mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-12-22 21:10:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
4f0bb2315b
ceph-csi/internal/kms
History
Rakshith R 4f0bb2315b rbd: add aws-sts-metdata encryption type 
With Amazon STS and kubernetes cluster is configured with
OIDC identity provider, credentials to access Amazon KMS
can be fetched using oidc-token(serviceaccount token).
Each tenant/namespace needs to create a secret with aws region,
role and CMK ARN.
Ceph-CSI will assume the given role with oidc token and access
aws KMS, with given CMK to encrypt/decrypt DEK which will stored
in the image metdata.

Refer: https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html
Resolves: #2879

Signed-off-by: Rakshith R <rar@redhat.com>
2022-03-16 07:29:56 +00:00
..
aws_metadata_test.go cleanup: move KMS functionality into its own package 2021-08-30 16:31:40 +00:00
aws_metadata.go rbd: unexport aws kms structs 2022-01-28 06:55:12 +00:00
aws_sts_metadata_test.go rbd: add aws-sts-metdata encryption type 2022-03-16 07:29:56 +00:00
aws_sts_metadata.go rbd: add aws-sts-metdata encryption type 2022-03-16 07:29:56 +00:00
keyprotect_test.go rbd: add kms unit test for key protect server 2021-12-21 17:09:50 +00:00
keyprotect.go rbd: remove kp-metadata register functions of HPCS/Key Protect 2022-02-08 18:27:03 +00:00
kms_test.go cleanup: move KMS functionality into its own package 2021-08-30 16:31:40 +00:00
kms.go rbd: Unexport IntegratedDEK struct from kms 2022-01-28 06:55:12 +00:00
secretskms_test.go cleanup: move KMS functionality into its own package 2021-08-30 16:31:40 +00:00
secretskms.go rbd: unexport SecretsKMS from KMS implementation 2022-01-28 06:55:12 +00:00
vault_sa_test.go rbd: Unexport VaultTenantSA struct from KMS implementation 2022-01-28 06:55:12 +00:00
vault_sa.go rbd: Unexport VaultTenantSA struct from KMS implementation 2022-01-28 06:55:12 +00:00
vault_test.go cleanup: move KMS functionality into its own package 2021-08-30 16:31:40 +00:00
vault_tokens_test.go util: configure tenants vaultAuthNamespace if not set 2022-03-02 08:36:33 +00:00
vault_tokens.go util: configure tenants vaultAuthNamespace if not set 2022-03-02 08:36:33 +00:00
vault.go util: use vaultNamespace if vaultAuthNamespace is not set 2022-02-07 08:20:48 +00:00