S3 bucket encryption - Githubissues

jetstack / tarmak

A toolkit for Kubernetes cluster provisioning and lifecycle management

Apache License 2.0

269 stars 49 forks source link

S3 bucket encryption #467

Closed MattiasGees closed 6 years ago

MattiasGees commented 6 years ago

Is this a BUG REPORT or FEATURE REQUEST?:

Uncomment only one, leave it on its own line:

/kind bug /kind feature

What happened: At the moment the S3 buckets created by tarmak for the kubernetes state store and the vault unsealer secrets are not encrypted

What you expected to happen: Encrypted bucket

How to reproduce it (as minimally and precisely as possible): Setup a k8s cluster with Tarmak

Anything else we need to know?:

Environment:

Kubernetes version (use kubectl version):
Cloud provider or hardware configuration**:
Install tools:
Others:

simonswine commented 6 years ago

Basically we have those assets stored in buckets:

Terraform state. This should be transparent (after a run of terraform init) using remote state options
Consul backups (they are already encrypted, but a KMS would not hurt)
Vault TLS secrets are already KMS encrypted
Puppet.tar.gz is not KMS encrypted and it will break comparison performed by terraform (https://www.terraform.io/docs/providers/aws/r/s3_bucket_object.html#etag-1), idea using md5 in key of the s3 object. (This will break the fallback mode)

JoshVanL commented 6 years ago

/reopen

jetstack-bot commented 6 years ago

@JoshVanL: Reopening this issue.

In response to [this](https://github.com/jetstack/tarmak/issues/467#issuecomment-423241063): >/reopen Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.