Skip to content

Commit e747ca0

Browse files
arkbriararkbriar
authored
feat: support secret encryption key (#746)
* feat: support setting private key for secret store Signed-off-by: arkbriar <arkbriar@gmail.com> * Add unit tests for the validation webhook Signed-off-by: arkbriar <arkbriar@gmail.com> * Refine the behaviours Signed-off-by: arkbriar <arkbriar@gmail.com> * Add license header Signed-off-by: arkbriar <arkbriar@gmail.com> --------- Signed-off-by: arkbriar <arkbriar@gmail.com>
1 parent 96bf158 commit e747ca0

19 files changed

Lines changed: 772 additions & 33 deletions

‎apis/risingwave/v1alpha1/risingwave_secret_store.go‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
// Copyright 2024 RisingWave Labs
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package v1alpha1
16+
17+
// RisingWaveSecretStorePrivateKeySecretReference is a reference to a secret that contains a private key.
18+
type RisingWaveSecretStorePrivateKeySecretReference struct {
19+
// Name is the name of the secret.
20+
Name string `json:"name"`
21+
22+
// Key is the key in the secret that contains the private key.
23+
Key string `json:"key"`
24+
}
25+
26+
// RisingWaveSecretStorePrivateKey is a private key that can be stored in a secret or directly in the resource.
27+
type RisingWaveSecretStorePrivateKey struct {
28+
// Value is the private key. It must be a 128-bit key encoded in hex. If this is set, SecretRef must be nil.
29+
// When the feature gate RandomSecretStorePrivateKey is enabled and neither is set, the private key will be
30+
// generated randomly.
31+
// +kubebuilder:validation:Pattern="^[0-9a-f]{32}$"
32+
// +optional
33+
Value *string `json:"value,omitempty"`
34+
35+
// SecretRef is a reference to a secret that contains the private key. If this is set, Value must be nil.
36+
// Note that the value in the secret must be a 128-bit key encoded in hex.
37+
// +optional
38+
SecretRef *RisingWaveSecretStorePrivateKeySecretReference `json:"secretRef,omitempty"`
39+
}
40+
41+
// RisingWaveSecretStore is the configuration of the secret store.
42+
type RisingWaveSecretStore struct {
43+
// PrivateKey is the private key used to encrypt and decrypt the secrets.
44+
PrivateKey RisingWaveSecretStorePrivateKey `json:"privateKey,omitempty"`
45+
}

‎apis/risingwave/v1alpha1/risingwave_types.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,9 @@ type RisingWaveSpec struct {
148148

149149
// LicenseKey to enable paid features of RisingWave.
150150
LicenseKey *RisingWaveLicenseKey `json:"licenseKey,omitempty"`
151+
152+
// SecretStore is the configuration of the secret store.
153+
SecretStore RisingWaveSecretStore `json:"secretStore,omitempty"`
151154
}
152155

153156
// ComponentGroupReplicasStatus are the running status of Pods in group.

‎apis/risingwave/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 57 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/risingwave.risingwavelabs.com_risingwaves.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30510,6 +30510,38 @@ spec:
3051030510
- path
3051130511
type: object
3051230512
type: object
30513+
secretStore:
30514+
description: SecretStore is the configuration of the secret store.
30515+
properties:
30516+
privateKey:
30517+
description: PrivateKey is the private key used to encrypt and
30518+
decrypt the secrets.
30519+
properties:
30520+
secretRef:
30521+
description: |-
30522+
SecretRef is a reference to a secret that contains the private key. If this is set, Value must be nil.
30523+
Note that the value in the secret must be a 128-bit key encoded in hex.
30524+
properties:
30525+
key:
30526+
description: Key is the key in the secret that contains
30527+
the private key.
30528+
type: string
30529+
name:
30530+
description: Name is the name of the secret.
30531+
type: string
30532+
required:
30533+
- key
30534+
- name
30535+
type: object
30536+
value:
30537+
description: |-
30538+
Value is the private key. It must be a 128-bit key encoded in hex. If this is set, SecretRef must be nil.
30539+
When the feature gate RandomSecretStorePrivateKey is enabled and neither is set, the private key will be
30540+
generated randomly.
30541+
pattern: ^[0-9a-f]{32}$
30542+
type: string
30543+
type: object
30544+
type: object
3051330545
standaloneMode:
3051430546
default: 0
3051530547
description: |-

‎config/risingwave-operator-test.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30527,6 +30527,38 @@ spec:
3052730527
- path
3052830528
type: object
3052930529
type: object
30530+
secretStore:
30531+
description: SecretStore is the configuration of the secret store.
30532+
properties:
30533+
privateKey:
30534+
description: PrivateKey is the private key used to encrypt and
30535+
decrypt the secrets.
30536+
properties:
30537+
secretRef:
30538+
description: |-
30539+
SecretRef is a reference to a secret that contains the private key. If this is set, Value must be nil.
30540+
Note that the value in the secret must be a 128-bit key encoded in hex.
30541+
properties:
30542+
key:
30543+
description: Key is the key in the secret that contains
30544+
the private key.
30545+
type: string
30546+
name:
30547+
description: Name is the name of the secret.
30548+
type: string
30549+
required:
30550+
- key
30551+
- name
30552+
type: object
30553+
value:
30554+
description: |-
30555+
Value is the private key. It must be a 128-bit key encoded in hex. If this is set, SecretRef must be nil.
30556+
When the feature gate RandomSecretStorePrivateKey is enabled and neither is set, the private key will be
30557+
generated randomly.
30558+
pattern: ^[0-9a-f]{32}$
30559+
type: string
30560+
type: object
30561+
type: object
3053030562
standaloneMode:
3053130563
default: 0
3053230564
description: |-

‎config/risingwave-operator.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30527,6 +30527,38 @@ spec:
3052730527
- path
3052830528
type: object
3052930529
type: object
30530+
secretStore:
30531+
description: SecretStore is the configuration of the secret store.
30532+
properties:
30533+
privateKey:
30534+
description: PrivateKey is the private key used to encrypt and
30535+
decrypt the secrets.
30536+
properties:
30537+
secretRef:
30538+
description: |-
30539+
SecretRef is a reference to a secret that contains the private key. If this is set, Value must be nil.
30540+
Note that the value in the secret must be a 128-bit key encoded in hex.
30541+
properties:
30542+
key:
30543+
description: Key is the key in the secret that contains
30544+
the private key.
30545+
type: string
30546+
name:
30547+
description: Name is the name of the secret.
30548+
type: string
30549+
required:
30550+
- key
30551+
- name
30552+
type: object
30553+
value:
30554+
description: |-
30555+
Value is the private key. It must be a 128-bit key encoded in hex. If this is set, SecretRef must be nil.
30556+
When the feature gate RandomSecretStorePrivateKey is enabled and neither is set, the private key will be
30557+
generated randomly.
30558+
pattern: ^[0-9a-f]{32}$
30559+
type: string
30560+
type: object
30561+
type: object
3053030562
standaloneMode:
3053130563
default: 0
3053230564
description: |-

0 commit comments

Comments
 (0)