Skip to content

Commit a551a9d

Browse files
aramasearamase
committed
feat: add byok support and refactor
1 parent feecc9d commit a551a9d

21 files changed

+1198
-1373
lines changed

‎.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,6 @@ azure.json
2323

2424
# OSX trash
2525
.DS_Store
26+
27+
.idea/
28+
_output/

‎.pipelines/unit-tests-template.yml

+5-4
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,18 @@ jobs:
66
clean: all
77
variables:
88
- group: kubernetes-kms
9-
- name: GOPATH
10-
value: '$(system.defaultWorkingDirectory)/gopath'
119

1210
steps:
1311
- task: GoTool@0
1412
inputs:
15-
version: 1.14.2
13+
version: 1.15
1614
- script: V=1 make build
1715
displayName: Build
1816
- script: make unit-test
1917
displayName: Run unit tests
18+
- script: |
19+
sudo ./_output/kubernetes-kms --version
20+
displayName: Check binary version
2021
- script: |
2122
sudo mkdir /etc/kubernetes
2223
echo -e '{\n "tenantId": "'$TENANT_ID'",\n "subscriptionId": "'$SUBSCRIPTION_ID'",\n "aadClientId": "'$CLIENT_ID'",\n "aadClientSecret": "'$CLIENT_SECRET'",\n "resourceGroup": "'$KV_RESOURCE_GROUP'",\n "location": "'$AZURE_LOCATION'",\n "providerVaultName": "'$KV_NAME'",\n "providerKeyName": "'$KV_KEY'",\n "providerKeyVersion": "'$KV_KEY_VERSION'"\n}' | sudo tee --append /etc/kubernetes/azure.json > /dev/null
@@ -25,7 +26,7 @@ jobs:
2526
CLIENT_ID: $(AZURE_CLIENT_ID)
2627
CLIENT_SECRET: $(AZURE_CLIENT_SECRET)
2728
- script: |
28-
sudo ./kubernetes-kms > /dev/null &
29+
sudo ./_output/kubernetes-kms --keyvault-name $KV_NAME --key-name $KV_KEY --key-version $KV_KEY_VERSION --listen-addr "unix:///opt/azurekms.sock" > /dev/null &
2930
echo Waiting 2 seconds for the server to start
3031
sleep 2
3132
make integration-test

‎Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
FROM alpine:3.5
22
WORKDIR /bin
33

4-
ADD ./kubernetes-kms /bin/k8s-azure-kms
4+
ADD _output/kubernetes-kms /bin/k8s-azure-kms
55

66
CMD ["./k8s-azure-kms"]

‎Makefile

+18-25
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,19 @@
1-
binary := kubernetes-kms
1+
ORG_PATH=github.com/Azure
2+
PROJECT_NAME := kubernetes-kms
3+
REPO_PATH="$(ORG_PATH)/$(PROJECT_NAME)"
24
REGISTRY_NAME ?= upstreamk8sci
35
REGISTRY ?= $(REGISTRY_NAME).azurecr.io
46
REPO_PREFIX ?= k8s/kms
5-
DOCKER_IMAGE := $(REGISTRY)/$(REPO_PREFIX)/keyvault
6-
VERSION ?= v0.0.9
7+
DOCKER_IMAGE ?= $(REGISTRY)/$(REPO_PREFIX)/keyvault
8+
IMAGE_VERSION ?= v0.0.9
79
CGO_ENABLED_FLAG := 0
810

11+
BUILD_VERSION_VAR := $(REPO_PATH)/pkg/version.BuildVersion
12+
BUILD_DATE_VAR := $(REPO_PATH)/pkg/version.BuildDate
13+
BUILD_DATE := $$(date +%Y-%m-%d-%H:%M)
14+
GIT_VAR := $(REPO_PATH)/pkg/version.GitCommit
15+
GIT_HASH := $$(git rev-parse --short HEAD)
16+
917
ifeq ($(OS),Windows_NT)
1018
GOOS_FLAG = windows
1119
else
@@ -18,33 +26,25 @@ else
1826
endif
1927
endif
2028

29+
GO_BUILD_OPTIONS := --tags "netgo osusergo" -ldflags "-s -X $(BUILD_VERSION_VAR)=$(IMAGE_VERSION) -X $(GIT_VAR)=$(GIT_HASH) -X $(BUILD_DATE_VAR)=$(BUILD_DATE) -extldflags '-static'"
30+
2131
.PHONY: build
2232
build: authors
2333
@echo "Building..."
24-
$Q GOOS=${GOOS_FLAG} CGO_ENABLED=${CGO_ENABLED_FLAG} go build .
34+
$Q GOOS=${GOOS_FLAG} CGO_ENABLED=${CGO_ENABLED_FLAG} go build $(GO_BUILD_OPTIONS) -o _output/kubernetes-kms ./cmd/server/
2535

26-
build-image: authors deps
27-
@echo "Building..."
28-
$Q GOOS=linux CGO_ENABLED=${CGO_ENABLED_FLAG} go build .
36+
build-image: authors build
2937
@echo "Building docker image..."
30-
$Q docker build -t $(DOCKER_IMAGE):$(VERSION) .
38+
$Q docker build -t $(DOCKER_IMAGE):$(IMAGE_VERSION) .
3139

3240
push: build-image
33-
$Q docker push $(DOCKER_IMAGE):$(VERSION)
41+
$Q docker push $(DOCKER_IMAGE):$(IMAGE_VERSION)
3442

3543
.PHONY: clean deps unit-test integration-test
3644

37-
deps: setup
38-
@echo "Ensuring Dependencies..."
39-
$Q go env
40-
4145
clean:
4246
@echo "Clean..."
43-
$Q rm -rf $(binary)
44-
45-
setup: clean
46-
@echo "Setup..."
47-
go get -u github.com/golang/dep/cmd/dep
47+
$Q rm -rf _output/
4848

4949
authors:
5050
$Q git log --all --format='%aN <%cE>' | sort -u | sed -n '/github/!p' > GITAUTHORS
@@ -59,14 +59,7 @@ integration-test:
5959

6060
unit-test:
6161
@echo "Running Unit Tests..."
62-
ifndef CI
63-
@echo "Running Unit Tests outside CI..."
64-
$Q go env
6562
go test -race -v -count=1 `go list ./... | grep -v client`
66-
else
67-
@echo "Running Unit Tests inside CI..."
68-
go test -race $(shell go list ./... | grep -v /test/e2e) -v
69-
endif
7063

7164
.PHONY: mod
7265
mod:

‎cmd/server/main.go

+105
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
// Copyright (c) Microsoft and contributors. All rights reserved.
2+
//
3+
// This source code is licensed under the MIT license found in the
4+
// LICENSE file in the root directory of this source tree.
5+
6+
package main
7+
8+
import (
9+
"context"
10+
"flag"
11+
"net"
12+
"os"
13+
"os/signal"
14+
"syscall"
15+
16+
"github.com/Azure/kubernetes-kms/pkg/plugin"
17+
"github.com/Azure/kubernetes-kms/pkg/utils"
18+
"github.com/Azure/kubernetes-kms/pkg/version"
19+
20+
kvmgmt "github.com/Azure/azure-sdk-for-go/services/keyvault/mgmt/2016-10-01/keyvault"
21+
"google.golang.org/grpc"
22+
pb "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1"
23+
json "k8s.io/component-base/logs/json"
24+
"k8s.io/klog/v2"
25+
)
26+
27+
var (
28+
listenAddr = flag.String("listen-addr", "unix:///tmp/azurekms.sock", "gRPC listen address")
29+
keyvaultName = flag.String("keyvault-name", "", "Azure Key Vault name")
30+
keyName = flag.String("key-name", "", "Azure Key Vault KMS key name")
31+
keyVersion = flag.String("key-version", "", "Azure Key Vault KMS key version")
32+
keyvaultSKU = flag.String("keyvault-sku", string(kvmgmt.Standard), "Azure Key Vault SKU")
33+
logFormatJSON = flag.Bool("log-format-json", false, "set log formatter to json")
34+
// TODO change this to follow the hyphen format. DEPRECATE this flag and introduce the new flag
35+
configFilePath = flag.String("configFilePath", "/etc/kubernetes/azure.json", "Path for Azure Cloud Provider config file")
36+
versionInfo = flag.Bool("version", false, "Prints the version information")
37+
)
38+
39+
func main() {
40+
klog.InitFlags(nil)
41+
defer klog.Flush()
42+
43+
flag.Parse()
44+
45+
if *logFormatJSON {
46+
klog.SetLogger(json.JSONLogger)
47+
}
48+
49+
if *versionInfo {
50+
version.PrintVersion()
51+
os.Exit(0)
52+
}
53+
54+
ctx := withShutdownSignal(context.Background())
55+
56+
klog.InfoS("Starting KeyManagementServiceServer service", "version", version.BuildVersion, "buildDate", version.BuildDate)
57+
kmsServer, err := plugin.New(ctx, *configFilePath, *keyvaultName, *keyName, *keyVersion, *keyvaultSKU)
58+
if err != nil {
59+
klog.Fatalf("failed to create server, error: %v", err)
60+
}
61+
62+
// Initialize and run the GRPC server
63+
proto, addr, err := utils.ParseEndpoint(*listenAddr)
64+
if err != nil {
65+
klog.Fatalf("failed to parse endpoint, err: %+v", err)
66+
}
67+
if err := os.Remove(addr); err != nil && !os.IsNotExist(err) {
68+
klog.Fatalf("failed to remove %s, error: %s", addr, err.Error())
69+
}
70+
71+
listener, err := net.Listen(proto, addr)
72+
if err != nil {
73+
klog.Fatalf("failed to listen: %v", err)
74+
}
75+
opts := []grpc.ServerOption{
76+
grpc.UnaryInterceptor(utils.LogGRPC),
77+
}
78+
79+
s := grpc.NewServer(opts...)
80+
pb.RegisterKeyManagementServiceServer(s, kmsServer)
81+
82+
klog.Infof("Listening for connections on address: %v", listener.Addr())
83+
go s.Serve(listener)
84+
85+
<-ctx.Done()
86+
// gracefully stop the grpc server
87+
klog.Infof("terminating the server")
88+
s.GracefulStop()
89+
}
90+
91+
// withShutdownSignal returns a copy of the parent context that will close if
92+
// the process receives termination signals.
93+
func withShutdownSignal(ctx context.Context) context.Context {
94+
signalChan := make(chan os.Signal, 1)
95+
signal.Notify(signalChan, syscall.SIGTERM, syscall.SIGINT, os.Interrupt)
96+
97+
nctx, cancel := context.WithCancel(ctx)
98+
99+
go func() {
100+
<-signalChan
101+
klog.Info("received shutdown signal")
102+
cancel()
103+
}()
104+
return nctx
105+
}

‎go.mod

+16-20
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,22 @@
11
module github.com/Azure/kubernetes-kms
22

3-
go 1.14
3+
go 1.15
44

55
require (
6-
github.com/Azure/azure-sdk-for-go v11.3.0-beta+incompatible
7-
github.com/Azure/go-autorest v10.15.5+incompatible
8-
github.com/dgrijalva/jwt-go v3.1.0+incompatible // indirect
9-
github.com/dnaeon/go-vcr v1.0.1 // indirect
10-
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
11-
github.com/golang/mock v1.1.1
12-
github.com/golang/protobuf v1.0.0
13-
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
6+
github.com/Azure/azure-sdk-for-go v48.2.0+incompatible
7+
github.com/Azure/go-autorest/autorest v0.9.6
8+
github.com/Azure/go-autorest/autorest/adal v0.8.2
9+
github.com/Azure/go-autorest/autorest/to v0.4.0
10+
github.com/Azure/go-autorest/autorest/validation v0.3.0 // indirect
11+
github.com/dnaeon/go-vcr v1.1.0 // indirect
12+
github.com/golang/mock v1.3.1
13+
github.com/golang/protobuf v1.4.2
1414
github.com/satori/go.uuid v1.2.0 // indirect
15-
github.com/satori/uuid v1.2.0 // indirect
16-
github.com/stretchr/testify v1.6.1 // indirect
17-
golang.org/x/crypto v0.0.0-20180211211603-9de5f2eaf759
18-
golang.org/x/net v0.0.0-20180208041118-f5dfe339be1d
19-
golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 // indirect
20-
golang.org/x/sys v0.0.0-20180202135801-37707fdb30a5
21-
golang.org/x/text v0.3.1-0.20180208041248-4e4a3210bb54 // indirect
22-
google.golang.org/genproto v0.0.0-20180206005123-2b5a72b8730b // indirect
23-
google.golang.org/grpc v1.9.2
24-
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
25-
gopkg.in/yaml.v2 v2.3.0 // indirect
15+
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
16+
golang.org/x/net v0.0.0-20200707034311-ab3426394381
17+
google.golang.org/grpc v1.27.0
18+
gopkg.in/yaml.v2 v2.3.0
19+
k8s.io/apiserver v0.19.4
20+
k8s.io/component-base v0.19.4
21+
k8s.io/klog/v2 v2.2.0
2622
)

0 commit comments

Comments
 (0)