Skip to content

Commit d8ad2b4

Browse files
tthvotthvo
committed
CORS-4337: allow AWS Europe Sovereign Cloud partition
In AWS European Sovereign Cloud, ARNs begin with "arn:aws-eusc:". Thus, we need to update the validation to allow this new format. See https://docs.aws.eu/general/latest/gr/arns.html
1 parent d34f11c commit d8ad2b4

38 files changed

Lines changed: 206 additions & 49 deletions

File tree

‎config/v1/tests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml‎

Lines changed: 89 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,81 @@ tests:
3030
aws:
3131
keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
3232
region: us-east-1
33+
- name: Should be able to create encrypt with KMS for AWS with aws-cn partition
34+
initial: |
35+
apiVersion: config.openshift.io/v1
36+
kind: APIServer
37+
spec:
38+
encryption:
39+
type: KMS
40+
kms:
41+
type: AWS
42+
aws:
43+
keyARN: arn:aws-cn:kms:cn-north-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
44+
region: cn-north-1
45+
expected: |
46+
apiVersion: config.openshift.io/v1
47+
kind: APIServer
48+
spec:
49+
audit:
50+
profile: Default
51+
encryption:
52+
type: KMS
53+
kms:
54+
type: AWS
55+
aws:
56+
keyARN: arn:aws-cn:kms:cn-north-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
57+
region: cn-north-1
58+
- name: Should be able to create encrypt with KMS for AWS with aws-us-gov partition
59+
initial: |
60+
apiVersion: config.openshift.io/v1
61+
kind: APIServer
62+
spec:
63+
encryption:
64+
type: KMS
65+
kms:
66+
type: AWS
67+
aws:
68+
keyARN: arn:aws-us-gov:kms:us-gov-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
69+
region: us-gov-east-1
70+
expected: |
71+
apiVersion: config.openshift.io/v1
72+
kind: APIServer
73+
spec:
74+
audit:
75+
profile: Default
76+
encryption:
77+
type: KMS
78+
kms:
79+
type: AWS
80+
aws:
81+
keyARN: arn:aws-us-gov:kms:us-gov-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
82+
region: us-gov-east-1
83+
- name: Should be able to create encrypt with KMS for AWS with aws-eusc partition
84+
initial: |
85+
apiVersion: config.openshift.io/v1
86+
kind: APIServer
87+
spec:
88+
encryption:
89+
type: KMS
90+
kms:
91+
type: AWS
92+
aws:
93+
keyARN: arn:aws-eusc:kms:eusc-de-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
94+
region: eusc-de-east-1
95+
expected: |
96+
apiVersion: config.openshift.io/v1
97+
kind: APIServer
98+
spec:
99+
audit:
100+
profile: Default
101+
encryption:
102+
type: KMS
103+
kms:
104+
type: AWS
105+
aws:
106+
keyARN: arn:aws-eusc:kms:eusc-de-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
107+
region: eusc-de-east-1
33108
- name: Should fail to create encrypt with KMS for AWS without region
34109
initial: |
35110
apiVersion: config.openshift.io/v1
@@ -98,7 +173,20 @@ tests:
98173
aws:
99174
keyARN: not-a-kms-arn
100175
region: us-east-1
101-
expectedError: "keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
176+
expectedError: "keyARN must follow the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
177+
- name: Should fail to create AWS KMS with invalid partition
178+
initial: |
179+
apiVersion: config.openshift.io/v1
180+
kind: APIServer
181+
spec:
182+
encryption:
183+
type: KMS
184+
kms:
185+
type: AWS
186+
aws:
187+
keyARN: arn:aws-invalid:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
188+
region: us-east-1
189+
expectedError: "keyARN must follow the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
102190
- name: Should fail to create AWS KMS with empty region
103191
initial: |
104192
apiVersion: config.openshift.io/v1

‎config/v1/tests/dnses.config.openshift.io/AAA_ungated.yaml‎

Lines changed: 64 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,57 @@ tests:
2929
type: AWS
3030
aws:
3131
privateZoneIAMRole: arn:aws:iam::123456789012:role/foo
32+
- name: Should be able to specify an AWS role ARN with aws-cn partition
33+
initial: |
34+
apiVersion: config.openshift.io/v1
35+
kind: DNS
36+
spec:
37+
platform:
38+
type: AWS
39+
aws:
40+
privateZoneIAMRole: arn:aws-cn:iam::123456789012:role/foo
41+
expected: |
42+
apiVersion: config.openshift.io/v1
43+
kind: DNS
44+
spec:
45+
platform:
46+
type: AWS
47+
aws:
48+
privateZoneIAMRole: arn:aws-cn:iam::123456789012:role/foo
49+
- name: Should be able to specify an AWS role ARN with aws-us-gov partition
50+
initial: |
51+
apiVersion: config.openshift.io/v1
52+
kind: DNS
53+
spec:
54+
platform:
55+
type: AWS
56+
aws:
57+
privateZoneIAMRole: arn:aws-us-gov:iam::123456789012:role/foo
58+
expected: |
59+
apiVersion: config.openshift.io/v1
60+
kind: DNS
61+
spec:
62+
platform:
63+
type: AWS
64+
aws:
65+
privateZoneIAMRole: arn:aws-us-gov:iam::123456789012:role/foo
66+
- name: Should be able to specify an AWS role ARN with aws-eusc partition
67+
initial: |
68+
apiVersion: config.openshift.io/v1
69+
kind: DNS
70+
spec:
71+
platform:
72+
type: AWS
73+
aws:
74+
privateZoneIAMRole: arn:aws-eusc:iam::123456789012:role/foo
75+
expected: |
76+
apiVersion: config.openshift.io/v1
77+
kind: DNS
78+
spec:
79+
platform:
80+
type: AWS
81+
aws:
82+
privateZoneIAMRole: arn:aws-eusc:iam::123456789012:role/foo
3283
- name: Should not be able to specify unsupported platform
3384
initial: |
3485
apiVersion: config.openshift.io/v1
@@ -50,7 +101,19 @@ tests:
50101
type: AWS
51102
aws:
52103
privateZoneIAMRole: arn:aws:iam:bad:123456789012:role/foo
53-
expectedError: "DNS.config.openshift.io \"cluster\" is invalid: spec.platform.aws.privateZoneIAMRole: Invalid value: \"arn:aws:iam:bad:123456789012:role/foo\": spec.platform.aws.privateZoneIAMRole in body should match '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\\/.*$'"
104+
expectedError: "DNS.config.openshift.io \"cluster\" is invalid: spec.platform.aws.privateZoneIAMRole: Invalid value: \"arn:aws:iam:bad:123456789012:role/foo\": spec.platform.aws.privateZoneIAMRole in body should match '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role\\/.*$'"
105+
- name: Should not be able to specify invalid AWS partition
106+
initial: |
107+
apiVersion: config.openshift.io/v1
108+
kind: DNS
109+
metadata:
110+
name: cluster
111+
spec:
112+
platform:
113+
type: AWS
114+
aws:
115+
privateZoneIAMRole: arn:aws-invalid:iam::123456789012:role/foo
116+
expectedError: "DNS.config.openshift.io \"cluster\" is invalid: spec.platform.aws.privateZoneIAMRole: Invalid value: \"arn:aws-invalid:iam::123456789012:role/foo\": spec.platform.aws.privateZoneIAMRole in body should match '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role\\/.*$'"
54117
- name: Should not be able to specify different type and platform
55118
initial: |
56119
apiVersion: config.openshift.io/v1

‎config/v1/types_dns.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ type AWSDNSSpec struct {
134134
// privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
135135
// operations on the cluster's private hosted zone specified in the cluster DNS config.
136136
// When left empty, no role should be assumed.
137-
// +kubebuilder:validation:Pattern:=`^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$`
137+
// +kubebuilder:validation:Pattern:=`^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role\/.*$`
138138
// +optional
139139
PrivateZoneIAMRole string `json:"privateZoneIAMRole"`
140140
}

‎config/v1/types_kmsencryption.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,15 @@ type KMSConfig struct {
2424
// AWSKMSConfig defines the KMS config specific to AWS KMS provider
2525
type AWSKMSConfig struct {
2626
// keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
27-
// The value must adhere to the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`, where:
27+
// The value must adhere to the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`, where:
28+
// - `<partition>` is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc).
2829
// - `<region>` is the AWS region consisting of lowercase letters and hyphens followed by a number.
2930
// - `<account_id>` is a 12-digit numeric identifier for the AWS account.
3031
// - `<key_id>` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
3132
//
3233
// +kubebuilder:validation:MaxLength=128
3334
// +kubebuilder:validation:MinLength=1
34-
// +kubebuilder:validation:XValidation:rule="self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')",message="keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
35+
// +kubebuilder:validation:XValidation:rule="self.matches('^arn:(aws|aws-cn|aws-us-gov|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')",message="keyARN must follow the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
3536
// +required
3637
KeyARN string `json:"keyARN"`
3738
// region specifies the AWS region where the KMS instance exists, and follows the format

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -177,19 +177,20 @@ spec:
177177
keyARN:
178178
description: |-
179179
keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
180-
The value must adhere to the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`, where:
180+
The value must adhere to the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`, where:
181+
- `<partition>` is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc).
181182
- `<region>` is the AWS region consisting of lowercase letters and hyphens followed by a number.
182183
- `<account_id>` is a 12-digit numeric identifier for the AWS account.
183184
- `<key_id>` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
184185
maxLength: 128
185186
minLength: 1
186187
type: string
187188
x-kubernetes-validations:
188-
- message: keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`.
189+
- message: keyARN must follow the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`.
189190
The account ID must be a 12 digit number and the region
190191
and key ID should consist only of lowercase hexadecimal
191192
characters and hyphens (-).
192-
rule: self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
193+
rule: self.matches('^arn:(aws|aws-cn|aws-us-gov|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
193194
region:
194195
description: |-
195196
region specifies the AWS region where the KMS instance exists, and follows the format

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -177,19 +177,20 @@ spec:
177177
keyARN:
178178
description: |-
179179
keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
180-
The value must adhere to the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`, where:
180+
The value must adhere to the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`, where:
181+
- `<partition>` is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc).
181182
- `<region>` is the AWS region consisting of lowercase letters and hyphens followed by a number.
182183
- `<account_id>` is a 12-digit numeric identifier for the AWS account.
183184
- `<key_id>` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
184185
maxLength: 128
185186
minLength: 1
186187
type: string
187188
x-kubernetes-validations:
188-
- message: keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`.
189+
- message: keyARN must follow the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`.
189190
The account ID must be a 12 digit number and the region
190191
and key ID should consist only of lowercase hexadecimal
191192
characters and hyphens (-).
192-
rule: self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
193+
rule: self.matches('^arn:(aws|aws-cn|aws-us-gov|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
193194
region:
194195
description: |-
195196
region specifies the AWS region where the KMS instance exists, and follows the format

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses.crd.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ spec:
7171
privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
7272
operations on the cluster's private hosted zone specified in the cluster DNS config.
7373
When left empty, no role should be assumed.
74-
pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
74+
pattern: ^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role\/.*$
7575
type: string
7676
type: object
7777
type:

‎config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -177,19 +177,20 @@ spec:
177177
keyARN:
178178
description: |-
179179
keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
180-
The value must adhere to the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`, where:
180+
The value must adhere to the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`, where:
181+
- `<partition>` is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc).
181182
- `<region>` is the AWS region consisting of lowercase letters and hyphens followed by a number.
182183
- `<account_id>` is a 12-digit numeric identifier for the AWS account.
183184
- `<key_id>` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
184185
maxLength: 128
185186
minLength: 1
186187
type: string
187188
x-kubernetes-validations:
188-
- message: keyARN must follow the format `arn:aws:kms:<region>:<account_id>:key/<key_id>`.
189+
- message: keyARN must follow the format `arn:<partition>:kms:<region>:<account_id>:key/<key_id>`.
189190
The account ID must be a 12 digit number and the region
190191
and key ID should consist only of lowercase hexadecimal
191192
characters and hyphens (-).
192-
rule: self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
193+
rule: self.matches('^arn:(aws|aws-cn|aws-us-gov|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
193194
region:
194195
description: |-
195196
region specifies the AWS region where the KMS instance exists, and follows the format

‎config/v1/zz_generated.featuregated-crd-manifests/dnses.config.openshift.io/AAA_ungated.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ spec:
7272
privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
7373
operations on the cluster's private hosted zone specified in the cluster DNS config.
7474
When left empty, no role should be assumed.
75-
pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
75+
pattern: ^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role\/.*$
7676
type: string
7777
type: object
7878
type:

‎config/v1/zz_generated.swagger_doc_generated.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)