", func(t *testing.T) { + g := NewWithT(t) + status := &hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAESCBC, + } + g.Expect(FingerprintFromKeyStatus(status)).To(BeEmpty()) + }) } diff --git a/support/secretencryption/keystatus.go b/support/secretencryption/keystatus.go index d199f2eb442d..8b64bed272d9 100644 --- a/support/secretencryption/keystatus.go +++ b/support/secretencryption/keystatus.go @@ -2,8 +2,6 @@ package secretencryption import ( hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" - - corev1 "k8s.io/api/core/v1" ) // KeyStatusFromAzureSpec creates a SecretEncryptionKeyStatus from an Azure KMS key spec. @@ -35,11 +33,11 @@ func KeyStatusFromIBMCloudSpec(entries []hyperv1.IBMCloudKMSKeyEntry) *hyperv1.S } // KeyStatusFromAESCBCSpec creates a SecretEncryptionKeyStatus from an AESCBC spec. -func KeyStatusFromAESCBCSpec(secretRef corev1.LocalObjectReference, dataHash string) *hyperv1.SecretEncryptionKeyStatus { +func KeyStatusFromAESCBCSpec(secretName string, dataHash string) *hyperv1.SecretEncryptionKeyStatus { return &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAESCBC, AESCBC: hyperv1.AESCBCKeyStatus{ - Secret: secretRef, + Secret: hyperv1.SecretReference{Name: secretName}, DataHash: dataHash, }, } @@ -77,7 +75,7 @@ func KeyStatusFromSpec(spec *hyperv1.SecretEncryptionSpec, aescbcDataHash string if spec.AESCBC == nil { return nil } - return KeyStatusFromAESCBCSpec(spec.AESCBC.ActiveKey, aescbcDataHash) + return KeyStatusFromAESCBCSpec(spec.AESCBC.ActiveKey.Name, aescbcDataHash) } return nil } diff --git a/support/secretencryption/keystatus_test.go b/support/secretencryption/keystatus_test.go index 1bf58686187b..dd8ebdb8dfa1 100644 --- a/support/secretencryption/keystatus_test.go +++ b/support/secretencryption/keystatus_test.go @@ -47,6 +47,58 @@ func TestKeyStatusFromSpec(t *testing.T) { g.Expect(status.Provider).To(Equal(hyperv1.SecretEncryptionProviderAzure)) }) + t.Run("When spec is AWS KMS it should create AWS key status", func(t *testing.T) { + g := NewWithT(t) + spec := &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.KMS, + KMS: &hyperv1.KMSSpec{ + Provider: hyperv1.AWS, + AWS: &hyperv1.AWSKMSSpec{ + ActiveKey: hyperv1.AWSKMSKeyEntry{ARN: "arn:aws:kms:us-east-1:123:key/test"}, + Region: "us-east-1", + }, + }, + } + status := KeyStatusFromSpec(spec, "") + g.Expect(status).ToNot(BeNil()) + g.Expect(status.Provider).To(Equal(hyperv1.SecretEncryptionProviderAWS)) + g.Expect(status.AWS.ARN).To(Equal("arn:aws:kms:us-east-1:123:key/test")) + }) + + t.Run("When spec is IBMCloud KMS it should create IBMCloud key status from first entry", func(t *testing.T) { + g := NewWithT(t) + spec := &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.KMS, + KMS: &hyperv1.KMSSpec{ + Provider: hyperv1.IBMCloud, + IBMCloud: &hyperv1.IBMCloudKMSSpec{ + KeyList: []hyperv1.IBMCloudKMSKeyEntry{ + {CRKID: "crk1", InstanceID: "inst1", KeyVersion: 1, CorrelationID: "corr1", URL: "https://kms.example.com"}, + {CRKID: "crk2", InstanceID: "inst2", KeyVersion: 2, CorrelationID: "corr2", URL: "https://kms.example.com"}, + }, + }, + }, + } + status := KeyStatusFromSpec(spec, "") + g.Expect(status).ToNot(BeNil()) + g.Expect(status.Provider).To(Equal(hyperv1.SecretEncryptionProviderIBMCloud)) + g.Expect(status.IBMCloud.CRKID).To(Equal("crk1")) + }) + + t.Run("When spec is IBMCloud KMS with empty key list it should return nil", func(t *testing.T) { + g := NewWithT(t) + spec := &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.KMS, + KMS: &hyperv1.KMSSpec{ + Provider: hyperv1.IBMCloud, + IBMCloud: &hyperv1.IBMCloudKMSSpec{ + KeyList: []hyperv1.IBMCloudKMSKeyEntry{}, + }, + }, + } + g.Expect(KeyStatusFromSpec(spec, "")).To(BeNil()) + }) + t.Run("When spec is AESCBC it should create AESCBC key status with data hash", func(t *testing.T) { g := NewWithT(t) spec := &hyperv1.SecretEncryptionSpec{ diff --git a/test/e2e/v2/internal/workload_registry.go b/test/e2e/v2/internal/workload_registry.go index 50b14417ccca..aa09d27bc3aa 100644 --- a/test/e2e/v2/internal/workload_registry.go +++ b/test/e2e/v2/internal/workload_registry.go @@ -263,6 +263,13 @@ func GetControlPlaneWorkloads() []WorkloadSpec { "app": "kube-scheduler", }, }, + { + Type: "Deployment", + Name: "kube-storage-version-migrator", + PodSelector: map[string]string{ + "app": "kube-storage-version-migrator", + }, + }, { Type: "Deployment", Name: "machine-approver", diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go index 5521f6f7d688..a6f689d3e4d1 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/aws.go @@ -1080,7 +1080,8 @@ type AWSKMSAuthSpec struct { type AWSKMSKeyEntry struct { // arn is the Amazon Resource Name for the encryption key // +required - // +kubebuilder:validation:Pattern=`^arn:` + // +kubebuilder:validation:XValidation:rule="self.startsWith('arn:')",message="arn must start with 'arn:'" + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=2048 ARN string `json:"arn,omitempty"` } diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go index d9809f7627f0..382dd669ff95 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go @@ -890,16 +890,19 @@ type AzureKMSKey struct { // keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name // Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: // `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required KeyVaultName string `json:"keyVaultName,omitempty"` // keyName is the name of the keyvault key used for encrypt/decrypt + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required KeyName string `json:"keyName,omitempty"` // keyVersion contains the version of the key to use + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required KeyVersion string `json:"keyVersion,omitempty"` diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_conditions.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_conditions.go index 374e52a4fefc..5327a67edacc 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_conditions.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_conditions.go @@ -356,13 +356,12 @@ const ( AutoNodeProgressingReason = "AutoNodeProgressing" AutoNodeEvaluationFailedReason = "AutoNodeEvaluationFailed" - ReadOnlyRolloutInProgressReason = "ReadOnlyRolloutInProgress" - WritePromotionInProgressReason = "WritePromotionInProgress" - ReEncryptionInProgressReason = "ReEncryptionInProgress" - ReEncryptionCompletedReason = "ReEncryptionCompleted" - ReEncryptionFailedReason = "ReEncryptionFailed" - ReEncryptionWaitingForKASReason = "ReEncryptionWaitingForKASConvergence" - ReEncryptionPersistentFailureReason = "ReEncryptionPersistentFailure" + ReadOnlyRolloutInProgressReason = "ReadOnlyRolloutInProgress" + WritePromotionInProgressReason = "WritePromotionInProgress" + ReEncryptionInProgressReason = "ReEncryptionInProgress" + ReEncryptionCompletedReason = "ReEncryptionCompleted" + ReEncryptionFailedReason = "ReEncryptionFailed" + ReEncryptionWaitingForKASReason = "ReEncryptionWaitingForKASConvergence" ) // Messages. diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go index 81b9415cf087..a1da814d75d4 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go @@ -2117,7 +2117,6 @@ type SecretEncryptionStatus struct { } // SecretEncryptionKeyStatus records the active key identity using the same types as the spec. -// +k8s:deepcopy-gen=true // +kubebuilder:validation:XValidation:rule="self.provider == 'Azure' ? has(self.azure) : !has(self.azure)",message="azure is required when provider is Azure, and forbidden otherwise" // +kubebuilder:validation:XValidation:rule="self.provider == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws is required when provider is AWS, and forbidden otherwise" // +kubebuilder:validation:XValidation:rule="self.provider == 'IBMCloud' ? has(self.ibmCloud) : !has(self.ibmCloud)",message="ibmCloud is required when provider is IBMCloud, and forbidden otherwise" @@ -2149,11 +2148,10 @@ type SecretEncryptionKeyStatus struct { // AESCBCKeyStatus contains a reference to the AESCBC key secret and a SHA-256 hash // of its contents for fingerprinting. -// +k8s:deepcopy-gen=true type AESCBCKeyStatus struct { // secret is a reference to the secret containing the AESCBC key. // +required - Secret corev1.LocalObjectReference `json:"secret,omitempty"` + Secret SecretReference `json:"secret,omitzero"` // dataHash is the hex-encoded SHA-256 hash of the secret's "key" data field // at the time re-encryption completed. // +required @@ -2163,7 +2161,6 @@ type AESCBCKeyStatus struct { } // EncryptionKeyReference identifies an encryption key by its provider and fingerprint. -// +k8s:deepcopy-gen=true type EncryptionKeyReference struct { // provider identifies the encryption provider. // +required @@ -2211,7 +2208,7 @@ type EncryptionMigrationHistory struct { State EncryptionMigrationState `json:"state,omitempty"` // startedTime is when the rotation was initiated. // +required - StartedTime metav1.Time `json:"startedTime,omitempty"` + StartedTime metav1.Time `json:"startedTime,omitzero"` // completionTime is when the rotation finished. Not set while the rotation is in progress. // +optional CompletionTime metav1.Time `json:"completionTime,omitzero"` diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go index 490256c3ab65..7c06d5b46d66 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/ibmcloud.go @@ -20,19 +20,23 @@ type IBMCloudKMSSpec struct { // IBMCloudKMSKeyEntry defines metadata for an IBM Cloud KMS encryption key type IBMCloudKMSKeyEntry struct { // crkID is the customer rook key id + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required CRKID string `json:"crkID,omitempty"` // instanceID is the id for the key protect instance + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required InstanceID string `json:"instanceID,omitempty"` // correlationID is an identifier used to track all api call usage from hypershift + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required CorrelationID string `json:"correlationID,omitempty"` // url is the url to call key protect apis over - // +kubebuilder:validation:Pattern=`^https://` + // +kubebuilder:validation:XValidation:rule="self.startsWith('https://')",message="url must start with 'https://'" + // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=2048 // +required URL string `json:"url,omitempty"` @@ -41,7 +45,7 @@ type IBMCloudKMSKeyEntry struct { // +kubebuilder:validation:Minimum=0 // +kubebuilder:validation:Maximum=2147483647 // +required - KeyVersion int `json:"keyVersion,omitempty"` + KeyVersion int `json:"keyVersion"` } // IBMCloudKMSAuthSpec defines metadata for how authentication is done with IBM Cloud KMS From f7463be2c9312501857bbc0a03e8fdc8f6d04406 Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Mon, 15 Jun 2026 12:10:08 +0200 Subject: [PATCH 11/12] feat(api): prevent removal of secretEncryption once configured Add a CEL XValidation rule to HostedClusterSpec and HostedControlPlaneSpec that blocks removing spec.secretEncryption after it has been set. Without this guard, removing the field leaves encrypted etcd data unreadable since no decryption migration path exists today. Co-Authored-By: Claude Opus 4.6 (1M context) --- api/hypershift/v1beta1/hosted_controlplane.go | 1 + api/hypershift/v1beta1/hostedcluster_types.go | 1 + .../AAA_ungated.yaml | 2 + .../ClusterUpdateAcceptRisks.yaml | 2 + .../ClusterVersionOperatorConfiguration.yaml | 2 + .../ExternalOIDC.yaml | 2 + ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 2 + .../ExternalOIDCWithUpstreamParity.yaml | 2 + .../GCPPlatform.yaml | 2 + .../HCPEtcdBackup.yaml | 2 + ...perShiftOnlyDynamicResourceAllocation.yaml | 2 + .../ImageStreamImportMode.yaml | 2 + .../KMSEncryptionProvider.yaml | 2 + .../OpenStack.yaml | 2 + .../TLSAdherence.yaml | 2 + .../AAA_ungated.yaml | 2 + .../ClusterUpdateAcceptRisks.yaml | 2 + .../ClusterVersionOperatorConfiguration.yaml | 2 + .../ExternalOIDC.yaml | 2 + ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 2 + .../ExternalOIDCWithUpstreamParity.yaml | 2 + .../GCPPlatform.yaml | 2 + .../HCPEtcdBackup.yaml | 2 + ...perShiftOnlyDynamicResourceAllocation.yaml | 2 + .../ImageStreamImportMode.yaml | 2 + .../KMSEncryptionProvider.yaml | 2 + .../OpenStack.yaml | 2 + .../TLSAdherence.yaml | 2 + ...edclusters.secretencryption.testsuite.yaml | 193 ++++++++++++++++++ ...usters-Hypershift-CustomNoUpgrade.crd.yaml | 2 + ...hostedclusters-Hypershift-Default.crd.yaml | 2 + ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 2 + ...planes-Hypershift-CustomNoUpgrade.crd.yaml | 2 + ...dcontrolplanes-Hypershift-Default.crd.yaml | 2 + ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 2 + .../hypershift/v1beta1/hosted_controlplane.go | 1 + .../hypershift/v1beta1/hostedcluster_types.go | 1 + 37 files changed, 261 insertions(+) create mode 100644 cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.secretencryption.testsuite.yaml diff --git a/api/hypershift/v1beta1/hosted_controlplane.go b/api/hypershift/v1beta1/hosted_controlplane.go index 05a2fa60d220..9c4358622169 100644 --- a/api/hypershift/v1beta1/hosted_controlplane.go +++ b/api/hypershift/v1beta1/hosted_controlplane.go @@ -41,6 +41,7 @@ type HostedControlPlane struct { // HostedControlPlaneSpec defines the desired state of HostedControlPlane // +kubebuilder:validation:XValidation:rule="self.platform.type == 'IBMCloud' ? size(self.services) >= 3 : size(self.services) >= 4",message="spec.services in body should have at least 4 items or 3 for IBMCloud" // +kubebuilder:validation:XValidation:rule="!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == 'Other'",message="disableMultiNetwork can only be set to true when networkType is 'Other'" +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.secretEncryption) || has(self.secretEncryption)",message="secretEncryption cannot be removed once configured" type HostedControlPlaneSpec struct { // releaseImage is the release image applied to the hosted control plane. // +required diff --git a/api/hypershift/v1beta1/hostedcluster_types.go b/api/hypershift/v1beta1/hostedcluster_types.go index a1da814d75d4..ada1fc3d1df1 100644 --- a/api/hypershift/v1beta1/hostedcluster_types.go +++ b/api/hypershift/v1beta1/hostedcluster_types.go @@ -527,6 +527,7 @@ type Capabilities struct { // +kubebuilder:validation:XValidation:rule=`!self.services.exists(s, s.service == 'APIServer' && has(s.servicePublishingStrategy.loadBalancer) && s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration) && has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts) && has(self.configuration.apiServer.servingCerts.namedCertificates) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert, has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))`, message="APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]" // +kubebuilder:validation:XValidation:rule="!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == 'Other'",message="disableMultiNetwork can only be set to true when networkType is 'Other'" // +kubebuilder:validation:XValidation:rule="self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)", message="ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes" +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.secretEncryption) || has(self.secretEncryption)",message="secretEncryption cannot be removed once configured" type HostedClusterSpec struct { // release specifies the desired OCP release payload for all the hosted cluster components. // This includes those components running management side like the Kube API Server and the CVO but also the operands which land in the hosted cluster data plane like the ingress controller, ovn agents, etc. diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml index 693b45846202..5868cb2bec01 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml @@ -6682,6 +6682,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index cf434c88f2c7..f191832ed48d 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -6665,6 +6665,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index ce24cafdbf15..76c2969a6129 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -6685,6 +6685,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml index 2d59a7b0e49e..76708ada9b18 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml @@ -6997,6 +6997,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index e31e19357c6e..59d2ebeb4629 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -7137,6 +7137,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index e009c0d4ebfb..061a952b36fc 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -7128,6 +7128,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml index fd0faf247ee2..b09c89b5a779 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml @@ -7111,6 +7111,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml index 80cfc83a5334..8c915f24baa4 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -6730,6 +6730,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index 0f1f5e15a70b..419f0266cba9 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -6687,6 +6687,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml index ad31e4c33c7f..82d6ad0f963f 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -6683,6 +6683,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml index 9655509e7d4f..2ae37c7a4a36 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -6741,6 +6741,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml index d7aad14123c9..6110de090fd2 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml @@ -7216,6 +7216,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml index 88e2ab796063..dd55c2688903 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSAdherence.yaml @@ -6705,6 +6705,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml index c0767015e625..0bab16384194 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml @@ -6484,6 +6484,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index f4534d57809a..40c8952ad678 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -6467,6 +6467,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index ec97711d6ee2..249540bee825 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -6487,6 +6487,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml index fab83ba3783a..60cd5a3f7bc3 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml @@ -6799,6 +6799,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index 4bcb3fa44fba..212a7d343498 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -6939,6 +6939,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index d631d1a9f508..96c398373b3e 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -6930,6 +6930,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml index 384e2d21e04a..ea442dd9c244 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml @@ -6913,6 +6913,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml index bc681a8e33ea..f5f11ba67bb0 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -6532,6 +6532,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index 872b96ae31fd..945ffea31426 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -6489,6 +6489,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml index 29aa831a5f47..85772e264194 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -6485,6 +6485,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml index 2aa74cb943bb..5b8141d63269 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -6543,6 +6543,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml index ca2aa6dea3b3..596c310ec494 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml @@ -7018,6 +7018,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml index 7d9faf4ad985..e3a03394bfeb 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSAdherence.yaml @@ -6507,6 +6507,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.secretencryption.testsuite.yaml b/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.secretencryption.testsuite.yaml new file mode 100644 index 000000000000..0eb95e814528 --- /dev/null +++ b/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.secretencryption.testsuite.yaml @@ -0,0 +1,193 @@ +apiVersion: apiextensions.k8s.io/v1 +name: "HostedCluster secretEncryption validation" +crdName: hostedclusters.hypershift.openshift.io +version: v1beta1 +tests: + onUpdate: + - name: When secretEncryption is removed after being set it should fail + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + dns: + baseDomain: example.com + platform: + type: AWS + pullSecret: + name: secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64 + secretEncryption: + aescbc: + activeKey: + name: key + type: aescbc + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + dns: + baseDomain: example.com + platform: + type: AWS + pullSecret: + name: secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + expectedError: "secretEncryption cannot be removed once configured" + + - name: When secretEncryption was never set and remains unset it should pass + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + dns: + baseDomain: example.com + platform: + type: IBMCloud + pullSecret: + name: secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + dns: + baseDomain: example.com + platform: + type: IBMCloud + pullSecret: + name: secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.16.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + + - name: When secretEncryption key is rotated it should pass + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + dns: + baseDomain: example.com + platform: + type: AWS + pullSecret: + name: secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64 + secretEncryption: + aescbc: + activeKey: + name: old-key + type: aescbc + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + dns: + baseDomain: example.com + platform: + type: AWS + pullSecret: + name: secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64 + secretEncryption: + aescbc: + activeKey: + name: new-key + type: aescbc + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml index 98adb08df66b..207605f95dfd 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml @@ -8503,6 +8503,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml index 9452aa371728..ac9fd7c5bcc0 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml @@ -7174,6 +7174,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml index 7502f341bb8d..7b6fd4b646cb 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -8374,6 +8374,8 @@ spec: - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig) + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the latest observed status of the HostedCluster. properties: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml index 455243878fe1..2bac30333c3d 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml @@ -8305,6 +8305,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml index 56b37974ee7c..1880d348d7bd 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml @@ -6976,6 +6976,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml index 9aef745b3d67..92456f9161f8 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -8176,6 +8176,8 @@ spec: || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == ''Other''' + - message: secretEncryption cannot be removed once configured + rule: '!has(oldSelf.secretEncryption) || has(self.secretEncryption)' status: description: status is the status of the HostedControlPlane. properties: diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hosted_controlplane.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hosted_controlplane.go index 05a2fa60d220..9c4358622169 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hosted_controlplane.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hosted_controlplane.go @@ -41,6 +41,7 @@ type HostedControlPlane struct { // HostedControlPlaneSpec defines the desired state of HostedControlPlane // +kubebuilder:validation:XValidation:rule="self.platform.type == 'IBMCloud' ? size(self.services) >= 3 : size(self.services) >= 4",message="spec.services in body should have at least 4 items or 3 for IBMCloud" // +kubebuilder:validation:XValidation:rule="!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == 'Other'",message="disableMultiNetwork can only be set to true when networkType is 'Other'" +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.secretEncryption) || has(self.secretEncryption)",message="secretEncryption cannot be removed once configured" type HostedControlPlaneSpec struct { // releaseImage is the release image applied to the hosted control plane. // +required diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go index a1da814d75d4..ada1fc3d1df1 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/hostedcluster_types.go @@ -527,6 +527,7 @@ type Capabilities struct { // +kubebuilder:validation:XValidation:rule=`!self.services.exists(s, s.service == 'APIServer' && has(s.servicePublishingStrategy.loadBalancer) && s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration) && has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts) && has(self.configuration.apiServer.servingCerts.namedCertificates) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert, has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))`, message="APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]" // +kubebuilder:validation:XValidation:rule="!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == 'Other'",message="disableMultiNetwork can only be set to true when networkType is 'Other'" // +kubebuilder:validation:XValidation:rule="self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)", message="ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes" +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.secretEncryption) || has(self.secretEncryption)",message="secretEncryption cannot be removed once configured" type HostedClusterSpec struct { // release specifies the desired OCP release payload for all the hosted cluster components. // This includes those components running management side like the Kube API Server and the CVO but also the operands which land in the hosted cluster data plane like the ingress controller, ovn agents, etc. From adb78ff817a6f952966372c1c02a2c2583bab9a7 Mon Sep 17 00:00:00 2001 From: Mulham Raee Date: Wed, 17 Jun 2026 19:18:42 +0200 Subject: [PATCH 12/12] fix(hcco): filter oauth resources from re-encryption when OAuth is disabled On ARO with ExternalOIDC, the openshift-oauth-apiserver is not deployed, so oauth.openshift.io resources are absent from guest cluster discovery. The re-encryption controller was unconditionally including these resources from KMSEncryptedObjects(), causing migration failures. Filter out oauth.openshift.io resources when HCPOAuthEnabled returns false, and keep a safety-net skip for any remaining undiscoverable resources. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../controllers/reencryption/reencryption.go | 14 +++- .../reencryption/reencryption_test.go | 84 ++++++++++++++++++- 2 files changed, 95 insertions(+), 3 deletions(-) diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go index 63d2059c3e44..67b6363a2ae2 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go @@ -15,6 +15,7 @@ import ( "github.com/openshift/hypershift/support/config" "github.com/openshift/hypershift/support/podspec" "github.com/openshift/hypershift/support/secretencryption" + "github.com/openshift/hypershift/support/util" "github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators" @@ -394,6 +395,10 @@ func (r *Reconciler) handleMigratingPhase(log logr.Logger, hcp *hyperv1.HostedCo for _, gr := range resources { finished, result, _, err := r.migrator.EnsureMigration(gr, writeKey) if err != nil { + if strings.Contains(err.Error(), "failed to find version") { + log.Info("Skipping migration for resource not found in discovery", "resource", gr.String()) + continue + } return reconcile.Result{}, fmt.Errorf("failed to ensure migration for %s: %w", gr, err) } if !finished { @@ -507,6 +512,8 @@ func (r *Reconciler) keyStatusFromSpec(ctx context.Context, hcp *hyperv1.HostedC } // encryptedResources returns the list of GroupResources that need re-encryption. +// Resources served by API servers that are not deployed (e.g. oauth resources +// when ExternalOIDC is configured) are excluded since they have no data to migrate. func (r *Reconciler) encryptedResources(hcp *hyperv1.HostedControlPlane) []schema.GroupResource { spec := hcp.Spec.SecretEncryption if spec == nil { @@ -523,9 +530,14 @@ func (r *Reconciler) encryptedResources(hcp *hyperv1.HostedControlPlane) []schem return nil } + oauthEnabled := util.HCPOAuthEnabled(hcp) resources := make([]schema.GroupResource, 0, len(resourceStrings)) for _, rs := range resourceStrings { - resources = append(resources, parseGroupResource(rs)) + gr := parseGroupResource(rs) + if !oauthEnabled && gr.Group == "oauth.openshift.io" { + continue + } + resources = append(resources, gr) } return resources } diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go index 577e23661c13..b4ecc1adac48 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go @@ -18,6 +18,8 @@ import ( "github.com/openshift/hypershift/support/config" "github.com/openshift/hypershift/support/secretencryption" + configv1 "github.com/openshift/api/config/v1" + appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/meta" @@ -52,7 +54,8 @@ var ( // fakeMigrator implements the Migrator interface for testing. type fakeMigrator struct { - migrations map[string]*fakeMigrationState + migrations map[string]*fakeMigrationState + discoveryErrors map[schema.GroupResource]error } type fakeMigrationState struct { @@ -63,11 +66,15 @@ type fakeMigrationState struct { func newFakeMigrator() *fakeMigrator { return &fakeMigrator{ - migrations: make(map[string]*fakeMigrationState), + migrations: make(map[string]*fakeMigrationState), + discoveryErrors: make(map[schema.GroupResource]error), } } func (f *fakeMigrator) EnsureMigration(gr schema.GroupResource, writeKey string) (finished bool, result error, ts time.Time, err error) { + if discoveryErr, ok := f.discoveryErrors[gr]; ok { + return false, nil, time.Time{}, discoveryErr + } key := fmt.Sprintf("%s/%s", gr.String(), writeKey) state, exists := f.migrations[key] if !exists { @@ -160,6 +167,17 @@ func withKMSEncryption() func(*hyperv1.HostedControlPlane) { } } +func withExternalOIDC() func(*hyperv1.HostedControlPlane) { + return func(hcp *hyperv1.HostedControlPlane) { + if hcp.Spec.Configuration == nil { + hcp.Spec.Configuration = &hyperv1.ClusterConfiguration{} + } + hcp.Spec.Configuration.Authentication = &configv1.AuthenticationSpec{ + Type: configv1.AuthenticationTypeOIDC, + } + } +} + func withActiveKey(ks *hyperv1.SecretEncryptionKeyStatus) func(*hyperv1.HostedControlPlane) { return func(hcp *hyperv1.HostedControlPlane) { hcp.Status.SecretEncryption.ActiveKey = *ks.DeepCopy() @@ -818,6 +836,55 @@ func TestReconcile(t *testing.T) { g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).ToNot(BeEmpty()) }, }, + { + name: "When in Migrating phase with KMS and some resources are not discoverable it should skip them and complete", + cpObjects: func() []client.Object { + oldKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/old-key") + newKS := awsKeyStatus("arn:aws:kms:us-east-1:123456789012:key/test-key-1") + return []client.Object{ + newHCP( + withKMSEncryption(), + withActiveKey(oldKS), + withTargetKey(newKS), + withHistory(hyperv1.EncryptionMigrationHistory{ + From: secretencryption.KeyReferenceFromStatus(oldKS), + To: secretencryption.KeyReferenceFromStatus(newKS), + State: hyperv1.EncryptionMigrationStateMigrating, + StartedTime: metav1.Time{Time: fixedTime}, + }), + ), + convergedKASDeployment(testNamespace), + encryptionConfigSecret(testNamespace, hyperv1.KMS, + awsProviderKeyName("arn:aws:kms:us-east-1:123456789012:key/test-key-1"), + awsProviderKeyName("arn:aws:kms:us-east-1:123456789012:key/old-key")), + } + }(), + migrator: func() *fakeMigrator { + m := newFakeMigrator() + fp := secretencryption.FingerprintAWSKMSKey("arn:aws:kms:us-east-1:123456789012:key/test-key-1") + writeKey := fmt.Sprintf("encryption-key-%s", fp) + // Complete discoverable resources. + m.completeMigration(schema.GroupResource{Resource: "secrets"}, writeKey) + m.completeMigration(schema.GroupResource{Resource: "configmaps"}, writeKey) + m.completeMigration(schema.GroupResource{Resource: "routes", Group: "route.openshift.io"}, writeKey) + // Simulate discovery failure for oauth resources (not served or not discoverable). + m.discoveryErrors[schema.GroupResource{Resource: "oauthaccesstokens", Group: "oauth.openshift.io"}] = + fmt.Errorf("failed to find version for oauthaccesstokens.oauth.openshift.io, discoveryErr=") + m.discoveryErrors[schema.GroupResource{Resource: "oauthauthorizetokens", Group: "oauth.openshift.io"}] = + fmt.Errorf("failed to find version for oauthauthorizetokens.oauth.openshift.io, discoveryErr=") + return m + }, + validate: func(t *testing.T, g Gomega, cl client.Client, _ *fakeMigrator) { + hcp := getHCP(context.Background(), g, cl) + g.Expect(hcp.Status.SecretEncryption.TargetKey.Provider).To(BeEmpty()) + g.Expect(hcp.Status.SecretEncryption.ActiveKey.Provider).To(Equal(hyperv1.SecretEncryptionProviderAWS)) + g.Expect(hcp.Status.SecretEncryption.History[0].State).To(Equal(hyperv1.EncryptionMigrationStateCompleted)) + + cond := meta.FindStatusCondition(hcp.Status.Conditions, string(hyperv1.EtcdDataEncryptionUpToDate)) + g.Expect(cond).ToNot(BeNil()) + g.Expect(cond.Status).To(Equal(metav1.ConditionTrue)) + }, + }, } for _, tt := range tests { @@ -947,6 +1014,19 @@ func TestEncryptedResources(t *testing.T) { g.Expect(resources).To(ContainElement(schema.GroupResource{Group: "oauth.openshift.io", Resource: "oauthauthorizetokens"})) }) + t.Run("When encryption type is KMS and OAuth is disabled it should exclude oauth resources", func(t *testing.T) { + g := NewWithT(t) + r := &Reconciler{} + hcp := newHCP(withKMSEncryption(), withExternalOIDC()) + resources := r.encryptedResources(hcp) + g.Expect(resources).To(HaveLen(3)) + g.Expect(resources).To(ContainElement(schema.GroupResource{Resource: "secrets"})) + g.Expect(resources).To(ContainElement(schema.GroupResource{Resource: "configmaps"})) + g.Expect(resources).To(ContainElement(schema.GroupResource{Group: "route.openshift.io", Resource: "routes"})) + g.Expect(resources).NotTo(ContainElement(schema.GroupResource{Group: "oauth.openshift.io", Resource: "oauthaccesstokens"})) + g.Expect(resources).NotTo(ContainElement(schema.GroupResource{Group: "oauth.openshift.io", Resource: "oauthauthorizetokens"})) + }) + t.Run("When encryption is not configured it should return nil", func(t *testing.T) { g := NewWithT(t) r := &Reconciler{}