Add eks secrets encryption (kubernetes-sigs#171)

* Add eks secrets encryption * Fix merge * Update changelog * Add space * Improve spaces
stg-0 · Jul 7, 2023 · 56cb98b · 56cb98b
1 parent b1303e2
commit 56cb98b
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## 0.17.0-0.3.0 (Upcoming)
 
+* Add EKS secrets encryption support
 * Fix wait conditions for unmanaged clusters
 
 ## 0.17.0-0.2.0 (2023-07-03)

diff --git a/pkg/cluster/internal/create/actions/createworker/templates/aws.eks.tmpl b/pkg/cluster/internal/create/actions/createworker/templates/aws.eks.tmpl
@@ -90,6 +90,12 @@ spec:
       - name: ENI_CONFIG_LABEL_DEF
         value: \"topology.kubernetes.io/zone\"
     {{- end }}
+{{- if ne .KeosCluster.Spec.ControlPlane.AWS.EncryptionKey "" }}
+  encryptionConfig:
+    provider: \"{{ .KeosCluster.Spec.ControlPlane.AWS.EncryptionKey }}\"
+    resources:
+      - secrets
+{{- end }}
 {{- range $node := .KeosCluster.Spec.WorkerNodes }}
 {{- range $index, $n := loop .AZ .ZoneDistribution .Quantity .NodeGroupMaxSize .NodeGroupMinSize }}
 ---

diff --git a/pkg/commons/cluster.go b/pkg/commons/cluster.go
@@ -124,7 +124,8 @@ type Subnets struct {
 }
 
 type AWSCP struct {
-	AssociateOIDCProvider bool `yaml:"associate_oidc_provider" validate:"boolean"`
+	AssociateOIDCProvider bool   `yaml:"associate_oidc_provider" validate:"boolean"`
+	EncryptionKey         string `yaml:"encryption_key"`
 	Logging               struct {
 		ApiServer         bool `yaml:"api_server" validate:"boolean"`
 		Audit             bool `yaml:"audit" validate:"boolean"`