feat: implements kms v2beta1 APIs

Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>

.pipelines/templates/e2e-kind-template.yml

@@ -5,34 +5,34 @@ jobs:
     workspace:
       clean: all
     variables:
-      - name: REGISTRY_NAME
-        value: kind-registry
-      - name: REGISTRY_PORT
-        value: 5000
-      - name: KUBERNETES_VERSION
-        value: v1.23.5
-      - name: KIND_CLUSTER_NAME
-        value: kms
-      - name: KIND_NETWORK
-        value: kind
-      # contains the following environment variables:
-      # - AZURE_CLIENT_ID
-      # - AZURE_CLIENT_SECRET
-      # - AZURE_TENANT_ID
-      # - KEYVAULT_NAME
-      # - KEY_NAME
-      # - KEY_VERSION
-      - group: kubernetes-kms
+    - name: REGISTRY_NAME
+      value: kind-registry
+    - name: REGISTRY_PORT
+      value: 5000
+    - name: KUBERNETES_VERSION
+      value: v1.27.1
+    - name: KIND_CLUSTER_NAME
+      value: kms
+    - name: KIND_NETWORK
+      value: kind
+    # contains the following environment variables:
+    # - AZURE_CLIENT_ID
+    # - AZURE_CLIENT_SECRET
+    # - AZURE_TENANT_ID
+    # - KEYVAULT_NAME
+    # - KEY_NAME
+    # - KEY_VERSION
+    - group: kubernetes-kms
     strategy:
       matrix:
-        kind_v1_23_13:
-          KUBERNETES_VERSION: v1.23.13
-        kind_v1_24_7:
+        kmsv1_kind_v1_24_7:
           KUBERNETES_VERSION: v1.24.7
-        kind_v1_25_3:
+        kmsv1_kind_v1_25_3:
           KUBERNETES_VERSION: v1.25.3
-        kind_v1_26_0:
+        kmsv1_kind_v1_26_0:
           KUBERNETES_VERSION: v1.26.0
+        kmsv1_kind_v1_27_1:
+          KUBERNETES_VERSION: v1.27.1
     steps:
       - task: GoTool@0
         inputs:
@@ -53,5 +53,55 @@ jobs:
       - template: cluster-health-template.yml
       - template: kind-debug-template.yml
       - script: make e2e-test
-        displayName: "Run e2e tests"
+        displayName: "Run e2e tests for KMS v1"
+      - template: cleanup-template.yml
+  - job:
+    timeoutInMinutes: 15
+    cancelTimeoutInMinutes: 5
+    workspace:
+      clean: all
+    variables:
+    - name: REGISTRY_NAME
+      value: kind-registry
+    - name: REGISTRY_PORT
+      value: 5000
+    - name: KUBERNETES_VERSION
+      value: v1.27.1
+    - name: KIND_CLUSTER_NAME
+      value: kms
+    - name: KIND_NETWORK
+      value: kind
+    # contains the following environment variables:
+    # - AZURE_CLIENT_ID
+    # - AZURE_CLIENT_SECRET
+    # - AZURE_TENANT_ID
+    # - KEYVAULT_NAME
+    # - KEY_NAME
+    # - KEY_VERSION
+    - group: kubernetes-kms
+    strategy:
+      matrix:
+        kmsv2_kind_v1_27_1:
+          KUBERNETES_VERSION: v1.27.1
+    steps:
+      - task: GoTool@0
+        inputs:
+          version: 1.19
+      - script: make e2e-install-prerequisites
+        displayName: "Install e2e test prerequisites"
+      - script: |
+          make e2e-kmsv2-setup-kind
+        displayName: "Setup kind cluster with azure kms plugin"
+        env:
+          REGISTRY_NAME: $(REGISTRY_NAME)
+          REGISTRY_PORT: $(REGISTRY_PORT)
+          KUBERNETES_VERSION: $(KUBERNETES_VERSION)
+          KIND_CLUSTER_NAME: $(KIND_CLUSTER_NAME)
+          KIND_NETWORK: $(KIND_NETWORK)
+          AZURE_CLIENT_ID: $(AZURE_CLIENT_ID)
+          AZURE_CLIENT_SECRET: $(AZURE_CLIENT_SECRET)
+      - template: cluster-health-template.yml
+      - template: kind-debug-template.yml
+      - script: make e2e-kmsv2-test
+        displayName: "Run e2e tests for KMS v2"
       - template: cleanup-template.yml

Makefile

@@ -29,8 +29,8 @@ DOCKER_BUILDKIT = 1
 export DOCKER_BUILDKIT
 
 # Testing var
-KIND_VERSION ?= 0.15.0
-KUBERNETES_VERSION ?= v1.25.0
+KIND_VERSION ?= 0.18.0
+KUBERNETES_VERSION ?= v1.27.1
 BATS_VERSION ?= 1.4.1
 
 ## --------------------------------------
@@ -132,6 +132,11 @@ e2e-setup-kind: setup-local-registry
 	./scripts/connect-registry.sh &
 	sleep 90s
 
+e2e-kmsv2-setup-kind: setup-local-registry
+	./scripts/setup-kmsv2-kind-cluster.sh &
+	./scripts/connect-registry.sh &
+	sleep 90s
+
 .PHONY: setup-local-registry
 setup-local-registry:
 	./scripts/setup-local-registry.sh
@@ -148,3 +153,7 @@ e2e-delete-kind:
 e2e-test:
 	# Run test suite with kind cluster
 	bats -t tests/e2e/test.bats
+
+e2e-kmsv2-test:
+	# Run test suite with kind cluster
+	bats -t tests/e2e/testkmsv2.bats

cmd/server/main.go

@@ -22,10 +22,11 @@ import (
 	"github.com/Azure/kubernetes-kms/pkg/version"
 
 	"google.golang.org/grpc"
-	pb "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1"
 	logsapi "k8s.io/component-base/logs/api/v1"
 	json "k8s.io/component-base/logs/json"
 	"k8s.io/klog/v2"
+	kmsv1 "k8s.io/kms/apis/v1beta1"
+	kmsv2 "k8s.io/kms/apis/v2"
 )
 
 var (
@@ -80,7 +81,7 @@ func main() {
 
 	klog.InfoS("Starting KeyManagementServiceServer service", "version", version.BuildVersion, "buildDate", version.BuildDate)
 
-	pc := &plugin.Config{
+	pluginConfig := &plugin.Config{
 		KeyVaultName:   *keyvaultName,
 		KeyName:        *keyName,
 		KeyVersion:     *keyVersion,
@@ -90,11 +91,6 @@ func main() {
 		ProxyPort:      *proxyPort,
 		ConfigFilePath: *configFilePath,
 	}
-	kmsServer, err := plugin.New(pc)
-	if err != nil {
-		klog.ErrorS(err, "failed to create server")
-		os.Exit(1)
-	}
 
 	// Initialize and run the GRPC server
 	proto, addr, err := utils.ParseEndpoint(*listenAddr)
@@ -112,23 +108,41 @@ func main() {
 		klog.ErrorS(err, "failed to listen", "addr", addr, "proto", proto)
 		os.Exit(1)
 	}
+
 	opts := []grpc.ServerOption{
 		grpc.UnaryInterceptor(utils.UnaryServerInterceptor),
 	}
 
 	s := grpc.NewServer(opts...)
-	pb.RegisterKeyManagementServiceServer(s, kmsServer)
+
+	// register kms v1 server
+	kmsV1Server, err := plugin.NewKMSv1Server(pluginConfig)
+	if err != nil {
+		klog.ErrorS(err, "failed to create server")
+		os.Exit(1)
+	}
+	kmsv1.RegisterKeyManagementServiceServer(s, kmsV1Server)
+
+	// register kms v2 server
+	kmsV2Server, err := plugin.NewKMSv2Server(pluginConfig)
+	if err != nil {
+		klog.ErrorS(err, "failed to create kms V2 server")
+		os.Exit(1)
+	}
+	kmsv2.RegisterKeyManagementServiceServer(s, kmsV2Server)
 
 	klog.InfoS("Listening for connections", "addr", listener.Addr().String())
 	go func() {
 		if err := s.Serve(listener); err != nil {
-			klog.ErrorS(err, "failed to serve")
+			klog.ErrorS(err, "failed to serve kms server")
 			os.Exit(1)
 		}
 	}()
 
+	// Health check for kms v1 and v2
 	healthz := &plugin.HealthZ{
-		KMSServer: kmsServer,
+		KMSv1Server: kmsV1Server,
+		KMSv2Server: kmsV2Server,
 		HealthCheckURL: &url.URL{
 			Host: net.JoinHostPort("", strconv.FormatUint(uint64(*healthzPort), 10)),
 			Path: *healthzPath,

go.mod

@@ -10,12 +10,14 @@ require (
 	go.opentelemetry.io/otel/exporters/metric/prometheus v0.20.0
 	go.opentelemetry.io/otel/metric v0.20.0
 	golang.org/x/crypto v0.6.0
-	golang.org/x/net v0.7.0
-	google.golang.org/grpc v1.49.0
+	golang.org/x/net v0.8.0
+	google.golang.org/grpc v1.54.0
 	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/apimachinery v0.27.1
 	k8s.io/apiserver v0.25.8
 	k8s.io/component-base v0.25.8
-	k8s.io/klog/v2 v2.80.1
+	k8s.io/klog/v2 v2.90.1
+	k8s.io/kms v0.27.1
 )
 
 require (
@@ -26,18 +28,20 @@ require (
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-logr/zapr v1.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/uuid v1.3.0 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/prometheus/client_golang v1.12.1 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
+	github.com/rogpeppe/go-internal v1.10.0 // indirect
 	github.com/spf13/cobra v1.4.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	go.opentelemetry.io/otel/sdk v0.20.0 // indirect
@@ -47,10 +51,9 @@ require (
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.19.0 // indirect
-	golang.org/x/sys v0.5.0 // indirect
-	golang.org/x/text v0.7.0 // indirect
-	google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	golang.org/x/sys v0.6.0 // indirect
+	golang.org/x/text v0.8.0 // indirect
+	google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/apimachinery v0.25.8 // indirect
 )