apiserver support for etcd encryption

- Support encrypting data persisted to etcd
  by kube-apiserver

Change-Id: I47ca634961e66e48dadc8f13d1c84748ab4e2fb9

examples/basic/EncryptionPolicy.yaml

@@ -8,6 +8,14 @@ metadata:
     layer: site
   storagePolicy: cleartext
 data:
+  etcd:
+    - resources:
+        - 'secrets'
+      providers:
+        - secretbox:
+            keys:
+              - name: key1
+                secret: Xw2UcbjILTJM6QiFZ0WPSbUvjtoT8OJC/Nl8qqYWjGk=
   scripts:
     genesis:
       gpg: {}

examples/basic/Genesis.yaml

@@ -7,6 +7,13 @@ metadata:
     abstract: false
     layer: site
   storagePolicy: cleartext
+  substitutions:
+    - src:
+        schema: promenade/EncryptionPolicy/v1
+        name: encryption-policy
+        path: .etcd
+      dest:
+        path: .apiserver.encryption
 data:
   hostname: n0
   ip: 192.168.77.10
@@ -20,6 +27,7 @@ data:
       # NOTE(mark-burnett): This flag is removed in Kubernetes 1.11
       - --repair-malformed-updates=false
       - --admission-control-config-file=/etc/kubernetes/apiserver/acconfig.yaml
+      - --experimental-encryption-provider-config=/etc/kubernetes/apiserver/encryption_provider.yaml
       - --v=3
   armada:
     target_manifest: cluster-bootstrap

examples/basic/armada-resources.yaml

@@ -711,6 +711,12 @@ metadata:
       dest:
         path: .values.secrets.service_account.public_key
 
+    - src:
+        schema: promenade/EncryptionPolicy/v1
+        name: encryption-policy
+        path: .etcd
+      dest:
+        path: $.values.conf.encryption_provider.content.resources
 data:
   chart_name: apiserver
   release: kubernetes-apiserver
@@ -722,6 +728,14 @@ data:
   upgrade:
     no_hooks: true
   values:
+    conf:
+      encryption_provider:
+        file: encryption_provider.yaml
+        command_options:
+          - '--experimental-encryption-provider-config=/etc/kubernetes/apiserver/encryption_provider.yaml'
+        content:
+          kind: EncryptionConfig
+          apiVersion: v1
     apiserver:
       etcd:
         endpoints: https://127.0.0.1:2378

promenade/renderer.py

@@ -109,6 +109,7 @@ def _build_env():
     env.filters['b64enc'] = _base64_encode
     env.filters['fill_no_proxy'] = _fill_no_proxy
     env.filters['yaml_safe_dump_all'] = _yaml_safe_dump_all
+    env.filters['toyaml'] = _yaml_safe_dump_arg
     return env
 
 
@@ -155,3 +156,9 @@ def _yaml_safe_dump_all(documents):
     f = io.StringIO()
     yaml.safe_dump_all(documents, f)
     return f.getvalue()
+
+
+def _yaml_safe_dump_arg(data):
+    f = io.StringIO()
+    yaml.safe_dump(data, f, explicit_start=False, explicit_end=False)
+    return f.getvalue()

promenade/schemas/EncryptionPolicy.yaml

@@ -13,6 +13,21 @@ data:
       oneof:
         - { $ref: '#/definitions/encryption_method_gpg' }
 
+    etcd_encryption:
+      type: array
+      items:
+        type: object
+        additionalProperties: false
+        properties:
+          resources:
+            type: array
+            items:
+              type: string
+          providers:
+            type: array
+            items:
+              type: object
+              additionalProperties: true
     encryption_method_gpg:
       properties:
         gpg:
@@ -23,6 +38,8 @@ data:
       additionalProperties: false
 
   properties:
+    etcd:
+      $ref: '#/definitions/etcd_encryption'
     scripts:
       properties:
         genesis:

promenade/schemas/Genesis.yaml

@@ -75,6 +75,20 @@ data:
           type: array
           items:
             type: string
+        encryption:
+          type: array
+          items:
+            type: object
+            properties:
+              resources:
+                type: array
+                items:
+                  type: string
+              providers:
+                type: array
+                items:
+                  type: object
+                  additionalProperties: true
       additionalProperties: false
 
     files:

promenade/templates/roles/genesis/etc/genesis/apiserver/encryption_provider.yaml

@@ -0,0 +1,4 @@
+kind: EncryptionConfig
+apiVersion: v1
+resources:
+{{ config.get_path('Genesis:apiserver.encryption', {}) | toyaml | indent(2, true) }}