Skip to content

Bug 1738354: pkg/asset/machines/aws/machines: Request encrypted root volumes #2160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wking wants to merge 2 commits into from
Closed

Bug 1738354: pkg/asset/machines/aws/machines: Request encrypted root volumes #2160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
82ecfef
pkg/asset/machines/aws/machines: Request encrypted root volumes
wking Aug 5, 2019
58c6413
data: Docs for encrypted volumes for compute machines
wking Aug 5, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion data/data/aws/variables-aws.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ variable "aws_master_instance_type" {

variable "aws_ami" {
type = string
description = "AMI for all nodes. An encrypted copy of this AMI will be used. Example: `ami-foobar123`."
description = "AMI for all nodes. Example: `ami-foobar123`."
}

variable "aws_extra_tags" {
Expand Down
6 changes: 1 addition & 5 deletions docs/user/aws/install.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,12 +49,9 @@ In EC2, there will be 6 running instances:

![EC2 instances after install](images/install_nodes.png)

The installation creates an encrypted AMI for the bootstrap and control-plane machines.
The encrypted AMI is [copied][encrypted-copy] from the AMI configured in the control-plane machine-API provider spec,
which is RHCOS by default.
Instance root volumes for the bootstrap and contro-plane machines are encrypted.
The encryption uses the default EBS key for your target account and region
(`aws kms describe-key --key-id alias/aws/ebs`).
The encrypted AMI is deregistered by `destroy cluster`.

An architecture diagram for the AWS elements created by the full installation is as depicted:

Expand All @@ -69,4 +66,3 @@ The OpenShift console is available via the kubeadmin login provided by the insta
![OpenShift web console](images/install_console.png)

[cloud-install]: https://cloud.openshift.com/clusters/install
[encrypted-copy]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIEncryption.html#create-ami-encrypted-root-snapshot
1 change: 1 addition & 0 deletions pkg/asset/machines/aws/machines.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ func provider(clusterID string, platform *aws.Platform, mpool *aws.MachinePool,
VolumeType: pointer.StringPtr(mpool.Type),
VolumeSize: pointer.Int64Ptr(int64(mpool.Size)),
Iops: pointer.Int64Ptr(int64(mpool.IOPS)),
Encrypted: pointer.BoolPtr(true),
},
},
},
Expand Down