{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/features/issues/92","repository_url":"https://api.github.com/repos/kubernetes/features","labels_url":"https://api.github.com/repos/kubernetes/features/issues/92/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/features/issues/92/comments","events_url":"https://api.github.com/repos/kubernetes/features/issues/92/events","html_url":"https://github.com/kubernetes/features/issues/92","id":176641491,"number":92,"title":"Encrypt secrets in etcd","user":{"login":"stevesloka","id":1048184,"avatar_url":"https://avatars.githubusercontent.com/u/1048184?v=3","gravatar_id":"","url":"https://api.github.com/users/stevesloka","html_url":"https://github.com/stevesloka","followers_url":"https://api.github.com/users/stevesloka/followers","following_url":"https://api.github.com/users/stevesloka/following{/other_user}","gists_url":"https://api.github.com/users/stevesloka/gists{/gist_id}","starred_url":"https://api.github.com/users/stevesloka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevesloka/subscriptions","organizations_url":"https://api.github.com/users/stevesloka/orgs","repos_url":"https://api.github.com/users/stevesloka/repos","events_url":"https://api.github.com/users/stevesloka/events{/privacy}","received_events_url":"https://api.github.com/users/stevesloka/received_events","type":"User","site_admin":false},"labels":[{"id":413888074,"url":"https://api.github.com/repos/kubernetes/features/labels/team/SIG-Auth","name":"team/SIG-Auth","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":{"login":"stevesloka","id":1048184,"avatar_url":"https://avatars.githubusercontent.com/u/1048184?v=3","gravatar_id":"","url":"https://api.github.com/users/stevesloka","html_url":"https://github.com/stevesloka","followers_url":"https://api.github.com/users/stevesloka/followers","following_url":"https://api.github.com/users/stevesloka/following{/other_user}","gists_url":"https://api.github.com/users/stevesloka/gists{/gist_id}","starred_url":"https://api.github.com/users/stevesloka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevesloka/subscriptions","organizations_url":"https://api.github.com/users/stevesloka/orgs","repos_url":"https://api.github.com/users/stevesloka/repos","events_url":"https://api.github.com/users/stevesloka/events{/privacy}","received_events_url":"https://api.github.com/users/stevesloka/received_events","type":"User","site_admin":false},"assignees":[{"login":"stevesloka","id":1048184,"avatar_url":"https://avatars.githubusercontent.com/u/1048184?v=3","gravatar_id":"","url":"https://api.github.com/users/stevesloka","html_url":"https://github.com/stevesloka","followers_url":"https://api.github.com/users/stevesloka/followers","following_url":"https://api.github.com/users/stevesloka/following{/other_user}","gists_url":"https://api.github.com/users/stevesloka/gists{/gist_id}","starred_url":"https://api.github.com/users/stevesloka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevesloka/subscriptions","organizations_url":"https://api.github.com/users/stevesloka/orgs","repos_url":"https://api.github.com/users/stevesloka/repos","events_url":"https://api.github.com/users/stevesloka/events{/privacy}","received_events_url":"https://api.github.com/users/stevesloka/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/features/milestones/3","html_url":"https://github.com/kubernetes/features/milestones/next-milestone","labels_url":"https://api.github.com/repos/kubernetes/features/milestones/3/labels","id":1892029,"number":3,"title":"next-milestone","description":"","creator":{"login":"idvoretskyi","id":118459,"avatar_url":"https://avatars.githubusercontent.com/u/118459?v=3","gravatar_id":"","url":"https://api.github.com/users/idvoretskyi","html_url":"https://github.com/idvoretskyi","followers_url":"https://api.github.com/users/idvoretskyi/followers","following_url":"https://api.github.com/users/idvoretskyi/following{/other_user}","gists_url":"https://api.github.com/users/idvoretskyi/gists{/gist_id}","starred_url":"https://api.github.com/users/idvoretskyi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/idvoretskyi/subscriptions","organizations_url":"https://api.github.com/users/idvoretskyi/orgs","repos_url":"https://api.github.com/users/idvoretskyi/repos","events_url":"https://api.github.com/users/idvoretskyi/events{/privacy}","received_events_url":"https://api.github.com/users/idvoretskyi/received_events","type":"User","site_admin":false},"open_issues":15,"closed_issues":1,"state":"open","created_at":"2016-07-19T13:43:19Z","updated_at":"2016-11-03T16:24:30Z","due_on":null,"closed_at":null},"comments":15,"created_at":"2016-09-13T13:33:22Z","updated_at":"2016-11-03T16:31:33Z","closed_at":null,"body":"# Description\n\nObjects of type `Secret` are currently stored inside the etcd cluster in plain text. Enabling encryption of these secrets would be a good first step into making the cluster more secure with data at rest.\n\nThe implementation should minic the current Cloud Provider pattern in which different encryption providers can be written by the community depending on their infrastructure or desire for how to implement the encryption.\n\nCurrently the implementation will only encrypt Secrets across all namespaces, but could be extended to encrypt all data.\n\nCurrent issue open where discussion started: https://github.com/kubernetes/kubernetes/issues/12742\n# Progress Tracker\n- [ ] Before Alpha\n  - [ ] Write and maintain draft quality doc\n    - [ ] During development keep a doc up-to-date about the desired experience of the feature and how someone can try the feature in its current state. Think of it as the README of your new feature and a skeleton for the docs to be written before the Kubernetes release. Paste link to Google Doc: **DOC-LINK**\n  - [ ] Design Approval\n    - [ ] Design Proposal.  This goes under [docs/proposals](https://github.com/kubernetes/kubernetes/tree/master/docs/proposals).  Doing a proposal as a PR allows line-by-line commenting from community, and creates the basis for later design documentation.  Paste link to merged design proposal here: **PROPOSAL-NUMBER**\n    - [ ] Decide which repo this feature's code will be checked into. Not everything needs to land in the core kubernetes repo. **REPO-NAME**\n    - [ ] Initial API review (if API).  Maybe same PR as design doc. **PR-NUMBER**\n      -  Any code that changes an API (`/pkg/apis/...`)\n      -  **cc `@kubernetes/api`**\n    - [ ] Identify shepherd (your SIG lead and/or kubernetes-pm@googlegroups.com will be able to help you). **My Shepherd is:** _replace.me@replaceme.com_ (and/or GH Handle)\n      -  A shepherd is an individual who will help acquaint you with the process of getting your feature into the repo, identify reviewers and provide feedback on the feature. They are _not_ (necessarily) the code reviewer of the feature, or tech lead for the area.\n      -  The shepherd is _not_ responsible for showing up to Kubernetes-PM meetings and/or communicating if the feature is on-track to make the release goals. That is still your responsibility.\n    - [ ] Identify secondary/backup contact point. **My Secondary Contact Point is:** _replace.me@replaceme.com_ (and/or GH Handle)\n  - [ ] Write (code + tests + docs) then get them merged.  **ALL-PR-NUMBERS**\n    - [ ] **Code needs to be disabled by default.**   Verified by code OWNERS\n    - [ ] Minimal testing\n    - [ ] Minimal docs\n      - cc `@kubernetes/docs` on docs PR\n      - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\n      - New apis: _Glossary Section Item_ in the docs repo: kubernetes/kubernetes.github.io\n    - [ ] Update release notes\n- [ ] Before Beta\n  - [ ] Testing is sufficient for beta\n  - [ ] User docs with tutorials\n    - _Updated walkthrough / tutorial_ in the docs repo: kubernetes/kubernetes.github.io\n    - cc `@kubernetes/docs` on docs PR\n    - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\n  - [ ] Thorough API review\n    - **cc `@kubernetes/api`**\n- [ ] Before Stable\n  - [ ] docs/proposals/foo.md moved to docs/design/foo.md \n    - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\n  - [ ] Soak, load testing  \n  - [ ] detailed user docs and examples\n    - **cc `@kubernetes/docs`**\n    - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\n\n_FEATURE_STATUS is used for feature tracking and to be updated by `@kubernetes/feature-reviewers`._\n**FEATURE_STATUS: IN_DEVELOPMENT**\n\nMore advice:\n\nDesign\n- Once you get LGTM from a _`@kubernetes/feature-reviewers`_ member, you can check this checkbox, and the reviewer will apply the \"design-complete\" label.\n\nCoding\n- Use as many PRs as you need.  Write tests in the same or different PRs, as is convenient for you.\n- As each PR is merged, add a comment to this issue referencing the PRs.  Code goes in the http://github.com/kubernetes/kubernetes repository,\n      and sometimes http://github.com/kubernetes/contrib, or other repos.\n- When you are done with the code, apply the \"code-complete\" label.\n- When the feature has user docs, please add a comment mentioning `@kubernetes/feature-reviewers` and they will\n      check that the code matches the proposed feature and design, and that everything is done, and that there is adequate\n      testing.  They won't do detailed code review: that already happened when your PRs were reviewed.\n      When that is done, you can check this box and the reviewer will apply the \"code-complete\" label.\n\nDocs\n- [ ] Write user docs and get them merged in.\n- User docs go into http://github.com/kubernetes/kubernetes.github.io.\n- When the feature has user docs, please add a comment mentioning `@kubernetes/docs`.\n- When you get LGTM, you can check this checkbox, and the reviewer will apply the \"docs-complete\" label.\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/features/issues/comments/258196752","html_url":"https://github.com/kubernetes/features/issues/92#issuecomment-258196752","issue_url":"https://api.github.com/repos/kubernetes/features/issues/92","id":258196752,"user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"created_at":"2016-11-03T16:31:32Z","updated_at":"2016-11-03T16:31:32Z","body":"Will take a look at upmc-enterprises/kubernetes-secret-manager.\n\nOn Thu, Nov 3, 2016 at 9:24 AM, Steve Sloka <notifications@github.com>\nwrote:\n\n> The starter (incomplete) proposal is here: https://docs.google.com/\n> document/d/1lFhPLlvkCo3XFC2xFDPSn0jAGpqKcCCZaNsBAv8zFdE/edit\n>\n> @erictune <https://github.com/erictune> How does Kelsey's repo resolve\n> the problem? I do like the integration pattern with Vault, but now ALL of\n> my apps are forced to understand Vault and how it works. I wrote this (\n> https://github.com/upmc-enterprises/kubernetes-secret-manager) so that\n> you could still use Vault, but your app is abstracted away from knowing the\n> underlining pieces in use.\n>\n> This is why I was looking to encrypt the secrets so we could continue to\n> use them and they would be compliant at rest inside etcd.\n>\n> —\n> You are receiving this because you were mentioned.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/kubernetes/features/issues/92#issuecomment-258194574>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AHuuduGCL05aRfJeKWdmH4qY7tmQ953tks5q6grIgaJpZM4J7rLO>\n> .\n>\n"}}
{"actor":{"display_login":"erictune"}}