{"action":"created","comment":{"url":"https://api.github.com/repos/gardener/gardener/pulls/comments/295199249","pull_request_review_id":251561921,"id":295199249,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDI5NTE5OTI0OQ==","diff_hunk":"@@ -0,0 +1,104 @@\n+package encryptionconfiguration\n+\n+import (\n+\t\"crypto/rand\"\n+\t\"encoding/base64\"\n+\t\"fmt\"\n+\t\"strconv\"\n+\t\"strings\"\n+\t\"time\"\n+\n+\tapiserverconfigv1 \"k8s.io/apiserver/pkg/apis/config/v1\"\n+)\n+\n+func createEncryptionKey() (apiserverconfigv1.Key, error) {\n+\tvar key apiserverconfigv1.Key\n+\tkeyString, err := createKeySecret()\n+\tif err != nil {\n+\t\treturn key, err\n+\t}\n+\tif len(keyString) == 0 {\n+\t\treturn key, fmt.Errorf(\"generated random encryption key is of unexpected length 0\")\n+\t}\n+\tkey.Name = createKeyName()\n+\tkey.Secret = keyString\n+\treturn key, nil\n+}\n+\n+func createKeyName() string {\n+\tnanos := time.Now().UnixNano()\n+\tname := ecKeyPrefix + strconv.FormatInt(nanos, 10)\n+\treturn name\n+}\n+\n+func createKeySecret() (string, error) {\n+\tkeyArray := make([]byte, ecKeySecretLen)\n+\t_, err := rand.Read(keyArray)","path":"pkg/operation/etcdencryption/encryptionkeys.go","position":49,"original_position":36,"commit_id":"69cbed61636516834de4564d98e66218f2bb9ee1","original_commit_id":"ec64d3fe8e3925774ac0544e4b59d4e599d97f57","user":{"login":"rfranzke","id":19169361,"node_id":"MDQ6VXNlcjE5MTY5MzYx","avatar_url":"https://avatars1.githubusercontent.com/u/19169361?v=4","gravatar_id":"","url":"https://api.github.com/users/rfranzke","html_url":"https://github.com/rfranzke","followers_url":"https://api.github.com/users/rfranzke/followers","following_url":"https://api.github.com/users/rfranzke/following{/other_user}","gists_url":"https://api.github.com/users/rfranzke/gists{/gist_id}","starred_url":"https://api.github.com/users/rfranzke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfranzke/subscriptions","organizations_url":"https://api.github.com/users/rfranzke/orgs","repos_url":"https://api.github.com/users/rfranzke/repos","events_url":"https://api.github.com/users/rfranzke/events{/privacy}","received_events_url":"https://api.github.com/users/rfranzke/received_events","type":"User","site_admin":false},"body":"Hm, ok, why not? As far as I understand the secret key is just a random string, or?","created_at":"2019-06-19T09:16:58Z","updated_at":"2019-06-19T09:20:32Z","html_url":"https://github.com/gardener/gardener/pull/1066#discussion_r295199249","pull_request_url":"https://api.github.com/repos/gardener/gardener/pulls/1066","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/gardener/gardener/pulls/comments/295199249"},"html":{"href":"https://github.com/gardener/gardener/pull/1066#discussion_r295199249"},"pull_request":{"href":"https://api.github.com/repos/gardener/gardener/pulls/1066"}},"in_reply_to_id":290586955},"pull_request":{"url":"https://api.github.com/repos/gardener/gardener/pulls/1066","id":285053801,"node_id":"MDExOlB1bGxSZXF1ZXN0Mjg1MDUzODAx","html_url":"https://github.com/gardener/gardener/pull/1066","diff_url":"https://github.com/gardener/gardener/pull/1066.diff","patch_url":"https://github.com/gardener/gardener/pull/1066.patch","issue_url":"https://api.github.com/repos/gardener/gardener/issues/1066","number":1066,"state":"open","locked":false,"title":"Encryption of shoot secrets in etcd","user":{"login":"michael-engler","id":47210029,"node_id":"MDQ6VXNlcjQ3MjEwMDI5","avatar_url":"https://avatars0.githubusercontent.com/u/47210029?v=4","gravatar_id":"","url":"https://api.github.com/users/michael-engler","html_url":"https://github.com/michael-engler","followers_url":"https://api.github.com/users/michael-engler/followers","following_url":"https://api.github.com/users/michael-engler/following{/other_user}","gists_url":"https://api.github.com/users/michael-engler/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-engler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-engler/subscriptions","organizations_url":"https://api.github.com/users/michael-engler/orgs","repos_url":"https://api.github.com/users/michael-engler/repos","events_url":"https://api.github.com/users/michael-engler/events{/privacy}","received_events_url":"https://api.github.com/users/michael-engler/received_events","type":"User","site_admin":false},"body":"**What this PR does / why we need it**:\r\nIn a nutshell, this PR addresses an automatic encryption of shoot secrets according to https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/ \r\n\r\nThe protection of shoot cluster secrets against eavesdropping and unauthorised access is of utmost importance. As of today, Gardener already protects the transmission of secrets by applying transport encryption via TLS between the API server and the kubelet(s). While encryption in transit is already addressed, this PR provides a data-at-rest protection of Kubernetes secrets. More clearly, shoot secrets that are stored in etcd need to be encrypted prior to storing them in etcd and need to be decrypted after retrieving them from etcd. From Kubernetes version 1.13.0 onward, the kube-apiserver process supports the encryption of secret data at rest. \r\n\r\nThis PR uses the Kubernetes feature automatically for shoots created by Gardener. Each shoot cluster with Kubernetes version 1.13.0 receives an EncryptionConfiguration with a random shoot-specific encryption key. The EncryptionConfiguration is realised itself as a Kubernetes secret which is created during the shoot reconciliation in the seed cluster (in the shoot namespace) and is mounted to the API server pods. All shoot secrets are rewritten to ensure that they are encrypted as specified in the EncryptionConfiguration. \r\n\r\nMore clearly, the EncryptionConfiguration is written during the first reconciliation run in a passive state (meaning that \"identity\" is the first entry in the list of encryption providers, and \"aescbc\" is the second entry). In this state, the key is already known to each apiserver process (and could be used for decrypting a secret that was encrypted with that key) but secrets are not yet actively encrypted. The next subsequent reconciliation run re-orders the encryption providers and thereby activates the encryption. \r\n\r\n**Which issue(s) this PR fixes**:\r\nFixes #\r\n\r\n**Special notes for your reviewer**:\r\n\r\n**Release note**:\r\n<!--  Write your release note:\r\n1. Enter your release note in the below block.\r\n2. If no release note is required, just write \"NONE\" within the block.\r\n\r\nFormat of block header: <category> <target_group>\r\nPossible values:\r\n- category:       improvement|noteworthy|action\r\n- target_group:   user|operator\r\n-->\r\n```improvement operator\r\n\r\n```\r\n","created_at":"2019-06-04T16:34:05Z","updated_at":"2019-06-19T09:20:32Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8c41d4a7abfc45f3711bd714dff88bd557439152","assignee":{"login":"rfranzke","id":19169361,"node_id":"MDQ6VXNlcjE5MTY5MzYx","avatar_url":"https://avatars1.githubusercontent.com/u/19169361?v=4","gravatar_id":"","url":"https://api.github.com/users/rfranzke","html_url":"https://github.com/rfranzke","followers_url":"https://api.github.com/users/rfranzke/followers","following_url":"https://api.github.com/users/rfranzke/following{/other_user}","gists_url":"https://api.github.com/users/rfranzke/gists{/gist_id}","starred_url":"https://api.github.com/users/rfranzke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfranzke/subscriptions","organizations_url":"https://api.github.com/users/rfranzke/orgs","repos_url":"https://api.github.com/users/rfranzke/repos","events_url":"https://api.github.com/users/rfranzke/events{/privacy}","received_events_url":"https://api.github.com/users/rfranzke/received_events","type":"User","site_admin":false},"assignees":[{"login":"rfranzke","id":19169361,"node_id":"MDQ6VXNlcjE5MTY5MzYx","avatar_url":"https://avatars1.githubusercontent.com/u/19169361?v=4","gravatar_id":"","url":"https://api.github.com/users/rfranzke","html_url":"https://github.com/rfranzke","followers_url":"https://api.github.com/users/rfranzke/followers","following_url":"https://api.github.com/users/rfranzke/following{/other_user}","gists_url":"https://api.github.com/users/rfranzke/gists{/gist_id}","starred_url":"https://api.github.com/users/rfranzke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfranzke/subscriptions","organizations_url":"https://api.github.com/users/rfranzke/orgs","repos_url":"https://api.github.com/users/rfranzke/repos","events_url":"https://api.github.com/users/rfranzke/events{/privacy}","received_events_url":"https://api.github.com/users/rfranzke/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":943536012,"node_id":"MDU6TGFiZWw5NDM1MzYwMTI=","url":"https://api.github.com/repos/gardener/gardener/labels/needs/ok-to-test","name":"needs/ok-to-test","color":"fef2c0","default":false},{"id":841434878,"node_id":"MDU6TGFiZWw4NDE0MzQ4Nzg=","url":"https://api.github.com/repos/gardener/gardener/labels/reviewed/do-not-merge","name":"reviewed/do-not-merge","color":"e11d21","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/gardener/gardener/pulls/1066/commits","review_comments_url":"https://api.github.com/repos/gardener/gardener/pulls/1066/comments","review_comment_url":"https://api.github.com/repos/gardener/gardener/pulls/comments{/number}","comments_url":"https://api.github.com/repos/gardener/gardener/issues/1066/comments","statuses_url":"https://api.github.com/repos/gardener/gardener/statuses/69cbed61636516834de4564d98e66218f2bb9ee1","head":{"label":"michael-engler:EtcdEncryption","ref":"EtcdEncryption","sha":"69cbed61636516834de4564d98e66218f2bb9ee1","user":{"login":"michael-engler","id":47210029,"node_id":"MDQ6VXNlcjQ3MjEwMDI5","avatar_url":"https://avatars0.githubusercontent.com/u/47210029?v=4","gravatar_id":"","url":"https://api.github.com/users/michael-engler","html_url":"https://github.com/michael-engler","followers_url":"https://api.github.com/users/michael-engler/followers","following_url":"https://api.github.com/users/michael-engler/following{/other_user}","gists_url":"https://api.github.com/users/michael-engler/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-engler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-engler/subscriptions","organizations_url":"https://api.github.com/users/michael-engler/orgs","repos_url":"https://api.github.com/users/michael-engler/repos","events_url":"https://api.github.com/users/michael-engler/events{/privacy}","received_events_url":"https://api.github.com/users/michael-engler/received_events","type":"User","site_admin":false},"repo":{"id":180543134,"node_id":"MDEwOlJlcG9zaXRvcnkxODA1NDMxMzQ=","name":"gardener","full_name":"michael-engler/gardener","private":false,"owner":{"login":"michael-engler","id":47210029,"node_id":"MDQ6VXNlcjQ3MjEwMDI5","avatar_url":"https://avatars0.githubusercontent.com/u/47210029?v=4","gravatar_id":"","url":"https://api.github.com/users/michael-engler","html_url":"https://github.com/michael-engler","followers_url":"https://api.github.com/users/michael-engler/followers","following_url":"https://api.github.com/users/michael-engler/following{/other_user}","gists_url":"https://api.github.com/users/michael-engler/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-engler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-engler/subscriptions","organizations_url":"https://api.github.com/users/michael-engler/orgs","repos_url":"https://api.github.com/users/michael-engler/repos","events_url":"https://api.github.com/users/michael-engler/events{/privacy}","received_events_url":"https://api.github.com/users/michael-engler/received_events","type":"User","site_admin":false},"html_url":"https://github.com/michael-engler/gardener","description":"Kubernetes API server extension and controller managing the full lifecycle of conformant Kubernetes clusters (Shoots) as a service on AWS, Azure, GCP, OpenStack, and Alicloud.","fork":true,"url":"https://api.github.com/repos/michael-engler/gardener","forks_url":"https://api.github.com/repos/michael-engler/gardener/forks","keys_url":"https://api.github.com/repos/michael-engler/gardener/keys{/key_id}","collaborators_url":"https://api.github.com/repos/michael-engler/gardener/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/michael-engler/gardener/teams","hooks_url":"https://api.github.com/repos/michael-engler/gardener/hooks","issue_events_url":"https://api.github.com/repos/michael-engler/gardener/issues/events{/number}","events_url":"https://api.github.com/repos/michael-engler/gardener/events","assignees_url":"https://api.github.com/repos/michael-engler/gardener/assignees{/user}","branches_url":"https://api.github.com/repos/michael-engler/gardener/branches{/branch}","tags_url":"https://api.github.com/repos/michael-engler/gardener/tags","blobs_url":"https://api.github.com/repos/michael-engler/gardener/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/michael-engler/gardener/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/michael-engler/gardener/git/refs{/sha}","trees_url":"https://api.github.com/repos/michael-engler/gardener/git/trees{/sha}","statuses_url":"https://api.github.com/repos/michael-engler/gardener/statuses/{sha}","languages_url":"https://api.github.com/repos/michael-engler/gardener/languages","stargazers_url":"https://api.github.com/repos/michael-engler/gardener/stargazers","contributors_url":"https://api.github.com/repos/michael-engler/gardener/contributors","subscribers_url":"https://api.github.com/repos/michael-engler/gardener/subscribers","subscription_url":"https://api.github.com/repos/michael-engler/gardener/subscription","commits_url":"https://api.github.com/repos/michael-engler/gardener/commits{/sha}","git_commits_url":"https://api.github.com/repos/michael-engler/gardener/git/commits{/sha}","comments_url":"https://api.github.com/repos/michael-engler/gardener/comments{/number}","issue_comment_url":"https://api.github.com/repos/michael-engler/gardener/issues/comments{/number}","contents_url":"https://api.github.com/repos/michael-engler/gardener/contents/{+path}","compare_url":"https://api.github.com/repos/michael-engler/gardener/compare/{base}...{head}","merges_url":"https://api.github.com/repos/michael-engler/gardener/merges","archive_url":"https://api.github.com/repos/michael-engler/gardener/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/michael-engler/gardener/downloads","issues_url":"https://api.github.com/repos/michael-engler/gardener/issues{/number}","pulls_url":"https://api.github.com/repos/michael-engler/gardener/pulls{/number}","milestones_url":"https://api.github.com/repos/michael-engler/gardener/milestones{/number}","notifications_url":"https://api.github.com/repos/michael-engler/gardener/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/michael-engler/gardener/labels{/name}","releases_url":"https://api.github.com/repos/michael-engler/gardener/releases{/id}","deployments_url":"https://api.github.com/repos/michael-engler/gardener/deployments","created_at":"2019-04-10T09:00:14Z","updated_at":"2019-06-04T13:27:21Z","pushed_at":"2019-06-06T13:58:11Z","git_url":"git://github.com/michael-engler/gardener.git","ssh_url":"git@github.com:michael-engler/gardener.git","clone_url":"https://github.com/michael-engler/gardener.git","svn_url":"https://github.com/michael-engler/gardener","homepage":"https://gardener.cloud","size":27886,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"gardener:master","ref":"master","sha":"185d265f7c588f859c639a0d6692c72adaf1788a","user":{"login":"gardener","id":33683699,"node_id":"MDEyOk9yZ2FuaXphdGlvbjMzNjgzNjk5","avatar_url":"https://avatars2.githubusercontent.com/u/33683699?v=4","gravatar_id":"","url":"https://api.github.com/users/gardener","html_url":"https://github.com/gardener","followers_url":"https://api.github.com/users/gardener/followers","following_url":"https://api.github.com/users/gardener/following{/other_user}","gists_url":"https://api.github.com/users/gardener/gists{/gist_id}","starred_url":"https://api.github.com/users/gardener/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gardener/subscriptions","organizations_url":"https://api.github.com/users/gardener/orgs","repos_url":"https://api.github.com/users/gardener/repos","events_url":"https://api.github.com/users/gardener/events{/privacy}","received_events_url":"https://api.github.com/users/gardener/received_events","type":"Organization","site_admin":false},"repo":{"id":117377862,"node_id":"MDEwOlJlcG9zaXRvcnkxMTczNzc4NjI=","name":"gardener","full_name":"gardener/gardener","private":false,"owner":{"login":"gardener","id":33683699,"node_id":"MDEyOk9yZ2FuaXphdGlvbjMzNjgzNjk5","avatar_url":"https://avatars2.githubusercontent.com/u/33683699?v=4","gravatar_id":"","url":"https://api.github.com/users/gardener","html_url":"https://github.com/gardener","followers_url":"https://api.github.com/users/gardener/followers","following_url":"https://api.github.com/users/gardener/following{/other_user}","gists_url":"https://api.github.com/users/gardener/gists{/gist_id}","starred_url":"https://api.github.com/users/gardener/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gardener/subscriptions","organizations_url":"https://api.github.com/users/gardener/orgs","repos_url":"https://api.github.com/users/gardener/repos","events_url":"https://api.github.com/users/gardener/events{/privacy}","received_events_url":"https://api.github.com/users/gardener/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/gardener/gardener","description":"Kubernetes API server extension and controller managing the full lifecycle of conformant Kubernetes clusters as a service on Alicloud, AWS, Azure, GCP, and OpenStack with minimal TCO.","fork":false,"url":"https://api.github.com/repos/gardener/gardener","forks_url":"https://api.github.com/repos/gardener/gardener/forks","keys_url":"https://api.github.com/repos/gardener/gardener/keys{/key_id}","collaborators_url":"https://api.github.com/repos/gardener/gardener/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/gardener/gardener/teams","hooks_url":"https://api.github.com/repos/gardener/gardener/hooks","issue_events_url":"https://api.github.com/repos/gardener/gardener/issues/events{/number}","events_url":"https://api.github.com/repos/gardener/gardener/events","assignees_url":"https://api.github.com/repos/gardener/gardener/assignees{/user}","branches_url":"https://api.github.com/repos/gardener/gardener/branches{/branch}","tags_url":"https://api.github.com/repos/gardener/gardener/tags","blobs_url":"https://api.github.com/repos/gardener/gardener/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/gardener/gardener/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/gardener/gardener/git/refs{/sha}","trees_url":"https://api.github.com/repos/gardener/gardener/git/trees{/sha}","statuses_url":"https://api.github.com/repos/gardener/gardener/statuses/{sha}","languages_url":"https://api.github.com/repos/gardener/gardener/languages","stargazers_url":"https://api.github.com/repos/gardener/gardener/stargazers","contributors_url":"https://api.github.com/repos/gardener/gardener/contributors","subscribers_url":"https://api.github.com/repos/gardener/gardener/subscribers","subscription_url":"https://api.github.com/repos/gardener/gardener/subscription","commits_url":"https://api.github.com/repos/gardener/gardener/commits{/sha}","git_commits_url":"https://api.github.com/repos/gardener/gardener/git/commits{/sha}","comments_url":"https://api.github.com/repos/gardener/gardener/comments{/number}","issue_comment_url":"https://api.github.com/repos/gardener/gardener/issues/comments{/number}","contents_url":"https://api.github.com/repos/gardener/gardener/contents/{+path}","compare_url":"https://api.github.com/repos/gardener/gardener/compare/{base}...{head}","merges_url":"https://api.github.com/repos/gardener/gardener/merges","archive_url":"https://api.github.com/repos/gardener/gardener/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/gardener/gardener/downloads","issues_url":"https://api.github.com/repos/gardener/gardener/issues{/number}","pulls_url":"https://api.github.com/repos/gardener/gardener/pulls{/number}","milestones_url":"https://api.github.com/repos/gardener/gardener/milestones{/number}","notifications_url":"https://api.github.com/repos/gardener/gardener/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/gardener/gardener/labels{/name}","releases_url":"https://api.github.com/repos/gardener/gardener/releases{/id}","deployments_url":"https://api.github.com/repos/gardener/gardener/deployments","created_at":"2018-01-13T20:57:47Z","updated_at":"2019-06-19T07:34:19Z","pushed_at":"2019-06-19T07:34:16Z","git_url":"git://github.com/gardener/gardener.git","ssh_url":"git@github.com:gardener/gardener.git","clone_url":"https://github.com/gardener/gardener.git","svn_url":"https://github.com/gardener/gardener","homepage":"https://gardener.cloud","size":28304,"stargazers_count":1071,"watchers_count":1071,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":146,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":70,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":146,"open_issues":70,"watchers":1071,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/gardener/gardener/pulls/1066"},"html":{"href":"https://github.com/gardener/gardener/pull/1066"},"issue":{"href":"https://api.github.com/repos/gardener/gardener/issues/1066"},"comments":{"href":"https://api.github.com/repos/gardener/gardener/issues/1066/comments"},"review_comments":{"href":"https://api.github.com/repos/gardener/gardener/pulls/1066/comments"},"review_comment":{"href":"https://api.github.com/repos/gardener/gardener/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/gardener/gardener/pulls/1066/commits"},"statuses":{"href":"https://api.github.com/repos/gardener/gardener/statuses/69cbed61636516834de4564d98e66218f2bb9ee1"}},"author_association":"NONE"}}
{"actor":{"display_login":"rfranzke"}}