1/*
2Copyright 2017 The Kubernetes Authors.
3
4Licensed under the Apache License, Version 2.0 (the "License");
5you may not use this file except in compliance with the License.
6You may obtain a copy of the License at
7
8    http://www.apache.org/licenses/LICENSE-2.0
9
10Unless required by applicable law or agreed to in writing, software
11distributed under the License is distributed on an "AS IS" BASIS,
12WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13See the License for the specific language governing permissions and
14limitations under the License.
15*/
16
17package v1
18
19import (
20	"fmt"
21
22	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23)
24
25// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
26
27// EncryptionConfiguration stores the complete configuration for encryption providers.
28type EncryptionConfiguration struct {
29	metav1.TypeMeta
30	// resources is a list containing resources, and their corresponding encryption providers.
31	Resources []ResourceConfiguration `json:"resources"`
32}
33
34// ResourceConfiguration stores per resource configuration.
35type ResourceConfiguration struct {
36	// resources is a list of kubernetes resources which have to be encrypted.
37	Resources []string `json:"resources"`
38	// providers is a list of transformers to be used for reading and writing the resources to disk.
39	// eg: aesgcm, aescbc, secretbox, identity.
40	Providers []ProviderConfiguration `json:"providers"`
41}
42
43// ProviderConfiguration stores the provided configuration for an encryption provider.
44type ProviderConfiguration struct {
45	// aesgcm is the configuration for the AES-GCM transformer.
46	AESGCM *AESConfiguration `json:"aesgcm,omitempty"`
47	// aescbc is the configuration for the AES-CBC transformer.
48	AESCBC *AESConfiguration `json:"aescbc,omitempty"`
49	// secretbox is the configuration for the Secretbox based transformer.
50	Secretbox *SecretboxConfiguration `json:"secretbox,omitempty"`
51	// identity is the (empty) configuration for the identity transformer.
52	Identity *IdentityConfiguration `json:"identity,omitempty"`
53	// kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.
54	KMS *KMSConfiguration `json:"kms,omitempty"`
55}
56
57// AESConfiguration contains the API configuration for an AES transformer.
58type AESConfiguration struct {
59	// keys is a list of keys to be used for creating the AES transformer.
60	// Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.
61	Keys []Key `json:"keys"`
62}
63
64// SecretboxConfiguration contains the API configuration for an Secretbox transformer.
65type SecretboxConfiguration struct {
66	// keys is a list of keys to be used for creating the Secretbox transformer.
67	// Each key has to be 32 bytes long.
68	Keys []Key `json:"keys"`
69}
70
71// Key contains name and secret of the provided key for a transformer.
72type Key struct {
73	// name is the name of the key to be used while storing data to disk.
74	Name string `json:"name"`
75	// secret is the actual key, encoded in base64.
76	Secret string `json:"secret"`
77}
78
79// String implements Stringer interface in a log safe way.
80func (k Key) String() string {
81	return fmt.Sprintf("Name: %s, Secret: [REDACTED]", k.Name)
82}
83
84// IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.
85type IdentityConfiguration struct{}
86
87// KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.
88type KMSConfiguration struct {
89	// name is the name of the KMS plugin to be used.
90	Name string `json:"name"`
91	// cachesize is the maximum number of secrets which are cached in memory. The default value is 1000.
92	// Set to a negative value to disable caching.
93	// +optional
94	CacheSize *int32 `json:"cachesize,omitempty"`
95	// endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".
96	Endpoint string `json:"endpoint"`
97	// timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.
98	// +optional
99	Timeout *metav1.Duration `json:"timeout,omitempty"`
100}
101