Add support for Customer Managed Encryption Key

Add support for The Customer Managed Encryption Key used to encrypt
the boot disk attached to each node in the node pool.

For more information about protecting resources with Cloud KMS Keys please see:
  https://cloud.google.com/compute/docs/disks/customer-managed-encryption

Issue: #261

charts/gke-operator-crd/templates/crds.yaml

@@ -43,6 +43,16 @@ spec:
               clusterName:
                 nullable: true
                 type: string
+              customerManagedEncryptionKey:
+                nullable: true
+                properties:
+                  keyName:
+                    nullable: true
+                    type: string
+                  ringName:
+                    nullable: true
+                    type: string
+                type: object
               description:
                 nullable: true
                 type: string
@@ -144,6 +154,9 @@ spec:
                     config:
                       nullable: true
                       properties:
+                        bootDiskKmsKey:
+                          nullable: true
+                          type: string
                         diskSizeGb:
                           type: integer
                         diskType:

controller/gke-cluster-config-handler.go

@@ -658,14 +658,15 @@ func BuildUpstreamClusterState(cluster *gkeapi.Cluster) (*gkev1.GKEClusterConfig
 
 		if np.Config != nil {
 			newNP.Config = &gkev1.GKENodeConfig{
-				DiskSizeGb:    np.Config.DiskSizeGb,
-				DiskType:      np.Config.DiskType,
-				ImageType:     np.Config.ImageType,
-				Labels:        np.Config.Labels,
-				LocalSsdCount: np.Config.LocalSsdCount,
-				MachineType:   np.Config.MachineType,
-				Preemptible:   np.Config.Preemptible,
-				Tags:          np.Config.Tags,
+				BootDiskKmsKey: np.Config.BootDiskKmsKey,
+				DiskSizeGb:     np.Config.DiskSizeGb,
+				DiskType:       np.Config.DiskType,
+				ImageType:      np.Config.ImageType,
+				Labels:         np.Config.Labels,
+				LocalSsdCount:  np.Config.LocalSsdCount,
+				MachineType:    np.Config.MachineType,
+				Preemptible:    np.Config.Preemptible,
+				Tags:           np.Config.Tags,
 			}
 
 			newNP.Config.Taints = make([]gkev1.GKENodeTaintConfig, 0, len(np.Config.Taints))

pkg/apis/gke.cattle.io/v1/types.go

@@ -139,6 +139,11 @@ type GKEClusterConfigSpec struct {
 	// including your nodes, scaling, security, and other preconfigured settings.
 	// +optional
 	AutopilotConfig *GKEAutopilotConfig `json:"autopilotConfig,omitempty"`
+
+	// The Customer Managed Encryption Key Config used to encrypt the boot disk attached
+	// to each node in the node pool.
+	// +optional
+	CustomerManagedEncryptionKey *CMEKConfig `json:"customerManagedEncryptionKey,omitempty"`
 }
 
 type GKEIPAllocationPolicy struct {
@@ -266,6 +271,13 @@ type GKENodePoolAutoscaling struct {
 }
 
 type GKENodeConfig struct {
+	// BootDiskKmsKey it the Customer Managed Encryption Key used to encrypt
+	// the boot disk attached to each node in the node pool. This should be
+	// of the form
+	// projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEY_RING_NAME]/cryptoKeys/[KEY_NAME]
+	// +optional
+	BootDiskKmsKey string `json:"bootDiskKmsKey,omitempty"`
+
 	// DiskSizeGb is the size of the node's disk in gigabytes.
 	// +optional
 	DiskSizeGb int64 `json:"diskSizeGb,omitempty"`
@@ -359,3 +371,16 @@ type GKENodePoolManagement struct {
 type GKEAutopilotConfig struct {
 	Enabled bool `json:"enabled,omitempty"`
 }
+
+// The Customer Managed Encryption Key Config struct
+// used to provide ring name and key name for encryption
+// the boot disk attached to each node in the node pool.
+// +optional
+type CMEKConfig struct {
+	// KeyName is the name of the key to use for encryption.
+	// It has to be provided together with RingName.
+	KeyName string `json:"keyName,omitempty"`
+	// RingName is the name of the ring to use for encryption.
+	// It has to be provided together with KeyName.
+	RingName string `json:"ringName,omitempty"`
+}

pkg/gke/create.go

@@ -190,6 +190,13 @@ func validateCreateRequest(ctx context.Context, gkeClient services.GKEClusterSer
 		}
 	}
 
+	if config.Spec.CustomerManagedEncryptionKey != nil {
+		if config.Spec.CustomerManagedEncryptionKey.RingName == "" ||
+			config.Spec.CustomerManagedEncryptionKey.KeyName == "" {
+			return fmt.Errorf("ringName and keyName are required to enable boot disk encryption for Node Pools")
+		}
+	}
+
 	operation, err := gkeClient.ClusterList(
 		ctx, LocationRRN(config.Spec.ProjectID, Location(config.Spec.Region, config.Spec.Zone)))
 	if err != nil {
@@ -337,6 +344,16 @@ func newGKENodePoolFromConfig(np *gkev1.GKENodePoolConfig, config *gkev1.GKEClus
 			AutoUpgrade: np.Management.AutoUpgrade,
 		},
 	}
+	if config.Spec.CustomerManagedEncryptionKey != nil &&
+		config.Spec.CustomerManagedEncryptionKey.RingName != "" &&
+		config.Spec.CustomerManagedEncryptionKey.KeyName != "" {
+		ret.Config.BootDiskKmsKey = BootDiskRRN(
+			config.Spec.ProjectID,
+			Location(config.Spec.Region, config.Spec.Zone),
+			config.Spec.CustomerManagedEncryptionKey.RingName,
+			config.Spec.CustomerManagedEncryptionKey.KeyName,
+		)
+	}
 	if config.Spec.IPAllocationPolicy != nil && config.Spec.IPAllocationPolicy.UseIPAliases {
 		ret.MaxPodsConstraint = &gkeapi.MaxPodsConstraint{
 			MaxPodsPerNode: *np.MaxPodsConstraint,

pkg/gke/create_test.go

@@ -100,6 +100,43 @@ var _ = Describe("CreateCluster", func() {
 		Expect(managedCluster.Name).To(Equal(config.Spec.ClusterName))
 	})
 
+	It("should successfully create cluster with customer managment encryption key", func() {
+		config.Spec.CustomerManagedEncryptionKey = &gkev1.CMEKConfig{
+			KeyName:  "test-key",
+			RingName: "test-keyring",
+		}
+		createClusterRequest := newClusterCreateRequest(config)
+		clusterServiceMock.EXPECT().
+			ClusterCreate(
+				ctx,
+				LocationRRN(config.Spec.ProjectID, Location(config.Spec.Region, config.Spec.Zone)),
+				createClusterRequest).
+			Return(&gkeapi.Operation{}, nil)
+
+		clusterServiceMock.EXPECT().
+			ClusterList(
+				ctx,
+				LocationRRN(config.Spec.ProjectID, Location(config.Spec.Region, config.Spec.Zone))).
+			Return(&gkeapi.ListClustersResponse{}, nil)
+
+		err := Create(ctx, clusterServiceMock, config)
+		Expect(err).ToNot(HaveOccurred())
+
+		clusterServiceMock.EXPECT().
+			ClusterGet(
+				ctx,
+				ClusterRRN(config.Spec.ProjectID, Location(config.Spec.Region, config.Spec.Zone),
+					config.Spec.ClusterName)).
+			Return(
+				&gkeapi.Cluster{
+					Name: "test-cluster",
+				}, nil)
+
+		managedCluster, err := GetCluster(ctx, clusterServiceMock, &config.Spec)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(managedCluster.Name).To(Equal(config.Spec.ClusterName))
+	})
+
 	It("should fail to create cluster", func() {
 		clusterServiceMock.EXPECT().
 			ClusterList(
@@ -156,6 +193,14 @@ var _ = Describe("CreateCluster", func() {
 		Expect(managedCluster.Name).To(Equal(config.Spec.ClusterName))
 	})
 
+	It("should fail create cluster with customer managment encryption key", func() {
+		config.Spec.CustomerManagedEncryptionKey = &gkev1.CMEKConfig{
+			KeyName: "test-key",
+		}
+		err := Create(ctx, clusterServiceMock, config)
+		Expect(err).To(HaveOccurred())
+	})
+
 	It("should fail to create autopilot cluster with nodepools", func() {
 		config.Spec.ClusterName = "test-autopilot-cluster"
 		config.Spec.AutopilotConfig = &gkev1.GKEAutopilotConfig{

pkg/gke/relative_resource_name.go

@@ -35,3 +35,9 @@ func ClusterRRN(projectID, location, clusterName string) string {
 func NodePoolRRN(projectID, location, clusterName, nodePool string) string {
 	return fmt.Sprintf("%s/nodePools/%s", ClusterRRN(projectID, location, clusterName), nodePool)
 }
+
+// BootDiskRRN returns a Relative Resource Name of a disk key in the region or zone for the
+// specified project
+func BootDiskRRN(projectID, location, ringName, keyName string) string {
+	return fmt.Sprintf("projects/%s/locations/%s/keyRings/%s/cryptoKeys/%s", projectID, location, ringName, keyName)
+}