Skip to content

Expose kms timeout value via encryption config.#72540

Merged
k8s-ci-robot merged 2 commits intokubernetes:masterfrom
immutableT:expose-kms-timeout-in-config-v2
Jan 9, 2019
Merged

Expose kms timeout value via encryption config.#72540
k8s-ci-robot merged 2 commits intokubernetes:masterfrom
immutableT:expose-kms-timeout-in-config-v2

Conversation

@immutableT
Copy link
Copy Markdown
Contributor

@immutableT immutableT commented Jan 3, 2019

What type of PR is this?

/kind feature
What this PR does / why we need it:
Expose, via EncryptionConfiguration, the timeout value that kube-apiserver will use when awaiting responses from kms-plugin.

This is a followup to 68585, were a timeout was added to calls from kube-apiserver to kms-plugin. This PR exposes the value of the timeout via EncryptionConfiguration. Providing the appropriate value of the timeout should be left to cluster managers who are familiar with the environment in which the cluster and the plugin operate. For example, KMS rooted in in a hardware device like (HSM/TPM) may have fairly long delays (seconds), while in memory KMS implementations would have timeouts in the range of milliseconds.
Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

kube-apiserver: When configuring integration with external KMS Providers, users  can supply timeout value (i.e. how long should kube-apiserver wait before giving up on a call to KMS).  (@immutableT )

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 3, 2019
@k8s-ci-robot k8s-ci-robot added area/apiserver kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. and removed needs-kind Indicates a PR lacks a `kind/foo` label and requires one. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jan 3, 2019
@immutableT
Copy link
Copy Markdown
Contributor Author

/assign @liggitt

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

document the default if unspecified

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

document the default if unspecified

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be *metav1.Duration so we can tell the difference between "0" and unspecified

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be +optional and omitempty, right?

@immutableT
Copy link
Copy Markdown
Contributor Author

@liggitt PTAL.

@immutableT
Copy link
Copy Markdown
Contributor Author

/test pull-kubernetes-verify

@liggitt
Copy link
Copy Markdown
Member

liggitt commented Jan 4, 2019

The failure is legitimate. The generated files need to be regenerated and checked in

@immutableT
Copy link
Copy Markdown
Contributor Author

/test pull-kubernetes-e2e-kops-aws

@immutableT
Copy link
Copy Markdown
Contributor Author

thanks @liggitt

@liggitt
Copy link
Copy Markdown
Member

liggitt commented Jan 4, 2019

one comment on validation, then squash, lgtm otherwise

@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 4, 2019
@immutableT immutableT force-pushed the expose-kms-timeout-in-config-v2 branch from f6bf95a to a4dc53c Compare January 4, 2019 20:54

timeout := kmsPluginConnectionTimeout
if provider.KMS.Timeout != nil {
if provider.KMS.Timeout.Duration < 0 {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what does a zero timeout do?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liggitt good catch - zero seems to make gRPC calls to kms-plugin fail no matter what - even when plugin is up and running before kube-apiserver makes its first call.
Based on that, changed the validation logic to prohibit zero.
Added unit test to cover timeout test cases; let me know if I should put them on a separate PR.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liggitt PTAL.

@immutableT
Copy link
Copy Markdown
Contributor Author

/test pull-kubernetes-e2e-gce-device-plugin-gpu
/test pull-kubernetes-kubemark-e2e-gce-big

@immutableT
Copy link
Copy Markdown
Contributor Author

/test pull-kubernetes-integration

@immutableT immutableT force-pushed the expose-kms-timeout-in-config-v2 branch from a2c1836 to d1bf08d Compare January 5, 2019 07:05
add unit test to cover timeout behaviour.
@immutableT immutableT force-pushed the expose-kms-timeout-in-config-v2 branch from d1bf08d to 39aca56 Compare January 5, 2019 08:51
@liggitt
Copy link
Copy Markdown
Member

liggitt commented Jan 9, 2019

/lgtm
/approve

please detail the config field in the release note and open a doc PR to update the encryption docs for 1.14

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 9, 2019
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: immutableT, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 9, 2019
@fejta-bot
Copy link
Copy Markdown

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

1 similar comment
@fejta-bot
Copy link
Copy Markdown

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

@k8s-ci-robot k8s-ci-robot merged commit 15521d0 into kubernetes:master Jan 9, 2019
@immutableT
Copy link
Copy Markdown
Contributor Author

Documentation PR 12158 submitted.
kubernetes/website#12158

@rtheis
Copy link
Copy Markdown

rtheis commented Mar 18, 2019

@liggitt is this something that could be cherry-picked to 1.13?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants