Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security: tikv encryption kms config #2151

Merged
merged 7 commits into from
Apr 13, 2020
Merged

security: tikv encryption kms config #2151

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
54ecca3
security: tikv encryption kms config
shuijing198799 Apr 10, 2020
57e4f1e
fix doc
shuijing198799 Apr 10, 2020
4146409
fix tiny
shuijing198799 Apr 10, 2020
53dc3b6
fix tiny
shuijing198799 Apr 10, 2020
e449837
fix tiny
shuijing198799 Apr 13, 2020
b960ede
address comment
shuijing198799 Apr 13, 2020
904fd18
Merge branch 'master' into yinliang/add-tikv-encryption-config
sre-bot Apr 13, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
261 changes: 261 additions & 0 deletions docs/api-references/docs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4250,6 +4250,117 @@ uint32
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.MasterKeyFileConfig">MasterKeyFileConfig
</h3>
<p>
(<em>Appears on:</em>
<a href="#pingcap.com/v1alpha1.TiKVMasterKeyConfig">TiKVMasterKeyConfig</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>method</code></br>
<em>
string
</em>
</td>
<td>
<p>Encrypyion method, use master key encryption data key
Possible values: plaintext, aes128-ctr, aes192-ctr, aes256-ctr
Optional: Default to plaintext
optional</p>
</td>
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.MasterKeyKMSConfig">MasterKeyKMSConfig
</h3>
<p>
(<em>Appears on:</em>
<a href="#pingcap.com/v1alpha1.TiKVMasterKeyConfig">TiKVMasterKeyConfig</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>key-id</code></br>
<em>
string
</em>
</td>
<td>
<p>AWS CMK key-id it can be find in AWS Console or use aws cli
This field is required</p>
</td>
</tr>
<tr>
<td>
<code>access-key</code></br>
<em>
string
</em>
</td>
<td>
<p>AccessKey of AWS user, leave empty if using other authrization method
optional</p>
</td>
</tr>
<tr>
<td>
<code>secret-access-key</code></br>
<em>
string
</em>
</td>
<td>
<p>SecretKey of AWS user, leave empty if using other authrization method
optional</p>
</td>
</tr>
<tr>
<td>
<code>region</code></br>
<em>
string
</em>
</td>
<td>
<p>Region of this KMS key
Optional: Default to us-east-1
optional</p>
</td>
</tr>
<tr>
<td>
<code>endpoint</code></br>
<em>
string
</em>
</td>
<td>
<p>Used for KMS compatible KMS, such as Ceph, minio, If use AWS, leave empty
optional</p>
</td>
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.MemberPhase">MemberPhase
(<code>string</code> alias)</p></h3>
<p>
Expand Down Expand Up @@ -10358,6 +10469,19 @@ TiKVSecurityConfig
<em>(Optional)</em>
</td>
</tr>
<tr>
<td>
<code>encryption</code></br>
<em>
<a href="#pingcap.com/v1alpha1.TiKVEncryptionConfig">
TiKVEncryptionConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
</td>
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.TiKVCoprocessorConfig">TiKVCoprocessorConfig
Expand Down Expand Up @@ -10929,6 +11053,78 @@ TiKVTitanDBConfig
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.TiKVEncryptionConfig">TiKVEncryptionConfig
</h3>
<p>
(<em>Appears on:</em>
<a href="#pingcap.com/v1alpha1.TiKVConfig">TiKVConfig</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>method</code></br>
<em>
string
</em>
</td>
<td>
<p>Encrypyion method, use data key encryption raw rocksdb data
Possible values: plaintext, aes128-ctr, aes192-ctr, aes256-ctr
Optional: Default to plaintext
optional</p>
</td>
</tr>
<tr>
<td>
<code>data-key-rotation-period</code></br>
<em>
string
</em>
</td>
<td>
<p>The frequency of datakey rotation, It managered by tikv
Optional: default to 7d
optional</p>
</td>
</tr>
<tr>
<td>
<code>master-key</code></br>
<em>
<a href="#pingcap.com/v1alpha1.TiKVMasterKeyConfig">
TiKVMasterKeyConfig
</a>
</em>
</td>
<td>
<p>Master key config</p>
</td>
</tr>
<tr>
<td>
<code>previous-master-key</code></br>
<em>
<a href="#pingcap.com/v1alpha1.TiKVMasterKeyConfig">
TiKVMasterKeyConfig
</a>
</em>
</td>
<td>
<p>Previous master key config
It used in master key rotation, the data key should decryption by previous master key and then encrypytion by new master key</p>
</td>
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.TiKVFailureStore">TiKVFailureStore
</h3>
<p>
Expand Down Expand Up @@ -11140,6 +11336,71 @@ string
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.TiKVMasterKeyConfig">TiKVMasterKeyConfig
</h3>
<p>
(<em>Appears on:</em>
<a href="#pingcap.com/v1alpha1.TiKVEncryptionConfig">TiKVEncryptionConfig</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
string
</em>
</td>
<td>
<p>Use KMS encryption or use file encryption, possible values: kms, file
If set to kms, kms MasterKeyKMSConfig should be filled, if set to file MasterKeyFileConfig should be filled
optional</p>
</td>
</tr>
<tr>
<td>
<code>MasterKeyFileConfig</code></br>
<em>
<a href="#pingcap.com/v1alpha1.MasterKeyFileConfig">
MasterKeyFileConfig
</a>
</em>
</td>
<td>
<p>
(Members of <code>MasterKeyFileConfig</code> are embedded into this type.)
</p>
<p>Master key file config
If the type set to file, this config should be filled</p>
</td>
</tr>
<tr>
<td>
<code>MasterKeyKMSConfig</code></br>
<em>
<a href="#pingcap.com/v1alpha1.MasterKeyKMSConfig">
MasterKeyKMSConfig
</a>
</em>
</td>
<td>
<p>
(Members of <code>MasterKeyKMSConfig</code> are embedded into this type.)
</p>
<p>Master key KMS config
If the type set to kms, this config should be filled</p>
</td>
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.TiKVPDConfig">TiKVPDConfig
</h3>
<p>
Expand Down
1 change: 1 addition & 0 deletions manifests/crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6117,6 +6117,7 @@ spec:
to false optional'
type: boolean
type: object
encryption: {}
gc:
properties:
"\tbatch-keys":
Expand Down
7 changes: 6 additions & 1 deletion pkg/apis/pingcap/v1alpha1/openapi_generated.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

71 changes: 71 additions & 0 deletions pkg/apis/pingcap/v1alpha1/tikv_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,8 @@ type TiKVConfig struct {
PD *TiKVPDConfig `json:"pd,omitempty" toml:"pd,omitempty"`
// +optional
Security *TiKVSecurityConfig `json:"security,omitempty" toml:"security,omitempty"`
// +optional
Encryption *TiKVEncryptionConfig `json:"encryption,omitempty" toml:"encryption,omitempty"`
}

// +k8s:openapi-gen=true
Expand Down Expand Up @@ -742,3 +744,72 @@ type TiKVCoprocessorConfig struct {
// optional
RegionSplitKeys *int64 `json:"region-split-keys,omitempty" toml:"region-split-keys,omitempty"`
}

type TiKVEncryptionConfig struct {
shuijing198799 marked this conversation as resolved.
Show resolved Hide resolved
// Encrypyion method, use data key encryption raw rocksdb data
// Possible values: plaintext, aes128-ctr, aes192-ctr, aes256-ctr
// Optional: Default to plaintext
// optional
Method string `json:"method,omitempty" toml:"method,omitempty"`
shuijing198799 marked this conversation as resolved.
Show resolved Hide resolved

// The frequency of datakey rotation, It managered by tikv
// Optional: default to 7d
// optional
DataKeyRotationPeriod string `json:"data-key-rotation-period,omitempty" toml:"data-key-rotation-period,omitempty"`
shuijing198799 marked this conversation as resolved.
Show resolved Hide resolved

// Master key config
MasterKey *TiKVMasterKeyConfig `json:"master-key,omitempty" toml:"master-key,omitempty"`

// Previous master key config
// It used in master key rotation, the data key should decryption by previous master key and then encrypytion by new master key
PreviousMasterKey *TiKVMasterKeyConfig `json:"previous-master-key,omitempty" toml:"previoud-master-key,omitempty"`
}

type TiKVMasterKeyConfig struct {
shuijing198799 marked this conversation as resolved.
Show resolved Hide resolved
// Use KMS encryption or use file encryption, possible values: kms, file
// If set to kms, kms MasterKeyKMSConfig should be filled, if set to file MasterKeyFileConfig should be filled
// optional
Type string `json:"type,omitempty" toml:"type,omitempty"`

// Master key file config
// If the type set to file, this config should be filled
MasterKeyFileConfig `json:",inline"`

// Master key KMS config
// If the type set to kms, this config should be filled
MasterKeyKMSConfig `json:",inline"`
}

type MasterKeyFileConfig struct {
shuijing198799 marked this conversation as resolved.
Show resolved Hide resolved
// Encrypyion method, use master key encryption data key
// Possible values: plaintext, aes128-ctr, aes192-ctr, aes256-ctr
// Optional: Default to plaintext
// optional
Method string `json:"method,omitempty" toml:"method,omitempty"`

// Text file containing the key in hex form, end with '\n'
Path string `json:"path" toml:"path"`
}

type MasterKeyKMSConfig struct {
// AWS CMK key-id it can be find in AWS Console or use aws cli
// This field is required
KeyID string `json:"key-id" toml:"key-id"`

// AccessKey of AWS user, leave empty if using other authrization method
shuijing198799 marked this conversation as resolved.
Show resolved Hide resolved
// optional
AccessKey string `json:"access-key,omitempty" toml:"access-key,omitempty"`

// SecretKey of AWS user, leave empty if using other authrization method
// optional
SecretKey string `json:"secret-access-key,omitempty" toml:"access-key,omitempty"`

// Region of this KMS key
// Optional: Default to us-east-1
// optional
Region string `json:"region,omitempty" toml:"region,omitempty"`

// Used for KMS compatible KMS, such as Ceph, minio, If use AWS, leave empty
// optional
Endpoint string `json:"endpoint,omitempty" toml:"endpoint,omitempty"`
shuijing198799 marked this conversation as resolved.
Show resolved Hide resolved
}
Loading