Skip to content

CNTRLPLANE-2711: extend kms encryption enhancement with vault KMS plugin api#1972

Open
flavianmissi wants to merge 1 commit intoopenshift:masterfrom
flavianmissi:extend-kms-ep
Open

CNTRLPLANE-2711: extend kms encryption enhancement with vault KMS plugin api#1972
flavianmissi wants to merge 1 commit intoopenshift:masterfrom
flavianmissi:extend-kms-ep

Conversation

@flavianmissi
Copy link
Copy Markdown
Member

@flavianmissi flavianmissi commented Apr 15, 2026

No description provided.

@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Apr 15, 2026 •
edited by openshift-ci Bot
Loading

@flavianmissi: This pull request references CNTRLPLANE-2711 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Apr 15, 2026
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 15, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 15, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign jerpeter1 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@flavianmissi flavianmissi mentioned this pull request Apr 15, 2026
Closed
@flavianmissi flavianmissi force-pushed the extend-kms-ep branch 2 times, most recently from 62a8101 to 5a2fe63 Compare April 15, 2026 14:46
ardaguclu
ardaguclu reviewed Apr 15, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@ardaguclu ardaguclu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From kms feature team point of view, these changes look good to me. Thank you.

Comment thread enhancements/kube-apiserver/kms-encryption-foundations.md
@flavianmissi flavianmissi force-pushed the extend-kms-ep branch 4 times, most recently from 76e73dd to fd23ae1 Compare April 20, 2026 11:58
@flavianmissi
Copy link
Copy Markdown
Member Author

flavianmissi commented Apr 20, 2026 •
edited by openshift-ci Bot
Loading

/retitle CNTRLPLANE-2711: extend kms encryption enhancement with vault KMS plugin api

@openshift-ci openshift-ci Bot changed the title [WIP] CNTRLPLANE-2711: extend kms encryption enhancement with vault KMS plugin api CNTRLPLANE-2711: extend kms encryption enhancement with vault KMS plugin api Apr 20, 2026
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 20, 2026
everettraven
everettraven reviewed Apr 21, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@everettraven everettraven left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Aside from a minor comment, the EP changes look pretty good to me.

I'll do a proper API review on the corresponding openshift/api PR as part of my review process here.

Comment thread enhancements/kube-apiserver/kms-encryption-foundations.md
@ardaguclu
Copy link
Copy Markdown
Member

ardaguclu commented Apr 21, 2026

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 21, 2026
benluddy
benluddy reviewed Apr 27, 2026
View reviewed changes
Comment thread enhancements/kube-apiserver/kms-encryption-foundations.md
tls:
caBundle:
name: vault-ca-bundle # ConfigMap in openshift-config namespace
serverName: vault.example.com
Copy link
Copy Markdown

@benluddy benluddy Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there already a need today to make this independently configurable rather than derived from "vaultAddress"?

Copy link
Copy Markdown
Member Author

@flavianmissi flavianmissi Apr 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sort of. The Vault KMS Plugin supports this via the --tls-sni command line argument, so it felt natural that we would too. See https://github.com/hashicorp/web-unified-docs/blob/428f75ec56f3ee7aada7069eb4c91093853e72cb/content/vault/v1.21.x/content/docs/deploy/kubernetes/kms/configuration.mdx#connection-parameters for reference.

Comment thread enhancements/kube-apiserver/kms-encryption-foundations.md
@openshift-ci openshift-ci Bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed lgtm Indicates that a PR is ready to be merged. labels Apr 28, 2026
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 28, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 28, 2026

@flavianmissi: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@ardaguclu
Copy link
Copy Markdown
Member

ardaguclu commented Apr 29, 2026

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@benluddy benluddy benluddy left review comments

@everettraven everettraven everettraven left review comments

@shawn-hurley shawn-hurley Awaiting requested review from shawn-hurley

@yuqi-zhang yuqi-zhang Awaiting requested review from yuqi-zhang

+1 more reviewer

@ardaguclu ardaguclu ardaguclu left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@ardaguclu ardaguclu

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@flavianmissi @openshift-ci-robot @ardaguclu @benluddy @everettraven