Enhancements: Enable encryption of etcd secrets by an Azure Key Vault managed key

[jdumars]

Enable encryption of etcd secrets by an Azure Key Vault managed key

• One-line feature description (can be used as a release note):

Enable encryption of etcd secrets by an Azure Key Vault managed key.

• Primary contact (assignee):

Khaled (Kal) Henidak [[email protected]]

• Responsible SIGs:

Azure

• Design proposal link (community repo):

WIP: https://github.com/Azure/acs-engine/issues/1116

• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred:

Brendan Burns, Anthony Howe (Not yet agreed upon, proposed)

• Approver (likely from SIG/area to which feature belongs):

Brendan Burns (Not yet agreed upon, Proposed)

• Feature target (which target equals to which milestone):
• Alpha release target (x.y)

N/A

• Beta release target (x.y)

N/A

• Stable release target (x.y)

1.9

[jdumars]

/sig azure

[idvoretskyi]

@jdumars can you mention GitHub ID of Khaled (or assign this feature directly to him)?

Also, please, describe in which stage (alpha/beta/stable) will this feature land in 1.8?

[jdumars]

@idvoretskyi this step in the feature process is stable, but lays the groundwork for later integration.

[idvoretskyi]

@jdumars unfortunately, @khenidak is not a member of Kubernetes org, so the feature can't be assigned to him on GitHub. Can you suggest someone from the org, who can shadow him with this role?

[jdumars]

/assign @brendandburns

[idvoretskyi]

@jdumars @brendandburns @kubernetes/sig-azure-misc can you confirm that this feature targets 1.8?

If yes, please, update the features tracking spreadsheet with the feature data, otherwise, let's remove this item from 1.8 milestone.

Thanks

[jdumars]

@idvoretskyi removed from milestone, also removing help wanted label to make your life easier.

[jdumars]

FYI https://github.com/kubernetes/kubernetes/pull/54439

[jdumars]

Docs will be needed, and provided by @Khenidak

[jdumars]

This is on hold indefinitely.

[idvoretskyi]

@jdumars thanks for updating

[pires]

With Kubernetes 1.10 the alpha support for gRPC KMS, it's now possible to implement this as an out-of-tree integration.

[dims]

@pires looks like @khenidak has already implemented this stuff :) https://github.com/Azure/kubernetes-kms

[khenidak]

yes and yes :-) but its @ritazh who is driving the work.

[justaugustus]

@khenidak
Any plans for this in 1.11?

If so, can you please ensure the feature is up-to-date with the appropriate:

• Description
• Milestone
• Assignee(s)
• Labels:
  
  
  
  • stage/{alpha,beta,stable}
  
  
  • sig/*
  
  
  • kind/feature
  
  

/assign @khenidak
cc @idvoretskyi

[justaugustus]

This feature current has no milestone, so we'd like to check in and see if there are any plans for this in Kubernetes 1.12.

If so, please ensure that this issue is up-to-date with ALL of the following information:

• One-line feature description (can be used as a release note):
• Primary contact (assignee):
• Responsible SIGs:
• Design proposal link (community repo):
• Link to e2e and/or unit tests:
• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred:
• Approver (likely from SIG/area to which feature belongs):
• Feature target (which target equals to which milestone):
  
  
  
  • Alpha release target (x.y)
  
  
  • Beta release target (x.y)
  
  
  • Stable release target (x.y)
  
  

Set the following:

• Description
• Assignee(s)
• Labels:
  
  
  
  • stage/{alpha,beta,stable}
  
  
  • sig/*
  
  
  • kind/feature
  
  

Once this feature is appropriately updated, please explicitly ping @justaugustus, @kacole2, @robertsandoval, @rajendar38 to note that it is ready to be included in the Features Tracking Spreadsheet for Kubernetes 1.12.

---

Please note that Features Freeze is tomorrow, July 31st, after which any incomplete Feature issues will require an Exception request to be accepted into the milestone.

In addition, please be aware of the following relevant deadlines:

• Docs deadline (open placeholder PRs): 8/21
• Test case freeze: 8/28

Please make sure all PRs for features have relevant release notes included as well.

Happy shipping!

P.S. This was sent via automation

[kacole2]

@khenidak @ritazh I'm doing some clean up. According to https://github.com/kubernetes/kubernetes/pull/48574 it looks like this has been merged. Can we close this issue?

[kacole2]

@khenidak @ritazh bump for previous comment

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[liggitt]

yes, this was addressed by the KMS integration point and promoted in 1.13

/close

[k8s-ci-robot]

@liggitt: Closing this issue.

In response to this:

yes, this was addressed by the KMS integration point and promoted in 1.13

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.