Feature Overview

This feature aims to enable customers of OCP to integrate 3rd party KMS solutions for encrypting etcd values at rest in accordance with: https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/

This feature makes the feature GA after the Tech Preview released with OCPSTRAT-108 

OpenShift Enhancement 

https://github.com/openshift/enhancements/pull/1872

Goals

• Adopt KMS v2 Plugin Interface: Implement the feature using the Kubernetes KMS v2 protocol only.
• Automatically deploy, monitor, and manage the lifecycle of the necessary KMS plugin pods to establish communication between the OpenShift API server and the external Key Management Service (KMS).
• Expose User Interface: Extend the APIServer configuration to be the single source of truth for KMS. encryption and connection details.
• Provide similar UX experience for all of self-hosted, HyperShift, SNO scenarios.
• Ensure Resilience: Implement mechanisms (e.g., in-memory DEK caching) to handle encryption and decryption during temporary KMS outages.
  • enhancements/kube-apiserver/kms-migration-recovery.md

General Prioritization for the Feature

1. KMS plugins management:
   Automatically deploy, monitor, and manage the lifecycle of the necessary KMS plugin pods to establish communication between the OpenShift API server and the external Key Management Service (KMS).
2. Approved design for detection & actuation for stand-alone OCP clusters.
   1. Monitor KMS State: Provide users with the means to monitor the state of the KMS plugins and the KMS itself.
   2. Report Status Clearly: Surface KMS plugin status and key rotation progress via Conditions in the APIServer CR's Status.
3. GA with the following providers
   • Cloud: (priority: AWS > Azure > Google)
     • AWS KMS: https://github.com/kubernetes-sigs/aws-encryption-provider
     • Azure KMS: https://github.com/Azure/kubernetes-kms 
     • Google Cloud KMS: https://github.com/GoogleCloudPlatform/k8s-cloudkms-plugin 

• • On-premise:
    • HashiCorp Vault (HashiCorp currently developing new plugin)
    • Thales: https://github.com/ThalesGroup/k8s-kms-plugin