mirror of
https://github.com/ceph/ceph-csi.git
synced 2024-09-20 07:29:50 +00:00
4f0bb2315b
With Amazon STS and kubernetes cluster is configured with OIDC identity provider, credentials to access Amazon KMS can be fetched using oidc-token(serviceaccount token). Each tenant/namespace needs to create a secret with aws region, role and CMK ARN. Ceph-CSI will assume the given role with oidc token and access aws KMS, with given CMK to encrypt/decrypt DEK which will stored in the image metdata. Refer: https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html Resolves: #2879 Signed-off-by: Rakshith R <rar@redhat.com>
32 lines
690 B
Go
32 lines
690 B
Go
package rand
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"fmt"
|
|
"io"
|
|
"math/big"
|
|
)
|
|
|
|
func init() {
|
|
Reader = rand.Reader
|
|
}
|
|
|
|
// Reader provides a random reader that can reset during testing.
|
|
var Reader io.Reader
|
|
|
|
// Int63n returns a int64 between zero and value of max, read from an io.Reader source.
|
|
func Int63n(reader io.Reader, max int64) (int64, error) {
|
|
bi, err := rand.Int(reader, big.NewInt(max))
|
|
if err != nil {
|
|
return 0, fmt.Errorf("failed to read random value, %w", err)
|
|
}
|
|
|
|
return bi.Int64(), nil
|
|
}
|
|
|
|
// CryptoRandInt63n returns a random int64 between zero and value of max
|
|
// obtained from the crypto rand source.
|
|
func CryptoRandInt63n(max int64) (int64, error) {
|
|
return Int63n(Reader, max)
|
|
}
|