From 76296fa1f5ff2aa3cb36b90c481d0da4058f693b Mon Sep 17 00:00:00 2001 From: Hilliary Lipsig Date: Wed, 19 Aug 2026 10:34:02 -0700 Subject: [PATCH 1/8] feat(api): add Azure Managed HSM support - Add AzureKMSKeyVaultType to AzureKMSSpec with backward-compatible immutability validation - Support Public, US Government, China, German, and Bleu Azure clouds - Accept Managed HSM encryption key URLs and regenerate feature-gated API manifests Signed-off-by: Hilliary Lipsig Commit-Message-Assisted-by: Claude (via Claude Code) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- api/hypershift/v1beta1/azure.go | 34 +++++++++++++++---- api/hypershift/v1beta1/etcdbackup_types.go | 27 ++++++++------- .../HCPEtcdBackup.yaml | 22 ++++++------ 3 files changed, 55 insertions(+), 28 deletions(-) diff --git a/api/hypershift/v1beta1/azure.go b/api/hypershift/v1beta1/azure.go index dafc4aa67154..2a13273825a6 100644 --- a/api/hypershift/v1beta1/azure.go +++ b/api/hypershift/v1beta1/azure.go @@ -365,9 +365,9 @@ type AzureNodePoolOSDisk struct { // +kubebuilder:validation:XValidation:rule="!has(self.topology) || ((self.topology == 'Private' || self.topology == 'PublicAndPrivate') ? has(self.private) : !has(self.private))",message="private is required when topology is Private or PublicAndPrivate, and forbidden otherwise" // +kubebuilder:validation:XValidation:rule="!has(self.private) || self.private.type != 'PrivateLink' || self.azureAuthenticationConfig.azureAuthenticationConfigType != 'WorkloadIdentities' || has(self.azureAuthenticationConfig.workloadIdentities.controlPlaneOperator)",message="workloadIdentities.controlPlaneOperator is required when Private Link is configured with WorkloadIdentities authentication" type AzurePlatformSpec struct { - // cloud is the cloud environment identifier, valid values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33 + // cloud is the Azure cloud environment identifier. // - // +kubebuilder:validation:Enum=AzurePublicCloud;AzureUSGovernmentCloud;AzureChinaCloud;AzureGermanCloud;AzureStackCloud + // +kubebuilder:validation:Enum=AzurePublicCloud;AzureUSGovernmentCloud;AzureChinaCloud;AzureGermanCloud;AzureBleuCloud;AzureStackCloud // +kubebuilder:default="AzurePublicCloud" // +optional Cloud string `json:"cloud,omitempty"` @@ -914,9 +914,10 @@ const ( AzureKeyVaultPrivate AzureKeyVaultAccessType = "Private" ) -// AzureKMSSpec defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure key vault +// AzureKMSSpec defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure Key Vault or Managed HSM. // // +kubebuilder:validation:XValidation:rule="!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName",message="backupKey.keyVaultName must match activeKey.keyVaultName; both keys must reside in the same Key Vault" +// +kubebuilder:validation:XValidation:rule="(has(self.keyVaultType) ? self.keyVaultType : 'KeyVault') == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : 'KeyVault')",message="keyVaultType is immutable" type AzureKMSSpec struct { // activeKey defines the active key used to encrypt new secrets // @@ -935,6 +936,15 @@ type AzureKMSSpec struct { // +required KMS ManagedIdentity `json:"kms"` + // keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + // Valid values are "KeyVault" and "ManagedHSM". + // When set to "KeyVault", both keys are hosted by Azure Key Vault. + // When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + // The type is immutable; key rotation must remain within the same service. + // When omitted, the keys are treated as Key Vault keys. + // +optional + KeyVaultType AzureKMSKeyVaultType `json:"keyVaultType,omitempty"` + // keyVaultAccess specifies how the Key Vault should be accessed. // When set to "Private", the control plane routes Key Vault traffic through // the private router to reach the Key Vault's private endpoint in the customer VNet. @@ -944,16 +954,28 @@ type AzureKMSSpec struct { KeyVaultAccess AzureKeyVaultAccessType `json:"keyVaultAccess,omitempty"` } +// AzureKMSKeyVaultType specifies the Azure service that hosts a KMS key. +// +kubebuilder:validation:Enum=KeyVault;ManagedHSM +type AzureKMSKeyVaultType string + +const ( + // AzureKMSKeyVaultTypeKeyVault indicates that the key is hosted by Azure Key Vault. + AzureKMSKeyVaultTypeKeyVault AzureKMSKeyVaultType = "KeyVault" + // AzureKMSKeyVaultTypeManagedHSM indicates that the key is hosted by Azure Managed HSM. + AzureKMSKeyVaultTypeManagedHSM AzureKMSKeyVaultType = "ManagedHSM" +) + +// AzureKMSKey defines an Azure Key Vault or Managed HSM key used for KMS encryption. type AzureKMSKey struct { - // keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - // Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + // keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + // Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: // `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required KeyVaultName string `json:"keyVaultName,omitempty"` - // keyName is the name of the keyvault key used for encrypt/decrypt + // keyName is the name of the key used for encrypt/decrypt. // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required diff --git a/api/hypershift/v1beta1/etcdbackup_types.go b/api/hypershift/v1beta1/etcdbackup_types.go index d59ef4752a95..f9a97a482af4 100644 --- a/api/hypershift/v1beta1/etcdbackup_types.go +++ b/api/hypershift/v1beta1/etcdbackup_types.go @@ -178,14 +178,15 @@ type HCPEtcdBackupAzureBlob struct { // +required Credentials SecretReference `json:"credentials,omitzero"` - // encryptionKeyURL is the URL of the Azure Key Vault key used for encryption. - // Must be a valid Azure Key Vault key URL in the format - // "https://.vault.azure.net/keys/[/]". + // encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption. + // Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + // Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + // Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. // This field is immutable once set and cannot be removed. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=210 - // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.(vault\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr)|managedhsm\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault or Managed HSM HTTPS URL" // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="encryptionKeyURL is immutable" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } @@ -249,13 +250,14 @@ type HCPEtcdBackupEncryptionMetadataAWS struct { // HCPEtcdBackupEncryptionMetadataAzure contains Azure-specific encryption metadata. // The values here reflect the encryption settings from the HCPEtcdBackupConfig input. type HCPEtcdBackupEncryptionMetadataAzure struct { - // encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. - // Must be a valid Azure Key Vault key URL in the format - // "https://.vault.azure.net/keys/[/]". + // encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption of the backup. + // Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + // Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + // Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=210 - // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.(vault\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr)|managedhsm\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault or Managed HSM HTTPS URL" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } @@ -349,12 +351,13 @@ type HCPEtcdBackupConfigAWS struct { // HCPEtcdBackupConfigAzure defines Azure-specific encryption settings for etcd backups. type HCPEtcdBackupConfigAzure struct { - // encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. - // Must be a valid Azure Key Vault key URL in the format - // "https://.vault.azure.net/keys/[/]". + // encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. + // Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + // Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + // Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=210 - // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.(vault\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr)|managedhsm\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault or Managed HSM HTTPS URL" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yaml index 6017107c92b8..08fbdfc4f007 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -101,17 +101,18 @@ spec: type: object encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key used for encryption. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. This field is immutable once set and cannot be removed. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure Key Vault - HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') - message: encryptionKeyURL is immutable rule: self == oldSelf keyPrefix: @@ -372,16 +373,17 @@ spec: properties: encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption of the backup. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure Key Vault - HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object From badc2db5676505d1c66df8ab2c180d799e0d1b9c Mon Sep 17 00:00:00 2001 From: Hilliary Lipsig Date: Wed, 19 Aug 2026 10:34:02 -0700 Subject: [PATCH 2/8] chore(api): regenerate CRDs, clients, and vendor - Regenerate install CRDs and validation suites for Managed HSM and sovereign clouds - Cover immutable vault type transitions and all supported Azure key URL suffixes - Update the AzureKMSSpec client and vendored HyperShift API types Signed-off-by: Hilliary Lipsig Commit-Message-Assisted-by: Claude (via Claude Code) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../hypershift/v1beta1/azurekmsspec.go | 9 ++ ...d.hostedclusters.etcdbackup.testsuite.yaml | 48 +++++++ ...stable.hostedclusters.azure.testsuite.yaml | 124 ++++++++++++++++++ .../hcpetcdbackups-CustomNoUpgrade.crd.yaml | 22 ++-- ...petcdbackups-TechPreviewNoUpgrade.crd.yaml | 22 ++-- .../api/hypershift/v1beta1/azure.go | 34 ++++- .../hypershift/v1beta1/etcdbackup_types.go | 27 ++-- 7 files changed, 248 insertions(+), 38 deletions(-) diff --git a/client/applyconfiguration/hypershift/v1beta1/azurekmsspec.go b/client/applyconfiguration/hypershift/v1beta1/azurekmsspec.go index d9d2647bc3c2..cb533e6eeb8e 100644 --- a/client/applyconfiguration/hypershift/v1beta1/azurekmsspec.go +++ b/client/applyconfiguration/hypershift/v1beta1/azurekmsspec.go @@ -27,6 +27,7 @@ type AzureKMSSpecApplyConfiguration struct { ActiveKey *AzureKMSKeyApplyConfiguration `json:"activeKey,omitempty"` BackupKey *AzureKMSKeyApplyConfiguration `json:"backupKey,omitempty"` KMS *ManagedIdentityApplyConfiguration `json:"kms,omitempty"` + KeyVaultType *hypershiftv1beta1.AzureKMSKeyVaultType `json:"keyVaultType,omitempty"` KeyVaultAccess *hypershiftv1beta1.AzureKeyVaultAccessType `json:"keyVaultAccess,omitempty"` } @@ -60,6 +61,14 @@ func (b *AzureKMSSpecApplyConfiguration) WithKMS(value *ManagedIdentityApplyConf return b } +// WithKeyVaultType sets the KeyVaultType field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the KeyVaultType field is set to the value of the last call. +func (b *AzureKMSSpecApplyConfiguration) WithKeyVaultType(value hypershiftv1beta1.AzureKMSKeyVaultType) *AzureKMSSpecApplyConfiguration { + b.KeyVaultType = &value + return b +} + // WithKeyVaultAccess sets the KeyVaultAccess field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the KeyVaultAccess field is set to the value of the last call. diff --git a/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/featuregated.hostedclusters.etcdbackup.testsuite.yaml b/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/featuregated.hostedclusters.etcdbackup.testsuite.yaml index 063199d588a1..1e61e3657643 100644 --- a/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/featuregated.hostedclusters.etcdbackup.testsuite.yaml +++ b/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/featuregated.hostedclusters.etcdbackup.testsuite.yaml @@ -5,6 +5,54 @@ featureGates: - HCPEtcdBackup version: v1beta1 tests: + onCreate: + - name: When Azure backup encryption uses a US Government Managed HSM URL, it should pass + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + backup: + platform: Azure + azure: + encryptionKeyURL: "https://my-hsm.managedhsm.usgovcloudapi.net/keys/my-key/abc123" + platform: + type: AWS + pullSecret: + name: secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64 + secretEncryption: + aescbc: + activeKey: + name: key + type: aescbc + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + onUpdate: - name: When lastSuccessfulEtcdBackupURL has invalid scheme it should fail initial: | diff --git a/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.azure.testsuite.yaml b/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.azure.testsuite.yaml index 342d169f1d4c..0779165ad57e 100644 --- a/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.azure.testsuite.yaml +++ b/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.azure.testsuite.yaml @@ -5,6 +5,130 @@ version: v1beta1 tests: onCreate: # --- Azure authentication configuration validation --- + - name: Azure German cloud should be selectable + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + dns: + baseDomain: example.com + platform: + type: Azure + azure: + cloud: AzureGermanCloud + location: germanywestcentral + resourceGroupName: test-rg + vnetID: "/subscriptions/12345678-1234-5678-9012-123456789012/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet" + subnetID: "/subscriptions/12345678-1234-5678-9012-123456789012/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/test-subnet" + subscriptionID: "12345678-1234-5678-9012-123456789012" + securityGroupID: "/subscriptions/12345678-1234-5678-9012-123456789012/resourceGroups/test-rg/providers/Microsoft.Network/networkSecurityGroups/test-nsg" + tenantID: "87654321-4321-8765-2109-876543210987" + azureAuthenticationConfig: + azureAuthenticationConfigType: WorkloadIdentities + workloadIdentities: + imageRegistry: + clientID: "12345678-1234-5678-9012-123456789012" + ingress: + clientID: "12345678-1234-5678-9012-123456789012" + file: + clientID: "12345678-1234-5678-9012-123456789012" + disk: + clientID: "12345678-1234-5678-9012-123456789012" + nodePoolManagement: + clientID: "12345678-1234-5678-9012-123456789012" + cloudProvider: + clientID: "12345678-1234-5678-9012-123456789012" + network: + clientID: "12345678-1234-5678-9012-123456789012" + pullSecret: + name: secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64 + secretEncryption: + aescbc: + activeKey: + name: key + type: aescbc + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + + - name: Azure Bleu cloud should be selectable + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + dns: + baseDomain: example.com + platform: + type: Azure + azure: + cloud: AzureBleuCloud + location: bleufrancecentral + resourceGroupName: test-rg + vnetID: "/subscriptions/12345678-1234-5678-9012-123456789012/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet" + subnetID: "/subscriptions/12345678-1234-5678-9012-123456789012/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/test-subnet" + subscriptionID: "12345678-1234-5678-9012-123456789012" + securityGroupID: "/subscriptions/12345678-1234-5678-9012-123456789012/resourceGroups/test-rg/providers/Microsoft.Network/networkSecurityGroups/test-nsg" + tenantID: "87654321-4321-8765-2109-876543210987" + azureAuthenticationConfig: + azureAuthenticationConfigType: WorkloadIdentities + workloadIdentities: + imageRegistry: + clientID: "12345678-1234-5678-9012-123456789012" + ingress: + clientID: "12345678-1234-5678-9012-123456789012" + file: + clientID: "12345678-1234-5678-9012-123456789012" + disk: + clientID: "12345678-1234-5678-9012-123456789012" + nodePoolManagement: + clientID: "12345678-1234-5678-9012-123456789012" + cloudProvider: + clientID: "12345678-1234-5678-9012-123456789012" + network: + clientID: "12345678-1234-5678-9012-123456789012" + pullSecret: + name: secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64 + secretEncryption: + aescbc: + activeKey: + name: key + type: aescbc + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + - name: When azureAuthenticationConfigType is ManagedIdentities but managedIdentities field is missing it should fail initial: | apiVersion: hypershift.openshift.io/v1beta1 diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml index 18455961b46f..6f2d159e380f 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml @@ -104,17 +104,18 @@ spec: type: object encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key used for encryption. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. This field is immutable once set and cannot be removed. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure Key Vault - HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') - message: encryptionKeyURL is immutable rule: self == oldSelf keyPrefix: @@ -375,16 +376,17 @@ spec: properties: encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption of the backup. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure Key Vault - HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml index 845e0c89f54d..4171748a42af 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml @@ -104,17 +104,18 @@ spec: type: object encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key used for encryption. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. This field is immutable once set and cannot be removed. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure Key Vault - HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') - message: encryptionKeyURL is immutable rule: self == oldSelf keyPrefix: @@ -375,16 +376,17 @@ spec: properties: encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption of the backup. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure Key Vault - HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go index dafc4aa67154..2a13273825a6 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/azure.go @@ -365,9 +365,9 @@ type AzureNodePoolOSDisk struct { // +kubebuilder:validation:XValidation:rule="!has(self.topology) || ((self.topology == 'Private' || self.topology == 'PublicAndPrivate') ? has(self.private) : !has(self.private))",message="private is required when topology is Private or PublicAndPrivate, and forbidden otherwise" // +kubebuilder:validation:XValidation:rule="!has(self.private) || self.private.type != 'PrivateLink' || self.azureAuthenticationConfig.azureAuthenticationConfigType != 'WorkloadIdentities' || has(self.azureAuthenticationConfig.workloadIdentities.controlPlaneOperator)",message="workloadIdentities.controlPlaneOperator is required when Private Link is configured with WorkloadIdentities authentication" type AzurePlatformSpec struct { - // cloud is the cloud environment identifier, valid values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33 + // cloud is the Azure cloud environment identifier. // - // +kubebuilder:validation:Enum=AzurePublicCloud;AzureUSGovernmentCloud;AzureChinaCloud;AzureGermanCloud;AzureStackCloud + // +kubebuilder:validation:Enum=AzurePublicCloud;AzureUSGovernmentCloud;AzureChinaCloud;AzureGermanCloud;AzureBleuCloud;AzureStackCloud // +kubebuilder:default="AzurePublicCloud" // +optional Cloud string `json:"cloud,omitempty"` @@ -914,9 +914,10 @@ const ( AzureKeyVaultPrivate AzureKeyVaultAccessType = "Private" ) -// AzureKMSSpec defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure key vault +// AzureKMSSpec defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure Key Vault or Managed HSM. // // +kubebuilder:validation:XValidation:rule="!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName",message="backupKey.keyVaultName must match activeKey.keyVaultName; both keys must reside in the same Key Vault" +// +kubebuilder:validation:XValidation:rule="(has(self.keyVaultType) ? self.keyVaultType : 'KeyVault') == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : 'KeyVault')",message="keyVaultType is immutable" type AzureKMSSpec struct { // activeKey defines the active key used to encrypt new secrets // @@ -935,6 +936,15 @@ type AzureKMSSpec struct { // +required KMS ManagedIdentity `json:"kms"` + // keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + // Valid values are "KeyVault" and "ManagedHSM". + // When set to "KeyVault", both keys are hosted by Azure Key Vault. + // When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + // The type is immutable; key rotation must remain within the same service. + // When omitted, the keys are treated as Key Vault keys. + // +optional + KeyVaultType AzureKMSKeyVaultType `json:"keyVaultType,omitempty"` + // keyVaultAccess specifies how the Key Vault should be accessed. // When set to "Private", the control plane routes Key Vault traffic through // the private router to reach the Key Vault's private endpoint in the customer VNet. @@ -944,16 +954,28 @@ type AzureKMSSpec struct { KeyVaultAccess AzureKeyVaultAccessType `json:"keyVaultAccess,omitempty"` } +// AzureKMSKeyVaultType specifies the Azure service that hosts a KMS key. +// +kubebuilder:validation:Enum=KeyVault;ManagedHSM +type AzureKMSKeyVaultType string + +const ( + // AzureKMSKeyVaultTypeKeyVault indicates that the key is hosted by Azure Key Vault. + AzureKMSKeyVaultTypeKeyVault AzureKMSKeyVaultType = "KeyVault" + // AzureKMSKeyVaultTypeManagedHSM indicates that the key is hosted by Azure Managed HSM. + AzureKMSKeyVaultTypeManagedHSM AzureKMSKeyVaultType = "ManagedHSM" +) + +// AzureKMSKey defines an Azure Key Vault or Managed HSM key used for KMS encryption. type AzureKMSKey struct { - // keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - // Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + // keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + // Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: // `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required KeyVaultName string `json:"keyVaultName,omitempty"` - // keyName is the name of the keyvault key used for encrypt/decrypt + // keyName is the name of the key used for encrypt/decrypt. // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 // +required diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.go index d59ef4752a95..f9a97a482af4 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.go @@ -178,14 +178,15 @@ type HCPEtcdBackupAzureBlob struct { // +required Credentials SecretReference `json:"credentials,omitzero"` - // encryptionKeyURL is the URL of the Azure Key Vault key used for encryption. - // Must be a valid Azure Key Vault key URL in the format - // "https://.vault.azure.net/keys/[/]". + // encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption. + // Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + // Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + // Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. // This field is immutable once set and cannot be removed. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=210 - // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.(vault\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr)|managedhsm\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault or Managed HSM HTTPS URL" // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="encryptionKeyURL is immutable" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } @@ -249,13 +250,14 @@ type HCPEtcdBackupEncryptionMetadataAWS struct { // HCPEtcdBackupEncryptionMetadataAzure contains Azure-specific encryption metadata. // The values here reflect the encryption settings from the HCPEtcdBackupConfig input. type HCPEtcdBackupEncryptionMetadataAzure struct { - // encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. - // Must be a valid Azure Key Vault key URL in the format - // "https://.vault.azure.net/keys/[/]". + // encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption of the backup. + // Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + // Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + // Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=210 - // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.(vault\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr)|managedhsm\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault or Managed HSM HTTPS URL" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } @@ -349,12 +351,13 @@ type HCPEtcdBackupConfigAWS struct { // HCPEtcdBackupConfigAzure defines Azure-specific encryption settings for etcd backups. type HCPEtcdBackupConfigAzure struct { - // encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. - // Must be a valid Azure Key Vault key URL in the format - // "https://.vault.azure.net/keys/[/]". + // encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. + // Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + // Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + // Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=210 - // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.(vault\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr)|managedhsm\\\\.(azure\\\\.net|usgovcloudapi\\\\.net|azure\\\\.cn|microsoftazure\\\\.de|sovcloud-api\\\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault or Managed HSM HTTPS URL" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } From 40644fe014707ef2334751457027e78b77633650 Mon Sep 17 00:00:00 2001 From: Hilliary Lipsig Date: Wed, 19 Aug 2026 10:34:02 -0700 Subject: [PATCH 3/8] feat(cli): configure Azure KMS vault type from key URLs - Propagate the detected vault type into AzureKMSSpec during cluster creation - Expose all supported Azure cloud environments in CLI help - Document Key Vault and Managed HSM encryption key URL formats Signed-off-by: Hilliary Lipsig Commit-Message-Assisted-by: Claude (via Claude Code) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- cmd/cluster/azure/create.go | 1 + cmd/infra/azure/create.go | 4 ++-- cmd/infra/azure/destroy.go | 4 ++-- cmd/util/azure_flag_descriptions.go | 4 ++-- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/cmd/cluster/azure/create.go b/cmd/cluster/azure/create.go index 75fb377606f9..c75476e435cd 100644 --- a/cmd/cluster/azure/create.go +++ b/cmd/cluster/azure/create.go @@ -393,6 +393,7 @@ func (o *CreateOptions) ApplyPlatformSpecifics(cluster *hyperv1.HostedCluster) e KeyName: o.encryptionKey.KeyName, KeyVersion: o.encryptionKey.KeyVersion, }, + KeyVaultType: o.encryptionKey.KeyVaultType, KMS: hyperv1.ManagedIdentity{ CredentialsSecretName: o.KMSUserAssignedCredsSecretName, ObjectEncoding: ObjectEncoding, diff --git a/cmd/infra/azure/create.go b/cmd/infra/azure/create.go index 4f10a4ef6cfb..8ebb9b5d9254 100644 --- a/cmd/infra/azure/create.go +++ b/cmd/infra/azure/create.go @@ -41,7 +41,7 @@ func NewCreateCommand() *cobra.Command { cmd.Flags().StringVar(&opts.InfraID, "infra-id", opts.InfraID, "Cluster ID(required)") cmd.Flags().StringVar(&opts.CredentialsFile, "azure-creds", opts.CredentialsFile, "Path to a credentials file (required). This file is used to create credentials used to create the necessary Azure resources for the HostedCluster.") cmd.Flags().StringVar(&opts.Location, "location", opts.Location, "Azure location where HostedCluster infrastructure should be created") - cmd.Flags().StringVar(&opts.Cloud, "cloud", opts.Cloud, "Azure cloud environment (AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud)") + cmd.Flags().StringVar(&opts.Cloud, "cloud", opts.Cloud, "Azure cloud environment (AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud, AzureBleuCloud)") cmd.Flags().StringVar(&opts.BaseDomain, "base-domain", opts.BaseDomain, "The ingress base domain for the HostedCluster") cmd.Flags().StringVar(&opts.Name, "name", opts.Name, "A name for the HostedCluster") cmd.Flags().StringVar(&opts.ResourceGroupName, "resource-group-name", opts.ResourceGroupName, "A resource group name to create the HostedCluster infrastructure resources under. If not provided, a new resource group will be created.") @@ -98,7 +98,7 @@ func BindProductFlags(opts *CreateInfraOptions, flags *pflag.FlagSet) { // Location and cloud flags.StringVar(&opts.Location, "location", opts.Location, util.LocationDescription) - flags.StringVar(&opts.Cloud, "cloud", opts.Cloud, "Azure cloud environment (AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud)") + flags.StringVar(&opts.Cloud, "cloud", opts.Cloud, "Azure cloud environment (AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud, AzureBleuCloud)") flags.StringVar(&opts.BaseDomain, "base-domain", opts.BaseDomain, util.BaseDomainInfraDescription) // Resource group and tags diff --git a/cmd/infra/azure/destroy.go b/cmd/infra/azure/destroy.go index ecd2a13b1204..b78fbe817160 100644 --- a/cmd/infra/azure/destroy.go +++ b/cmd/infra/azure/destroy.go @@ -46,7 +46,7 @@ func NewDestroyCommand() *cobra.Command { cmd.Flags().StringVar(&opts.InfraID, "infra-id", opts.InfraID, "Cluster ID(required)") cmd.Flags().StringVar(&opts.CredentialsFile, "azure-creds", opts.CredentialsFile, "Path to a credentials file (required)") cmd.Flags().StringVar(&opts.Location, "location", opts.Location, "Location where cluster infra should be created") - cmd.Flags().StringVar(&opts.Cloud, "cloud", opts.Cloud, "Azure cloud environment (AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud)") + cmd.Flags().StringVar(&opts.Cloud, "cloud", opts.Cloud, "Azure cloud environment (AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud, AzureBleuCloud)") cmd.Flags().StringVar(&opts.Name, "name", opts.Name, "A name for the cluster") cmd.Flags().StringVar(&opts.ResourceGroupName, "resource-group-name", opts.ResourceGroupName, "The name of the resource group containing the HostedCluster infrastructure resources that need to be destroyed.") cmd.Flags().BoolVar(&opts.PreserveResourceGroup, "preserve-resource-group", opts.PreserveResourceGroup, "When true, the managed/main resource group will not be deleted during cluster destroy. Only cluster-specific resources within the resource group will be cleaned up.") @@ -87,7 +87,7 @@ func BindDestroyProductFlags(opts *DestroyInfraOptions, flags *pflag.FlagSet) { // Location and cloud flags.StringVar(&opts.Location, "location", opts.Location, util.LocationDescription) - flags.StringVar(&opts.Cloud, "cloud", opts.Cloud, "Azure cloud environment (AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud)") + flags.StringVar(&opts.Cloud, "cloud", opts.Cloud, "Azure cloud environment (AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud, AzureBleuCloud)") // Resource group flags.StringVar(&opts.ResourceGroupName, "resource-group-name", opts.ResourceGroupName, util.ResourceGroupNameDescription) diff --git a/cmd/util/azure_flag_descriptions.go b/cmd/util/azure_flag_descriptions.go index 2d9b12d856cd..a6d0f9780b9b 100644 --- a/cmd/util/azure_flag_descriptions.go +++ b/cmd/util/azure_flag_descriptions.go @@ -41,7 +41,7 @@ const ( EndpointAccessPrivateAdditionalAllowedSubscriptionsDescription = "Additional Azure subscription IDs permitted to create Private Endpoints (the guest cluster's own subscription is always automatically allowed)." // Encryption - EncryptionKeyIDDescription = "Azure Key Vault key identifier used to encrypt etcd data via KMSv2 (format: https://.vault.azure.net/keys//)." + EncryptionKeyIDDescription = "Azure Key Vault or Managed HSM key identifier used to encrypt etcd data via KMSv2 (formats: https://.vault.azure.net/keys// or https://.managedhsm.azure.net/keys//)." EncryptionAtHostDescription = "Enable host-based encryption for VM disks and temp disks. Valid values: Enabled, Disabled." DiskEncryptionSetIDDescription = "Full resource ID of an Azure Disk Encryption Set used to encrypt NodePool OS disks with customer-managed keys." @@ -83,5 +83,5 @@ const ( // Common flags NameDescription = "A name for the HostedCluster. This name is used to identify resources and must be unique within the namespace." - CloudDescription = "Azure cloud environment. Valid values: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud." + CloudDescription = "Azure cloud environment. Valid values: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud, AzureBleuCloud." ) From 1f2bdcf05fe774917bca6cea5083c3a956c0fa6c Mon Sep 17 00:00:00 2001 From: Hilliary Lipsig Date: Wed, 19 Aug 2026 10:34:03 -0700 Subject: [PATCH 4/8] feat(hypershift-operator): support Azure Managed HSM endpoints - Resolve Key Vault and Managed HSM endpoints across all supported Azure clouds - Preserve legacy Key Vault fingerprints while distinguishing Managed HSM keys - Gate Managed HSM on OpenShift 4.22 without masking release resolution failures Signed-off-by: Hilliary Lipsig Commit-Message-Assisted-by: Claude (via Claude Code) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../managed-azure/setup_etcd_managed_hsm.sh | 110 ++++++++++ .../hostedcluster/hostedcluster_controller.go | 34 +++ .../hostedcluster_controller_test.go | 105 +++++++++ support/azureutil/azureutil.go | 114 ++++++++-- support/azureutil/azureutil_test.go | 199 +++++++++++++++++- support/azureutil/constants.go | 13 ++ support/secretencryption/fingerprint.go | 13 +- support/secretencryption/fingerprint_test.go | 43 ++-- support/secretencryption/keystatus.go | 5 +- support/secretencryption/keystatus_test.go | 4 +- 10 files changed, 596 insertions(+), 44 deletions(-) create mode 100755 contrib/managed-azure/setup_etcd_managed_hsm.sh diff --git a/contrib/managed-azure/setup_etcd_managed_hsm.sh b/contrib/managed-azure/setup_etcd_managed_hsm.sh new file mode 100755 index 000000000000..0193b846dd7e --- /dev/null +++ b/contrib/managed-azure/setup_etcd_managed_hsm.sh @@ -0,0 +1,110 @@ +#!/bin/bash +set +x + +# Prerequisites: define these constants +LOCATION="eastus" +HSM_RG_NAME="example-kms" +HSM_NAME="example-managed-hsm" +KEY_NAME="example-key" +SUBSCRIPTION_ID="" + +# This is the object ID of your signed-in user or service principal that will administer the HSM. +# Used to assign the initial HSM administrator role and create keys. +# Find it with: az ad signed-in-user show --query id -o tsv +USER_OBJECT_ID="" + +# This is the object ID of the KMS Managed Identity. This object ID can be found under the enterprise application for +# your KMS Managed Identity. +OBJECT_ID="" + +# Number of security domain key shares and required quorum for HSM activation. +# At least 3 shares with a quorum of 2 is recommended. +SD_SHARES=3 +SD_QUORUM=2 + +# Create a resource group to hold the Managed HSM +az group create --name "$HSM_RG_NAME" --location "$LOCATION" + +# Create the Managed HSM +# Note: provisioning takes approximately 20+ minutes. +az keyvault create \ + --hsm-name "$HSM_NAME" \ + --resource-group "$HSM_RG_NAME" \ + --location "$LOCATION" \ + --administrators "$USER_OBJECT_ID" + +echo "Waiting for Managed HSM provisioning to complete..." +az keyvault wait --hsm-name "$HSM_NAME" --resource-group "$HSM_RG_NAME" --created + +# Activate the Managed HSM security domain. +# Generate RSA key pairs that will protect the security domain download. +SD_DIR=$(mktemp -d) +for i in $(seq 0 $((SD_SHARES - 1))); do + openssl req -newkey rsa:2048 -nodes \ + -keyout "${SD_DIR}/sd_key_${i}.pem" \ + -x509 -days 365 \ + -out "${SD_DIR}/sd_cert_${i}.pem" \ + -subj "/CN=SecurityDomain${i}" 2>/dev/null +done + +SD_CERT_ARGS="" +for i in $(seq 0 $((SD_SHARES - 1))); do + SD_CERT_ARGS="${SD_CERT_ARGS} --sd-wrapping-keys ${SD_DIR}/sd_cert_${i}.pem" +done + +# Download and activate the security domain +# shellcheck disable=SC2086 +az keyvault security-domain download \ + --hsm-name "$HSM_NAME" \ + --security-domain-file "${SD_DIR}/security_domain.json" \ + ${SD_CERT_ARGS} \ + --sd-quorum "$SD_QUORUM" + +echo "Security domain downloaded to ${SD_DIR}/security_domain.json" +echo "IMPORTANT: Back up the security domain file and key pairs — they are required to restore the HSM." + +# Assign the Managed HSM Crypto Officer role (key management) and +# Crypto User role at /keys (data-plane key operations). Both are +# needed to create keys — Administrator alone is not sufficient. +az keyvault role assignment create \ + --hsm-name "$HSM_NAME" \ + --assignee "$USER_OBJECT_ID" \ + --role "Managed HSM Crypto Officer" \ + --scope "/" + +az keyvault role assignment create \ + --hsm-name "$HSM_NAME" \ + --assignee "$USER_OBJECT_ID" \ + --role "Managed HSM Crypto User" \ + --scope "/keys" + +# Wait for RBAC to propagate (~2-5 minutes for Managed HSM data-plane) +echo "Waiting for RBAC propagation..." +sleep 300 + +# Create a key in the Managed HSM +# Note: --protection is not used; all Managed HSM keys are HSM-backed. +export KEY_ID +KEY_ID=$(az keyvault key create \ + --hsm-name "$HSM_NAME" \ + --name "$KEY_NAME" \ + --kty RSA-HSM \ + --query key.kid \ + -o tsv) + +echo "" +echo "Encryption key created: $KEY_ID" +echo "" + +# Assign the Managed HSM Crypto User role to the KMS Managed Identity +az keyvault role assignment create \ + --hsm-name "$HSM_NAME" \ + --assignee "$OBJECT_ID" \ + --role "Managed HSM Crypto User" \ + --scope "/keys/${KEY_NAME}" + +echo "" +echo "Setup complete. Pass the following flag when creating your Azure HostedCluster:" +echo " --encryption-key-id $KEY_ID" +echo "" +echo "Managed HSM requires OpenShift 4.22 or later." diff --git a/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go b/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go index a55c37ffcb96..2089eee14cd1 100644 --- a/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go +++ b/hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go @@ -1811,6 +1811,19 @@ func (r *HostedClusterReconciler) reconcile(ctx context.Context, req ctrl.Reques if err != nil { return ctrl.Result{}, fmt.Errorf("failed to parse release image version: %w", err) } + if err := validateManagedHSMVersion(hcluster, releaseImageVersion); err != nil { + meta.SetStatusCondition(&hcluster.Status.Conditions, metav1.Condition{ + Type: string(hyperv1.ValidHostedClusterConfiguration), + ObservedGeneration: hcluster.Generation, + Status: metav1.ConditionFalse, + Reason: hyperv1.InvalidConfigurationReason, + Message: err.Error(), + }) + if statusErr := r.Client.Status().Update(ctx, hcluster); statusErr != nil { + return ctrl.Result{}, fmt.Errorf("%w; failed to update status: %v", err, statusErr) + } + return ctrl.Result{}, err + } // Reconcile the HostedControlPlane isAutoscalingNeeded, err := r.isAutoscalingNeeded(ctx, hcluster) @@ -3999,6 +4012,27 @@ func (r *HostedClusterReconciler) validateAzureConfig(hc *hyperv1.HostedCluster) return nil } +var minManagedHSMVersion = semver.MustParse("4.22.0") + +func validateManagedHSMVersion(hc *hyperv1.HostedCluster, releaseVersion semver.Version) error { + if hc.Spec.Platform.Type != hyperv1.AzurePlatform { + return nil + } + if hc.Spec.SecretEncryption == nil || + hc.Spec.SecretEncryption.KMS == nil || + hc.Spec.SecretEncryption.KMS.Azure == nil { + return nil + } + if hc.Spec.SecretEncryption.KMS.Azure.KeyVaultType != hyperv1.AzureKMSKeyVaultTypeManagedHSM { + return nil + } + releaseVersion.Pre = nil + if releaseVersion.LT(minManagedHSMVersion) { + return fmt.Errorf("release image version %s does not support Azure Managed HSM, which requires version %s or newer", releaseVersion, minManagedHSMVersion) + } + return nil +} + func (r *HostedClusterReconciler) validateAgentConfig(ctx context.Context, hc *hyperv1.HostedCluster) error { if hc.Spec.Platform.Type != hyperv1.AgentPlatform { return nil diff --git a/hypershift-operator/controllers/hostedcluster/hostedcluster_controller_test.go b/hypershift-operator/controllers/hostedcluster/hostedcluster_controller_test.go index 27878c702132..bb5833d51691 100644 --- a/hypershift-operator/controllers/hostedcluster/hostedcluster_controller_test.go +++ b/hypershift-operator/controllers/hostedcluster/hostedcluster_controller_test.go @@ -6502,6 +6502,111 @@ func TestValidateAzureConfig(t *testing.T) { } } +func TestValidateManagedHSMVersion(t *testing.T) { + managedHSMCluster := func() *hyperv1.HostedCluster { + return &hyperv1.HostedCluster{ + Spec: hyperv1.HostedClusterSpec{ + Platform: hyperv1.PlatformSpec{ + Type: hyperv1.AzurePlatform, + }, + SecretEncryption: &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.KMS, + KMS: &hyperv1.KMSSpec{ + Azure: &hyperv1.AzureKMSSpec{ + KeyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + }, + }, + }, + }, + } + } + + testCases := []struct { + name string + hc *hyperv1.HostedCluster + version semver.Version + expectError bool + }{ + { + name: "When the platform is not Azure, it should skip validation", + hc: &hyperv1.HostedCluster{ + Spec: hyperv1.HostedClusterSpec{ + Platform: hyperv1.PlatformSpec{ + Type: hyperv1.AWSPlatform, + }, + }, + }, + version: semver.MustParse("4.21.0"), + expectError: false, + }, + { + name: "When Azure uses KeyVault, it should skip validation", + hc: &hyperv1.HostedCluster{ + Spec: hyperv1.HostedClusterSpec{ + Platform: hyperv1.PlatformSpec{ + Type: hyperv1.AzurePlatform, + }, + SecretEncryption: &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.KMS, + KMS: &hyperv1.KMSSpec{ + Azure: &hyperv1.AzureKMSSpec{ + KeyVaultType: hyperv1.AzureKMSKeyVaultTypeKeyVault, + }, + }, + }, + }, + }, + version: semver.MustParse("4.21.0"), + expectError: false, + }, + { + name: "When the release version is 4.21, it should reject ManagedHSM", + hc: managedHSMCluster(), + version: semver.MustParse("4.21.3"), + expectError: true, + }, + { + name: "When the release version is exactly 4.22.0, it should accept ManagedHSM", + hc: managedHSMCluster(), + version: semver.MustParse("4.22.0"), + expectError: false, + }, + { + name: "When the release version is a 4.22 prerelease, it should accept ManagedHSM", + hc: managedHSMCluster(), + version: semver.MustParse("4.22.0-0.nightly-2026-08-18-152154"), + expectError: false, + }, + { + name: "When the release version is newer than 4.22, it should accept ManagedHSM", + hc: managedHSMCluster(), + version: semver.MustParse("4.23.0"), + expectError: false, + }, + { + name: "When the release version has a newer major version, it should accept ManagedHSM", + hc: managedHSMCluster(), + version: semver.MustParse("5.0.0"), + expectError: false, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + err := validateManagedHSMVersion(tc.hc, tc.version) + if tc.expectError { + if err == nil { + t.Fatalf("expected error but got nil") + } + } else { + if err != nil { + t.Fatalf("expected no error but got: %v", err) + } + } + }) + } +} + func TestComputeEndpointServiceCondition(t *testing.T) { g := NewGomegaWithT(t) diff --git a/support/azureutil/azureutil.go b/support/azureutil/azureutil.go index 686f487e33d4..09831c073a33 100644 --- a/support/azureutil/azureutil.go +++ b/support/azureutil/azureutil.go @@ -31,12 +31,12 @@ import ( // Azure SDK has a 24-character limit for ApplicationID, and spaces are replaced with "/". const CPOUserAgent = "hypershift-cpo" -// AzureEncryptionKey represents the information needed to access an encryption key in Azure Key Vault -// This information comes from the encryption key ID, which is in the form of https://.vault.azure.net/keys// +// AzureEncryptionKey represents the information needed to access an encryption key in Azure Key Vault or Managed HSM. type AzureEncryptionKey struct { KeyVaultName string KeyName string KeyVersion string + KeyVaultType hyperv1.AzureKMSKeyVaultType } // NewARMClientOptions creates Azure ARM client options with proper cloud configuration @@ -56,7 +56,8 @@ func NewARMClientOptions(cloudConfig cloud.Configuration) *arm.ClientOptions { // GetAzureCloudConfiguration converts a cloud name string to the Azure SDK cloud.Configuration. // This function maps the cloud names used in the HyperShift API to the corresponding Azure SDK cloud configurations. -// Valid cloud names are: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, and empty string (defaults to AzurePublicCloud). +// Valid cloud names are AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, +// AzureGermanCloud, AzureBleuCloud, and empty string (defaults to AzurePublicCloud). // Returns an error if the cloud name is not recognized. func GetAzureCloudConfiguration(cloudName string) (cloud.Configuration, error) { switch cloudName { @@ -66,6 +67,26 @@ func GetAzureCloudConfiguration(cloudName string) (cloud.Configuration, error) { return cloud.AzureGovernment, nil case "AzureChinaCloud": return cloud.AzureChina, nil + case "AzureGermanCloud": + return cloud.Configuration{ + ActiveDirectoryAuthorityHost: "https://login.microsoftonline.de/", + Services: map[cloud.ServiceName]cloud.ServiceConfiguration{ + cloud.ResourceManager: { + Audience: "https://management.core.cloudapi.de/", + Endpoint: "https://management.microsoftazure.de", + }, + }, + }, nil + case "AzureBleuCloud": + return cloud.Configuration{ + ActiveDirectoryAuthorityHost: "https://login.sovcloud-identity.fr/", + Services: map[cloud.ServiceName]cloud.ServiceConfiguration{ + cloud.ResourceManager: { + Audience: "https://management.sovcloud-api.fr/", + Endpoint: "https://management.sovcloud-api.fr", + }, + }, + }, nil default: return cloud.Configuration{}, fmt.Errorf("unknown Azure cloud: %s", cloudName) } @@ -379,19 +400,60 @@ func GetServicePrincipalScopes(subscriptionID, managedResourceGroupName, nsgReso // GetKeyVaultDNSSuffixFromCloudType simply mimics the functionality in environments.go from the Azure SDK, github.com/Azure/go-autorest. // This function is used to get the DNS suffix for the Key Vault based on the cloud type. func GetKeyVaultDNSSuffixFromCloudType(cloud string) (string, error) { - cloud = strings.ToUpper(cloud) + return GetKeyVaultDNSSuffix(cloud, hyperv1.AzureKMSKeyVaultTypeKeyVault) +} - switch cloud { +// GetKeyVaultDNSSuffix returns the cloud-specific DNS suffix for Azure Key Vault or Managed HSM. +// An empty keyVaultType is treated as KeyVault for compatibility with existing API objects. +// Supporting another cloud requires adding its suffix here, allowing it in GetAzureEncryptionKeyInfo, +// and updating the HCPEtcdBackup encryptionKeyURL API validation. +func GetKeyVaultDNSSuffix(cloud string, keyVaultType hyperv1.AzureKMSKeyVaultType) (string, error) { + normalizedCloud := strings.ToUpper(cloud) + managedHSM := false + switch keyVaultType { + case "", hyperv1.AzureKMSKeyVaultTypeKeyVault: + case hyperv1.AzureKMSKeyVaultTypeManagedHSM: + managedHSM = true + default: + return "", fmt.Errorf("unknown Azure KMS key vault type %q", keyVaultType) + } + + switch normalizedCloud { case "AZURECHINACLOUD": - return "vault.azure.cn", nil + if managedHSM { + return azureChinaManagedHSMDNSSuffix, nil + } + return azureChinaKeyVaultDNSSuffix, nil case "AZURECLOUD": - return "vault.azure.net", nil + if managedHSM { + return azurePublicManagedHSMDNSSuffix, nil + } + return azurePublicKeyVaultDNSSuffix, nil case "AZUREPUBLICCLOUD": - return "vault.azure.net", nil + if managedHSM { + return azurePublicManagedHSMDNSSuffix, nil + } + return azurePublicKeyVaultDNSSuffix, nil case "AZUREUSGOVERNMENT": - return "vault.usgovcloudapi.net", nil + if managedHSM { + return azureGovernmentManagedHSMDNSSuffix, nil + } + return azureGovernmentKeyVaultDNSSuffix, nil case "AZUREUSGOVERNMENTCLOUD": - return "vault.usgovcloudapi.net", nil + if managedHSM { + return azureGovernmentManagedHSMDNSSuffix, nil + } + return azureGovernmentKeyVaultDNSSuffix, nil + case "AZUREGERMANCLOUD": + if managedHSM { + return azureGermanManagedHSMDNSSuffix, nil + } + return azureGermanKeyVaultDNSSuffix, nil + case "AZUREBLEUCLOUD": + if managedHSM { + return azureBleuManagedHSMDNSSuffix, nil + } + return azureBleuKeyVaultDNSSuffix, nil default: return "", fmt.Errorf("unknown cloud type %q", cloud) } @@ -406,16 +468,16 @@ func GetKeyVaultFQDN(hcp *hyperv1.HostedControlPlane) (string, error) { return "", fmt.Errorf("azure KMS is not configured") } - vaultName := hcp.Spec.SecretEncryption.KMS.Azure.ActiveKey.KeyVaultName - suffix, err := GetKeyVaultDNSSuffixFromCloudType(hcp.Spec.Platform.Azure.Cloud) + azureKMS := hcp.Spec.SecretEncryption.KMS.Azure + activeKey := azureKMS.ActiveKey + suffix, err := GetKeyVaultDNSSuffix(hcp.Spec.Platform.Azure.Cloud, azureKMS.KeyVaultType) if err != nil { - return "", err + return "", fmt.Errorf("failed to resolve Azure KMS DNS suffix: %w", err) } - return fmt.Sprintf("%s.%s", vaultName, suffix), nil + return fmt.Sprintf("%s.%s", activeKey.KeyVaultName, suffix), nil } -// GetAzureEncryptionKeyInfo extracts the key vault name, key name, and key version from an encryption key ID -// The encryption key ID is in the form of https://.vault.azure.net/keys// +// GetAzureEncryptionKeyInfo extracts the vault name, key name, key version, and vault type from an encryption key ID. func GetAzureEncryptionKeyInfo(encryptionKeyID string) (*AzureEncryptionKey, error) { parsed, err := url.Parse(encryptionKeyID) if err != nil { @@ -423,7 +485,7 @@ func GetAzureEncryptionKeyInfo(encryptionKeyID string) (*AzureEncryptionKey, err } // Ensure the host is present - host := parsed.Hostname() + host := strings.ToLower(parsed.Hostname()) if host == "" { return nil, fmt.Errorf("invalid encryption key identifier %q: missing host", encryptionKeyID) @@ -440,16 +502,26 @@ func GetAzureEncryptionKeyInfo(encryptionKeyID string) (*AzureEncryptionKey, err return nil, fmt.Errorf("invalid encryption key identifier %q: expected /keys//", encryptionKeyID) } - // Ensure the vault name is present - vaultName := strings.Split(host, ".")[0] - if vaultName == "" { - return nil, fmt.Errorf("invalid encryption key identifier %q: could not derive vault name from host %q", encryptionKeyID, host) + vaultName, suffix, found := strings.Cut(host, ".") + if !found || vaultName == "" { + return nil, fmt.Errorf("invalid encryption key identifier %q: could not derive vault name and service suffix from host %q", encryptionKeyID, host) + } + + var keyVaultType hyperv1.AzureKMSKeyVaultType + switch suffix { + case azurePublicKeyVaultDNSSuffix, azureGovernmentKeyVaultDNSSuffix, azureChinaKeyVaultDNSSuffix, azureGermanKeyVaultDNSSuffix, azureBleuKeyVaultDNSSuffix: + keyVaultType = hyperv1.AzureKMSKeyVaultTypeKeyVault + case azurePublicManagedHSMDNSSuffix, azureGovernmentManagedHSMDNSSuffix, azureChinaManagedHSMDNSSuffix, azureGermanManagedHSMDNSSuffix, azureBleuManagedHSMDNSSuffix: + keyVaultType = hyperv1.AzureKMSKeyVaultTypeManagedHSM + default: + return nil, fmt.Errorf("invalid encryption key identifier %q: unsupported Azure Key Vault host %q", encryptionKeyID, host) } return &AzureEncryptionKey{ KeyVaultName: vaultName, KeyName: parts[0], KeyVersion: parts[1], + KeyVaultType: keyVaultType, }, nil } diff --git a/support/azureutil/azureutil_test.go b/support/azureutil/azureutil_test.go index 6987c36bb1b2..604501ed4fe6 100644 --- a/support/azureutil/azureutil_test.go +++ b/support/azureutil/azureutil_test.go @@ -601,6 +601,29 @@ func TestGetKeyVaultFQDN(t *testing.T) { }, wantFQDN: "gov-vault.vault.usgovcloudapi.net", }, + { + name: "When Azure KMS uses Managed HSM, it should return the Managed HSM FQDN", + hcp: &hyperv1.HostedControlPlane{ + Spec: hyperv1.HostedControlPlaneSpec{ + Platform: hyperv1.PlatformSpec{ + Azure: &hyperv1.AzurePlatformSpec{ + Cloud: "AzurePublicCloud", + }, + }, + SecretEncryption: &hyperv1.SecretEncryptionSpec{ + KMS: &hyperv1.KMSSpec{ + Azure: &hyperv1.AzureKMSSpec{ + ActiveKey: hyperv1.AzureKMSKey{ + KeyVaultName: "my-hsm", + }, + KeyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + }, + }, + }, + }, + }, + wantFQDN: "my-hsm.managedhsm.azure.net", + }, { name: "When SecretEncryption is nil it should return error", hcp: &hyperv1.HostedControlPlane{ @@ -668,6 +691,90 @@ func TestGetKeyVaultFQDN(t *testing.T) { } } +func TestGetKeyVaultDNSSuffix(t *testing.T) { + tests := []struct { + name string + cloud string + keyVaultType hyperv1.AzureKMSKeyVaultType + wantSuffix string + wantErr bool + }{ + { + name: "When keyVaultType is omitted, it should return the standard Key Vault suffix", + cloud: "AzurePublicCloud", + wantSuffix: "vault.azure.net", + }, + { + name: "When keyVaultType is ManagedHSM in public cloud, it should return the Managed HSM suffix", + cloud: "AzurePublicCloud", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + wantSuffix: "managedhsm.azure.net", + }, + { + name: "When keyVaultType is ManagedHSM in government cloud, it should return the government Managed HSM suffix", + cloud: "AzureUSGovernmentCloud", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + wantSuffix: "managedhsm.usgovcloudapi.net", + }, + { + name: "When keyVaultType is ManagedHSM in China cloud, it should return the China Managed HSM suffix", + cloud: "AzureChinaCloud", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + wantSuffix: "managedhsm.azure.cn", + }, + { + name: "When keyVaultType is KeyVault in China cloud, it should return the China Key Vault suffix", + cloud: "AzureChinaCloud", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeKeyVault, + wantSuffix: "vault.azure.cn", + }, + { + name: "When keyVaultType is ManagedHSM in German cloud, it should return the German Managed HSM suffix", + cloud: "AzureGermanCloud", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + wantSuffix: "managedhsm.microsoftazure.de", + }, + { + name: "When keyVaultType is KeyVault in German cloud, it should return the German Key Vault suffix", + cloud: "AzureGermanCloud", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeKeyVault, + wantSuffix: "vault.microsoftazure.de", + }, + { + name: "When keyVaultType is ManagedHSM in Bleu cloud, it should return the Bleu Managed HSM suffix", + cloud: "AzureBleuCloud", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + wantSuffix: "managedhsm.sovcloud-api.fr", + }, + { + name: "When keyVaultType is KeyVault in Bleu cloud, it should return the Bleu Key Vault suffix", + cloud: "AzureBleuCloud", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeKeyVault, + wantSuffix: "vault.sovcloud-api.fr", + }, + { + // keyVaultType is validated before the cloud switch, so this errors regardless of cloud. + name: "When keyVaultType is unknown, it should return an error", + cloud: "AzurePublicCloud", + keyVaultType: "Unknown", + wantErr: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + g := NewWithT(t) + got, err := GetKeyVaultDNSSuffix(tt.cloud, tt.keyVaultType) + if tt.wantErr { + g.Expect(err).To(HaveOccurred()) + return + } + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(got).To(Equal(tt.wantSuffix)) + }) + } +} + func TestGetAzureEncryptionKeyInfo(t *testing.T) { tests := []struct { name string @@ -675,6 +782,7 @@ func TestGetAzureEncryptionKeyInfo(t *testing.T) { wantVaultHost string wantKeyName string wantKeyVersion string + wantVaultType hyperv1.AzureKMSKeyVaultType wantErr bool }{ { @@ -683,8 +791,65 @@ func TestGetAzureEncryptionKeyInfo(t *testing.T) { wantVaultHost: "example-kms", wantKeyName: "example-key", wantKeyVersion: "1234abcd", + wantVaultType: hyperv1.AzureKMSKeyVaultTypeKeyVault, + wantErr: false, + }, + { + name: "When given a Managed HSM key ID, it should identify the vault type", + id: "https://example-hsm.managedhsm.azure.net/keys/example-key/1234abcd", + wantVaultHost: "example-hsm", + wantKeyName: "example-key", + wantKeyVersion: "1234abcd", + wantVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + wantErr: false, + }, + { + name: "When given a US Government Managed HSM key ID, it should identify the vault type", + id: "https://example-hsm.managedhsm.usgovcloudapi.net/keys/example-key/1234abcd", + wantVaultHost: "example-hsm", + wantKeyName: "example-key", + wantKeyVersion: "1234abcd", + wantVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + wantErr: false, + }, + { + name: "When given an uppercase US Government Managed HSM key ID, it should normalize and parse the host", + id: "https://EXAMPLE-HSM.MANAGEDHSM.USGOVCLOUDAPI.NET/keys/example-key/1234abcd", + wantVaultHost: "example-hsm", + wantKeyName: "example-key", + wantKeyVersion: "1234abcd", + wantVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, wantErr: false, }, + { + name: "When given a China Managed HSM key ID, it should identify the vault type", + id: "https://example-hsm.managedhsm.azure.cn/keys/example-key/1234abcd", + wantVaultHost: "example-hsm", + wantKeyName: "example-key", + wantKeyVersion: "1234abcd", + wantVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + }, + { + name: "When given a German Managed HSM key ID, it should identify the vault type", + id: "https://example-hsm.managedhsm.microsoftazure.de/keys/example-key/1234abcd", + wantVaultHost: "example-hsm", + wantKeyName: "example-key", + wantKeyVersion: "1234abcd", + wantVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + }, + { + name: "When given a Bleu Managed HSM key ID, it should identify the vault type", + id: "https://example-hsm.managedhsm.sovcloud-api.fr/keys/example-key/1234abcd", + wantVaultHost: "example-hsm", + wantKeyName: "example-key", + wantKeyVersion: "1234abcd", + wantVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + }, + { + name: "When given an unrecognized Azure key host, it should return an error", + id: "https://example-hsm.managedhsm.invalid/keys/example-key/1234abcd", + wantErr: true, + }, { name: "When key id missing version it should error", id: "https://example-kms.vault.azure.net/keys/example-key", @@ -706,6 +871,7 @@ func TestGetAzureEncryptionKeyInfo(t *testing.T) { wantVaultHost: "example-kms", wantKeyName: "example-key", wantKeyVersion: "1234abcd", + wantVaultType: hyperv1.AzureKMSKeyVaultTypeKeyVault, wantErr: false, }, { @@ -729,6 +895,7 @@ func TestGetAzureEncryptionKeyInfo(t *testing.T) { g.Expect(got.KeyVaultName).To(Equal(tt.wantVaultHost)) g.Expect(got.KeyName).To(Equal(tt.wantKeyName)) g.Expect(got.KeyVersion).To(Equal(tt.wantKeyVersion)) + g.Expect(got.KeyVaultType).To(Equal(tt.wantVaultType)) }) } } @@ -998,6 +1165,34 @@ func TestGetAzureCloudConfiguration(t *testing.T) { wantCloud: cloud.AzureChina, wantErr: false, }, + { + name: "When the cloud name is AzureGermanCloud, it should return the German cloud configuration", + cloudName: "AzureGermanCloud", + wantCloud: cloud.Configuration{ + ActiveDirectoryAuthorityHost: "https://login.microsoftonline.de/", + Services: map[cloud.ServiceName]cloud.ServiceConfiguration{ + cloud.ResourceManager: { + Audience: "https://management.core.cloudapi.de/", + Endpoint: "https://management.microsoftazure.de", + }, + }, + }, + wantErr: false, + }, + { + name: "When the cloud name is AzureBleuCloud, it should return the Bleu cloud configuration", + cloudName: "AzureBleuCloud", + wantCloud: cloud.Configuration{ + ActiveDirectoryAuthorityHost: "https://login.sovcloud-identity.fr/", + Services: map[cloud.ServiceName]cloud.ServiceConfiguration{ + cloud.ResourceManager: { + Audience: "https://management.sovcloud-api.fr/", + Endpoint: "https://management.sovcloud-api.fr", + }, + }, + }, + wantErr: false, + }, { name: "Invalid cloud name returns error", cloudName: "InvalidCloud", @@ -1020,10 +1215,12 @@ func TestGetAzureCloudConfiguration(t *testing.T) { return } if !tt.wantErr { - // Compare the ActiveDirectoryAuthorityHost to verify we got the right cloud configuration if gotCloud.ActiveDirectoryAuthorityHost != tt.wantCloud.ActiveDirectoryAuthorityHost { t.Errorf("GetAzureCloudConfiguration() = %v, want %v", gotCloud, tt.wantCloud) } + if gotCloud.Services[cloud.ResourceManager] != tt.wantCloud.Services[cloud.ResourceManager] { + t.Errorf("GetAzureCloudConfiguration() resource manager configuration = %v, want %v", gotCloud.Services[cloud.ResourceManager], tt.wantCloud.Services[cloud.ResourceManager]) + } } }) } diff --git a/support/azureutil/constants.go b/support/azureutil/constants.go index 576fc57defd3..559e28379c5a 100644 --- a/support/azureutil/constants.go +++ b/support/azureutil/constants.go @@ -25,3 +25,16 @@ const ( // PEConnectionStateRejected indicates a Private Endpoint connection has been rejected. PEConnectionStateRejected = "Rejected" ) + +const ( + azurePublicKeyVaultDNSSuffix = "vault.azure.net" + azurePublicManagedHSMDNSSuffix = "managedhsm.azure.net" + azureGovernmentKeyVaultDNSSuffix = "vault.usgovcloudapi.net" + azureGovernmentManagedHSMDNSSuffix = "managedhsm.usgovcloudapi.net" + azureChinaKeyVaultDNSSuffix = "vault.azure.cn" + azureChinaManagedHSMDNSSuffix = "managedhsm.azure.cn" + azureGermanKeyVaultDNSSuffix = "vault.microsoftazure.de" + azureGermanManagedHSMDNSSuffix = "managedhsm.microsoftazure.de" + azureBleuKeyVaultDNSSuffix = "vault.sovcloud-api.fr" + azureBleuManagedHSMDNSSuffix = "managedhsm.sovcloud-api.fr" +) diff --git a/support/secretencryption/fingerprint.go b/support/secretencryption/fingerprint.go index 8c233f25c93e..247908c86956 100644 --- a/support/secretencryption/fingerprint.go +++ b/support/secretencryption/fingerprint.go @@ -15,8 +15,12 @@ func DataHash(data []byte) string { } // FingerprintAzureKMSKey computes the SHA-256 fingerprint for an Azure KMS key. -func FingerprintAzureKMSKey(key hyperv1.AzureKMSKey) string { - return DataHash([]byte(key.KeyVaultName + "/" + key.KeyName + "/" + key.KeyVersion)) +func FingerprintAzureKMSKey(key hyperv1.AzureKMSKey, keyVaultType hyperv1.AzureKMSKeyVaultType) string { + identity := key.KeyVaultName + "/" + key.KeyName + "/" + key.KeyVersion + if keyVaultType == hyperv1.AzureKMSKeyVaultTypeManagedHSM { + identity += "/" + string(keyVaultType) + } + return DataHash([]byte(identity)) } // FingerprintAWSKMSKey computes the SHA-256 fingerprint for an AWS KMS key. @@ -41,7 +45,8 @@ func FingerprintAESCBCKey(secretName string, dataHash string) string { } // FingerprintFromKeyStatus computes the fingerprint from a SecretEncryptionKeyStatus. -func FingerprintFromKeyStatus(status *hyperv1.SecretEncryptionKeyStatus) string { +// keyVaultType is only used for Azure KMS keys and is ignored for other providers. +func FingerprintFromKeyStatus(status *hyperv1.SecretEncryptionKeyStatus, keyVaultType hyperv1.AzureKMSKeyVaultType) string { if status == nil { return "" } @@ -50,7 +55,7 @@ func FingerprintFromKeyStatus(status *hyperv1.SecretEncryptionKeyStatus) string if status.Azure.KeyVaultName == "" { return "" } - return FingerprintAzureKMSKey(status.Azure) + return FingerprintAzureKMSKey(status.Azure, keyVaultType) case hyperv1.SecretEncryptionProviderAWS: if status.AWS.ARN == "" { return "" diff --git a/support/secretencryption/fingerprint_test.go b/support/secretencryption/fingerprint_test.go index d6c4dfc8b698..10982cc2c9f1 100644 --- a/support/secretencryption/fingerprint_test.go +++ b/support/secretencryption/fingerprint_test.go @@ -10,20 +10,35 @@ import ( func TestFingerprintAzureKMSKey(t *testing.T) { t.Parallel() - t.Run("When computing Azure KMS fingerprint it should be deterministic", func(t *testing.T) { + t.Run("When computing Azure KMS fingerprint, it should be deterministic", func(t *testing.T) { g := NewWithT(t) key := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"} - fp1 := FingerprintAzureKMSKey(key) - fp2 := FingerprintAzureKMSKey(key) + fp1 := FingerprintAzureKMSKey(key, "") + fp2 := FingerprintAzureKMSKey(key, "") g.Expect(fp1).To(Equal(fp2)) g.Expect(fp1).ToNot(BeEmpty()) }) - t.Run("When Azure KMS key version changes it should produce a different fingerprint", func(t *testing.T) { + t.Run("When Azure KMS key version changes, it should produce a different fingerprint", func(t *testing.T) { g := NewWithT(t) key1 := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"} key2 := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"} - g.Expect(FingerprintAzureKMSKey(key1)).ToNot(Equal(FingerprintAzureKMSKey(key2))) + g.Expect(FingerprintAzureKMSKey(key1, "")).ToNot(Equal(FingerprintAzureKMSKey(key2, ""))) + }) + + t.Run("When KeyVault type is explicit, it should preserve the legacy fingerprint", func(t *testing.T) { + const legacyFingerprint = "d5962eb588f841eaa664c407524cfeff2eb31432751370611c35737a8b81da35" + + g := NewWithT(t) + legacyKey := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"} + g.Expect(FingerprintAzureKMSKey(legacyKey, "")).To(Equal(legacyFingerprint)) + g.Expect(FingerprintAzureKMSKey(legacyKey, hyperv1.AzureKMSKeyVaultTypeKeyVault)).To(Equal(legacyFingerprint)) + }) + + t.Run("When vault type changes to ManagedHSM, it should produce a different fingerprint", func(t *testing.T) { + g := NewWithT(t) + key := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"} + g.Expect(FingerprintAzureKMSKey(key, hyperv1.AzureKMSKeyVaultTypeManagedHSM)).ToNot(Equal(FingerprintAzureKMSKey(key, ""))) }) } @@ -106,7 +121,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { t.Parallel() t.Run("When status is nil it should return empty string", func(t *testing.T) { g := NewWithT(t) - g.Expect(FingerprintFromKeyStatus(nil)).To(BeEmpty()) + g.Expect(FingerprintFromKeyStatus(nil, "")).To(BeEmpty()) }) t.Run("When Azure status is provided it should match spec fingerprint", func(t *testing.T) { @@ -116,7 +131,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { Provider: hyperv1.SecretEncryptionProviderAzure, Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, } - g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintAzureKMSKey(key))) + g.Expect(FingerprintFromKeyStatus(status, "")).To(Equal(FingerprintAzureKMSKey(key, ""))) }) t.Run("When AWS status is provided it should match spec fingerprint", func(t *testing.T) { @@ -126,7 +141,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { Provider: hyperv1.SecretEncryptionProviderAWS, AWS: hyperv1.AWSKMSKeyEntry{ARN: arn}, } - g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintAWSKMSKey(arn))) + g.Expect(FingerprintFromKeyStatus(status, "")).To(Equal(FingerprintAWSKMSKey(arn))) }) t.Run("When IBMCloud status is provided it should match spec fingerprint", func(t *testing.T) { @@ -136,7 +151,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { Provider: hyperv1.SecretEncryptionProviderIBMCloud, IBMCloud: entry, } - g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintIBMCloudKMSKeyList([]hyperv1.IBMCloudKMSKeyEntry{entry}))) + g.Expect(FingerprintFromKeyStatus(status, "")).To(Equal(FingerprintIBMCloudKMSKeyList([]hyperv1.IBMCloudKMSKeyEntry{entry}))) }) t.Run("When AESCBC status is provided it should match spec fingerprint", func(t *testing.T) { @@ -148,7 +163,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { DataHash: "abc123", }, } - g.Expect(FingerprintFromKeyStatus(status)).To(Equal(FingerprintAESCBCKey("my-secret", "abc123"))) + g.Expect(FingerprintFromKeyStatus(status, "")).To(Equal(FingerprintAESCBCKey("my-secret", "abc123"))) }) t.Run("When Azure status has empty fields it should return empty string", func(t *testing.T) { @@ -156,7 +171,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { status := &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAzure, } - g.Expect(FingerprintFromKeyStatus(status)).To(BeEmpty()) + g.Expect(FingerprintFromKeyStatus(status, "")).To(BeEmpty()) }) t.Run("When AWS status has empty ARN it should return empty string", func(t *testing.T) { @@ -164,7 +179,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { status := &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAWS, } - g.Expect(FingerprintFromKeyStatus(status)).To(BeEmpty()) + g.Expect(FingerprintFromKeyStatus(status, "")).To(BeEmpty()) }) t.Run("When IBMCloud status has empty CRKID it should return empty string", func(t *testing.T) { @@ -172,7 +187,7 @@ func TestFingerprintFromKeyStatus(t *testing.T) { status := &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderIBMCloud, } - g.Expect(FingerprintFromKeyStatus(status)).To(BeEmpty()) + g.Expect(FingerprintFromKeyStatus(status, "")).To(BeEmpty()) }) t.Run("When AESCBC status has empty data hash it should return empty string", func(t *testing.T) { @@ -180,6 +195,6 @@ func TestFingerprintFromKeyStatus(t *testing.T) { status := &hyperv1.SecretEncryptionKeyStatus{ Provider: hyperv1.SecretEncryptionProviderAESCBC, } - g.Expect(FingerprintFromKeyStatus(status)).To(BeEmpty()) + g.Expect(FingerprintFromKeyStatus(status, "")).To(BeEmpty()) }) } diff --git a/support/secretencryption/keystatus.go b/support/secretencryption/keystatus.go index 8b64bed272d9..a72b69750883 100644 --- a/support/secretencryption/keystatus.go +++ b/support/secretencryption/keystatus.go @@ -81,11 +81,12 @@ func KeyStatusFromSpec(spec *hyperv1.SecretEncryptionSpec, aescbcDataHash string } // KeyReferenceFromStatus extracts an EncryptionKeyReference from a SecretEncryptionKeyStatus. -func KeyReferenceFromStatus(status *hyperv1.SecretEncryptionKeyStatus) hyperv1.EncryptionKeyReference { +// keyVaultType is only used for Azure KMS keys and is ignored for other providers. +func KeyReferenceFromStatus(status *hyperv1.SecretEncryptionKeyStatus, keyVaultType hyperv1.AzureKMSKeyVaultType) hyperv1.EncryptionKeyReference { if status == nil { return hyperv1.EncryptionKeyReference{} } - fp := FingerprintFromKeyStatus(status) + fp := FingerprintFromKeyStatus(status, keyVaultType) return hyperv1.EncryptionKeyReference{ Provider: status.Provider, Fingerprint: fp, diff --git a/support/secretencryption/keystatus_test.go b/support/secretencryption/keystatus_test.go index dd8ebdb8dfa1..9ab78d33d119 100644 --- a/support/secretencryption/keystatus_test.go +++ b/support/secretencryption/keystatus_test.go @@ -119,7 +119,7 @@ func TestKeyReferenceFromStatus(t *testing.T) { t.Parallel() t.Run("When status is nil it should return empty reference", func(t *testing.T) { g := NewWithT(t) - ref := KeyReferenceFromStatus(nil) + ref := KeyReferenceFromStatus(nil, "") g.Expect(ref.Provider).To(BeEmpty()) g.Expect(ref.Fingerprint).To(BeEmpty()) }) @@ -130,7 +130,7 @@ func TestKeyReferenceFromStatus(t *testing.T) { Provider: hyperv1.SecretEncryptionProviderAzure, Azure: hyperv1.AzureKMSKey{KeyVaultName: "v", KeyName: "k", KeyVersion: "1"}, } - ref := KeyReferenceFromStatus(status) + ref := KeyReferenceFromStatus(status, "") g.Expect(ref.Provider).To(Equal(hyperv1.SecretEncryptionProviderAzure)) g.Expect(ref.Fingerprint).ToNot(BeEmpty()) }) From 402cac049a3522533112dcc8644bc552351cfcbf Mon Sep 17 00:00:00 2001 From: Hilliary Lipsig Date: Wed, 19 Aug 2026 10:34:03 -0700 Subject: [PATCH 5/8] feat(control-plane-operator): configure KMS for Azure Managed HSM - Pass Managed HSM mode to both active and backup Azure KMS provider sidecars - Use one immutable vault type for active, backup, and rotation target keys - Preserve legacy Key Vault provider names while distinguishing Managed HSM providers Signed-off-by: Hilliary Lipsig Commit-Message-Assisted-by: Claude (via Claude Code) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../hostedcontrolplane_controller.go | 2 +- .../hostedcontrolplane/v2/kas/kms.go | 2 +- .../hostedcontrolplane/v2/kas/kms/azure.go | 25 +++- .../hostedcontrolplane/v2/kas/kms_test.go | 105 ++++++++++++++- .../controllers/reencryption/reencryption.go | 30 +++-- .../reencryption/reencryption_test.go | 125 +++++++++++++++--- 6 files changed, 249 insertions(+), 40 deletions(-) diff --git a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go index 76b2d492ef40..fc59fa0a640d 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go +++ b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go @@ -3033,7 +3033,7 @@ func (r *HostedControlPlaneReconciler) validateAzureKMSConfig(ctx context.Contex } } - azureKeyVaultDNSSuffix, err := hyperazureutil.GetKeyVaultDNSSuffixFromCloudType(hcp.Spec.Platform.Azure.Cloud) + azureKeyVaultDNSSuffix, err := hyperazureutil.GetKeyVaultDNSSuffix(hcp.Spec.Platform.Azure.Cloud, azureKmsSpec.KeyVaultType) if err != nil { conditions.SetFalseCondition(hcp, hyperv1.ValidAzureKMSConfig, hyperv1.InvalidAzureCredentialsReason, fmt.Sprintf("vault dns suffix not available for cloud: %s", hcp.Spec.Platform.Azure.Cloud)) diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms.go index 1b35d2d867d2..5a8c0ba6cd8f 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms.go @@ -149,7 +149,7 @@ func deriveKMSKeys(kmsSpec *hyperv1.KMSSpec, encStatus *hyperv1.SecretEncryption KeyName: encStatus.ActiveKey.Azure.KeyName, KeyVersion: encStatus.ActiveKey.Azure.KeyVersion, } - targetName, err := kms.AzureKMSProviderName(*targetKey) + targetName, err := kms.AzureKMSProviderName(*targetKey, kmsSpec.Azure.KeyVaultType) if err != nil { return keys, err } diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go index a218adc2c14b..26df96bff949 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure.go @@ -36,8 +36,22 @@ const ( ) // AzureKMSProviderName computes the EncryptionConfiguration KMS provider name for an Azure KMS key. -func AzureKMSProviderName(key hyperv1.AzureKMSKey) (string, error) { - h, err := util.HashStruct(key) +func AzureKMSProviderName(key hyperv1.AzureKMSKey, keyVaultType hyperv1.AzureKMSKeyVaultType) (string, error) { + type keyIdentity struct { + KeyVaultName string `json:"keyVaultName,omitempty"` + KeyName string `json:"keyName,omitempty"` + KeyVersion string `json:"keyVersion,omitempty"` + KeyVaultType hyperv1.AzureKMSKeyVaultType `json:"keyVaultType,omitempty"` + } + id := keyIdentity{ + KeyVaultName: key.KeyVaultName, + KeyName: key.KeyName, + KeyVersion: key.KeyVersion, + } + if keyVaultType == hyperv1.AzureKMSKeyVaultTypeManagedHSM { + id.KeyVaultType = keyVaultType + } + h, err := util.HashStruct(id) if err != nil { return "", err } @@ -87,7 +101,7 @@ func NewAzureKMSProvider(writeKey hyperv1.AzureKMSKey, readKey *hyperv1.AzureKMS func (p *azureKMSProvider) GenerateKMSEncryptionConfig(apiVersion string) (*v1.EncryptionConfiguration, error) { var providerConfiguration []v1.ProviderConfiguration - writeKeyName, err := AzureKMSProviderName(p.writeKey) + writeKeyName, err := AzureKMSProviderName(p.writeKey, p.kmsSpec.KeyVaultType) if err != nil { return nil, err } @@ -100,7 +114,7 @@ func (p *azureKMSProvider) GenerateKMSEncryptionConfig(apiVersion string) (*v1.E }, }) if p.readKey != nil { - readKeyName, err := AzureKMSProviderName(*p.readKey) + readKeyName, err := AzureKMSProviderName(*p.readKey, p.kmsSpec.KeyVaultType) if err != nil { return nil, err } @@ -183,6 +197,9 @@ func (p *azureKMSProvider) buildKASContainerAzureKMS(kmsKey hyperv1.AzureKMSKey, fmt.Sprintf("--config-file-path=%s/%s", azureKMSVolumeMounts.Path(c.Name, kasVolumeAzureKMSCredentials().Name), azureKMSCredsFileKey), "-v=1", } + if p.kmsSpec.KeyVaultType == hyperv1.AzureKMSKeyVaultTypeManagedHSM { + c.Args = append(c.Args, "--managed-hsm") + } c.VolumeMounts = azureKMSVolumeMounts.ContainerMounts(c.Name) c.VolumeMounts = append(c.VolumeMounts, corev1.VolumeMount{ Name: config.ManagedAzureKMSSecretStoreVolumeName, diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go index b15d1f75b370..8dc3480056d5 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms_test.go @@ -106,8 +106,8 @@ func TestDeriveKMSKeys(t *testing.T) { }, }, currentConfig: kmsEncryptionConfig( - mustAWSProviderName("arn:aws:kms:us-east-1:123456789:key/old-key"), - mustAWSProviderName("arn:aws:kms:us-east-1:123456789:key/new-key"), + mustAWSProviderName(t, "arn:aws:kms:us-east-1:123456789:key/old-key"), + mustAWSProviderName(t, "arn:aws:kms:us-east-1:123456789:key/new-key"), ), kasConverged: true, validate: func(g Gomega, keys kmsWriteReadKeys) { @@ -116,7 +116,7 @@ func TestDeriveKMSKeys(t *testing.T) { }, }, { - name: "When Azure rotation in progress and target key absent from config it should use old key as write", + name: "When legacy Key Vault rotation is not ready for promotion, it should keep the old key as write and target as read", kmsSpec: &hyperv1.KMSSpec{ Provider: hyperv1.AZURE, Azure: &hyperv1.AzureKMSSpec{ @@ -139,6 +139,88 @@ func TestDeriveKMSKeys(t *testing.T) { g.Expect(keys.azureRead.KeyVersion).To(Equal("v2"), "target key should be read-only during ReadOnlyDeploy") }, }, + { + name: "When legacy Key Vault rotation is ready for promotion, it should promote the target key and keep the old key as read", + kmsSpec: &hyperv1.KMSSpec{ + Provider: hyperv1.AZURE, + Azure: &hyperv1.AzureKMSSpec{ + ActiveKey: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, + }, + TargetKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, + }, + }, + currentConfig: kmsEncryptionConfig( + mustAzureProviderName(t, hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, ""), + mustAzureProviderName(t, hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, ""), + ), + kasConverged: true, + validate: func(g Gomega, keys kmsWriteReadKeys) { + g.Expect(keys.azureWrite.KeyVersion).To(Equal("v2"), "target key should be write after promotion") + g.Expect(keys.azureRead.KeyVersion).To(Equal("v1"), "old key should be read after promotion") + }, + }, + { + name: "When Managed HSM rotation is not ready for promotion, it should preserve the vault type on both keys", + kmsSpec: &hyperv1.KMSSpec{ + Provider: hyperv1.AZURE, + Azure: &hyperv1.AzureKMSSpec{ + ActiveKey: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, + KeyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, + }, + TargetKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, + }, + }, + currentConfig: nil, + validate: func(g Gomega, keys kmsWriteReadKeys) { + g.Expect(keys.azureWrite.KeyVersion).To(Equal("v1"), "old key should be write during ReadOnlyDeploy") + g.Expect(keys.azureRead.KeyVersion).To(Equal("v2"), "target key should be read-only during ReadOnlyDeploy") + }, + }, + { + name: "When Managed HSM rotation is ready for promotion, it should preserve the vault type on both keys", + kmsSpec: &hyperv1.KMSSpec{ + Provider: hyperv1.AZURE, + Azure: &hyperv1.AzureKMSSpec{ + ActiveKey: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, + KeyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + }, + }, + encStatus: &hyperv1.SecretEncryptionStatus{ + ActiveKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, + }, + TargetKey: hyperv1.SecretEncryptionKeyStatus{ + Provider: hyperv1.SecretEncryptionProviderAzure, + Azure: hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, + }, + }, + currentConfig: kmsEncryptionConfig( + mustAzureProviderName(t, hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v1"}, hyperv1.AzureKMSKeyVaultTypeManagedHSM), + mustAzureProviderName(t, hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "v2"}, hyperv1.AzureKMSKeyVaultTypeManagedHSM), + ), + kasConverged: true, + validate: func(g Gomega, keys kmsWriteReadKeys) { + g.Expect(keys.azureWrite.KeyVersion).To(Equal("v2"), "target key should be write after promotion") + g.Expect(keys.azureRead.KeyVersion).To(Equal("v1"), "old key should be read after promotion") + }, + }, } for _, tc := range tests { @@ -153,8 +235,21 @@ func TestDeriveKMSKeys(t *testing.T) { } } -func mustAWSProviderName(arn string) string { - name, _ := kms.AWSKMSProviderName(arn) +func mustAWSProviderName(t *testing.T, arn string) string { + t.Helper() + name, err := kms.AWSKMSProviderName(arn) + if err != nil { + t.Fatalf("failed to compute AWS KMS provider name: %v", err) + } + return name +} + +func mustAzureProviderName(t *testing.T, key hyperv1.AzureKMSKey, keyVaultType hyperv1.AzureKMSKeyVaultType) string { + t.Helper() + name, err := kms.AzureKMSProviderName(key, keyVaultType) + if err != nil { + t.Fatalf("failed to compute Azure KMS provider name: %v", err) + } return name } diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go index d36c9b1e2a84..3bf85f8d9094 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption.go @@ -102,9 +102,10 @@ func (r *Reconciler) reconcile(ctx context.Context, log logr.Logger, hcp *hyperv return reconcile.Result{}, nil } - specFingerprint := secretencryption.FingerprintFromKeyStatus(specKeyStatus) + kvt := azureKeyVaultType(hcp) + specFingerprint := secretencryption.FingerprintFromKeyStatus(specKeyStatus, kvt) - statusActiveFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.ActiveKey) + statusActiveFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.ActiveKey, kvt) // Case 1: Status has no active key (first-time setup or upgrade bootstrap). if hcp.Status.SecretEncryption.ActiveKey.Provider == "" { @@ -163,8 +164,9 @@ func (r *Reconciler) startNewRotation(log logr.Logger, hcp *hyperv1.HostedContro hcp.Status.SecretEncryption.TargetKey = *specKeyStatus.DeepCopy() - fromRef := secretencryption.KeyReferenceFromStatus(&hcp.Status.SecretEncryption.ActiveKey) - toRef := secretencryption.KeyReferenceFromStatus(specKeyStatus) + kvt := azureKeyVaultType(hcp) + fromRef := secretencryption.KeyReferenceFromStatus(&hcp.Status.SecretEncryption.ActiveKey, kvt) + toRef := secretencryption.KeyReferenceFromStatus(specKeyStatus, kvt) entry := hyperv1.EncryptionMigrationHistory{ From: fromRef, @@ -191,7 +193,8 @@ func (r *Reconciler) startNewRotation(log logr.Logger, hcp *hyperv1.HostedContro // It inspects the EncryptionConfiguration and KAS Deployment convergence rather than // reading history[0].state. The history state is updated for observability only. func (r *Reconciler) handleInProgressRotation(ctx context.Context, log logr.Logger, hcp *hyperv1.HostedControlPlane, specFingerprint string) (reconcile.Result, error) { - targetFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.TargetKey) + kvt := azureKeyVaultType(hcp) + targetFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.TargetKey, kvt) if specFingerprint != targetFingerprint { log.Info("Spec key differs from target key during rotation, current rotation will complete first", @@ -201,8 +204,8 @@ func (r *Reconciler) handleInProgressRotation(ctx context.Context, log logr.Logg if len(hcp.Status.SecretEncryption.History) == 0 { log.Info("Target key set but no history entry found, creating one") - fromRef := secretencryption.KeyReferenceFromStatus(&hcp.Status.SecretEncryption.ActiveKey) - toRef := secretencryption.KeyReferenceFromStatus(&hcp.Status.SecretEncryption.TargetKey) + fromRef := secretencryption.KeyReferenceFromStatus(&hcp.Status.SecretEncryption.ActiveKey, kvt) + toRef := secretencryption.KeyReferenceFromStatus(&hcp.Status.SecretEncryption.TargetKey, kvt) entry := hyperv1.EncryptionMigrationHistory{ From: fromRef, To: toRef, @@ -342,7 +345,7 @@ func (r *Reconciler) computeTargetKeyProviderName(ctx context.Context, hcp *hype KeyVaultName: tk.Azure.KeyVaultName, KeyName: tk.Azure.KeyName, KeyVersion: tk.Azure.KeyVersion, - }) + }, azureKeyVaultType(hcp)) case hyperv1.SecretEncryptionProviderAWS: if tk.AWS.ARN == "" { @@ -389,7 +392,7 @@ func (r *Reconciler) handleMigratingPhase(log logr.Logger, hcp *hyperv1.HostedCo } resources := r.encryptedResources(hcp) - targetFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.TargetKey) + targetFingerprint := secretencryption.FingerprintFromKeyStatus(&hcp.Status.SecretEncryption.TargetKey, azureKeyVaultType(hcp)) writeKey := fmt.Sprintf("encryption-key-%s", targetFingerprint) allFinished := true @@ -557,6 +560,15 @@ func parseGroupResource(rs string) schema.GroupResource { return schema.GroupResource{Resource: parts[0], Group: parts[1]} } +// azureKeyVaultType returns the vault type (Key Vault or Managed HSM) from the Azure KMS configuration. +// Returns empty string when the HCP is not configured for Azure KMS. +func azureKeyVaultType(hcp *hyperv1.HostedControlPlane) hyperv1.AzureKMSKeyVaultType { + if hcp.Spec.SecretEncryption == nil || hcp.Spec.SecretEncryption.KMS == nil || hcp.Spec.SecretEncryption.KMS.Azure == nil { + return "" + } + return hcp.Spec.SecretEncryption.KMS.Azure.KeyVaultType +} + // prependHistory prepends a new entry to the history and trims it to maxHistoryEntries. func prependHistory(history []hyperv1.EncryptionMigrationHistory, entry hyperv1.EncryptionMigrationHistory) []hyperv1.EncryptionMigrationHistory { result := make([]hyperv1.EncryptionMigrationHistory, 0, maxHistoryEntries) diff --git a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go index 0cc894ba1dbb..dd91b02fde8c 100644 --- a/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go +++ b/control-plane-operator/hostedclusterconfigoperator/controllers/reencryption/reencryption_test.go @@ -481,8 +481,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(newKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(newKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(newKS, ""), State: hyperv1.EncryptionMigrationStateReadOnlyDeploy, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -523,8 +523,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(newKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(newKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(newKS, ""), State: hyperv1.EncryptionMigrationStateReadOnlyDeploy, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -562,8 +562,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(newKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(newKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(newKS, ""), State: hyperv1.EncryptionMigrationStateReadOnlyDeploy, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -600,8 +600,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(newKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(newKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(newKS, ""), State: hyperv1.EncryptionMigrationStateWritePromote, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -641,8 +641,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(newKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(newKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(newKS, ""), State: hyperv1.EncryptionMigrationStateMigrating, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -675,8 +675,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(newKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(newKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(newKS, ""), State: hyperv1.EncryptionMigrationStateMigrating, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -728,8 +728,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(newKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(newKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(newKS, ""), State: hyperv1.EncryptionMigrationStateMigrating, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -795,8 +795,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(newKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(newKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(newKS, ""), State: hyperv1.EncryptionMigrationStateMigrating, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -844,8 +844,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(midKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(midKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(midKS, ""), State: hyperv1.EncryptionMigrationStateWritePromote, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -894,8 +894,8 @@ func TestReconcile(t *testing.T) { withActiveKey(oldKS), withTargetKey(newKS), withHistory(hyperv1.EncryptionMigrationHistory{ - From: secretencryption.KeyReferenceFromStatus(oldKS), - To: secretencryption.KeyReferenceFromStatus(newKS), + From: secretencryption.KeyReferenceFromStatus(oldKS, ""), + To: secretencryption.KeyReferenceFromStatus(newKS, ""), State: hyperv1.EncryptionMigrationStateMigrating, StartedTime: metav1.Time{Time: fixedTime}, }), @@ -1080,3 +1080,88 @@ func TestEncryptedResources(t *testing.T) { g.Expect(resources).To(BeNil()) }) } + +func TestComputeTargetKeyProviderName(t *testing.T) { + tests := []struct { + name string + targetKey *hyperv1.SecretEncryptionKeyStatus + keyVaultType hyperv1.AzureKMSKeyVaultType + expectName string + expectErr bool + }{ + { + name: "When no target key is set, it should return an error", + targetKey: &hyperv1.SecretEncryptionKeyStatus{}, + expectErr: true, + }, + { + name: "When Azure target key omits KeyVaultType, it should produce the legacy provider name", + targetKey: secretencryption.KeyStatusFromAzureSpec(hyperv1.AzureKMSKey{ + KeyVaultName: "vault", + KeyName: "key", + KeyVersion: "1", + }), + }, + { + name: "When Azure target key has KeyVaultType KeyVault, it should produce the same name as omitted", + targetKey: secretencryption.KeyStatusFromAzureSpec(hyperv1.AzureKMSKey{ + KeyVaultName: "vault", + KeyName: "key", + KeyVersion: "1", + }), + keyVaultType: hyperv1.AzureKMSKeyVaultTypeKeyVault, + }, + { + name: "When Azure target key has KeyVaultType ManagedHSM, it should produce a different provider name", + targetKey: secretencryption.KeyStatusFromAzureSpec(hyperv1.AzureKMSKey{ + KeyVaultName: "vault", + KeyName: "key", + KeyVersion: "1", + }), + keyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + }, + } + + legacyKey := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "1"} + legacyName, err := kms.AzureKMSProviderName(legacyKey, "") + if err != nil { + t.Fatalf("failed to compute legacy provider name: %v", err) + } + + r := &Reconciler{} + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + g := NewWithT(t) + hcp := newHCP() + hcp.Status.SecretEncryption.TargetKey = *tt.targetKey + // Set the KeyVaultType on the spec so azureKeyVaultType(hcp) returns it. + if tt.targetKey.Provider == hyperv1.SecretEncryptionProviderAzure { + hcp.Spec.SecretEncryption = &hyperv1.SecretEncryptionSpec{ + Type: hyperv1.KMS, + KMS: &hyperv1.KMSSpec{ + Provider: hyperv1.AZURE, + Azure: &hyperv1.AzureKMSSpec{ + ActiveKey: tt.targetKey.Azure, + KeyVaultType: tt.keyVaultType, + }, + }, + } + } + + name, err := r.computeTargetKeyProviderName(context.Background(), hcp) + if tt.expectErr { + g.Expect(err).To(HaveOccurred()) + return + } + g.Expect(err).NotTo(HaveOccurred()) + + if tt.keyVaultType == hyperv1.AzureKMSKeyVaultTypeManagedHSM { + g.Expect(name).NotTo(Equal(legacyName), + "ManagedHSM target key should produce a different provider name than KeyVault") + } else { + g.Expect(name).To(Equal(legacyName), + "KeyVault or omitted target key should produce the legacy provider name") + } + }) + } +} From 2284e26bf1b2d18a4e7141d3465ac1f808b37282 Mon Sep 17 00:00:00 2001 From: Hilliary Lipsig Date: Wed, 19 Aug 2026 10:34:03 -0700 Subject: [PATCH 6/8] docs: document Azure Managed HSM support - Describe supported Azure KMS services, clouds, and minimum OpenShift version - Regenerate the API reference and aggregated documentation Signed-off-by: Hilliary Lipsig Commit-Message-Assisted-by: Claude (via Claude Code) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../create-azure-cluster-with-options.md | 13 ++- docs/content/reference/aggregated-docs.md | 88 +++++++++++++++---- docs/content/reference/api.md | 74 +++++++++++++--- 3 files changed, 142 insertions(+), 33 deletions(-) diff --git a/docs/content/how-to/azure/create-azure-cluster-with-options.md b/docs/content/how-to/azure/create-azure-cluster-with-options.md index edb1db37884d..d64bb38a3401 100644 --- a/docs/content/how-to/azure/create-azure-cluster-with-options.md +++ b/docs/content/how-to/azure/create-azure-cluster-with-options.md @@ -154,8 +154,17 @@ This section walks through how to: 1. Set up the flags needed when creating the Azure HostedCluster 1. Verify the etcd encryption is setup and working properly -There is a `setup_etcd_kv.sh` script in the contrib folder in the HyperShift repo to help automate the first couple of -steps mentioned above. However, this guide will manually walk through those steps. +!!! important "Managed HSM compatibility" + + Azure Managed HSM for KMS encryption requires an OpenShift 4.22 or later HostedCluster release and is supported in Azure Public Cloud, Azure US Government Cloud, Azure China Cloud, Azure German Cloud, and Azure Bleu Cloud. + Do not configure Managed HSM on an earlier release because its control plane operator does not configure the Managed HSM endpoint or authentication scope. + Downgrading a HostedCluster after enabling Managed HSM is not supported. + + The KMS vault type is immutable. An existing HostedCluster that uses Azure Key Vault cannot migrate to Managed HSM through key rotation; create a new HostedCluster to change between those services. + Custom Azure Stack Key Vault endpoints are not supported. + +There is a `setup_etcd_kv.sh` script in the contrib folder in the HyperShift repo to help automate the first couple of +steps mentioned above. For Managed HSM, use `setup_etcd_managed_hsm.sh` instead. This guide will manually walk through the Key Vault setup steps below. 1a) Create a resource group for the key vault that will house the key used for etcd encryption. diff --git a/docs/content/reference/aggregated-docs.md b/docs/content/reference/aggregated-docs.md index 1bb0e08dbc52..0f1a01aae0e1 100644 --- a/docs/content/reference/aggregated-docs.md +++ b/docs/content/reference/aggregated-docs.md @@ -8107,8 +8107,17 @@ This section walks through how to: 1. Set up the flags needed when creating the Azure HostedCluster 1. Verify the etcd encryption is setup and working properly -There is a `setup_etcd_kv.sh` script in the contrib folder in the HyperShift repo to help automate the first couple of -steps mentioned above. However, this guide will manually walk through those steps. +!!! important "Managed HSM compatibility" + + Azure Managed HSM for KMS encryption requires an OpenShift 4.22 or later HostedCluster release and is supported in Azure Public Cloud, Azure US Government Cloud, Azure China Cloud, Azure German Cloud, and Azure Bleu Cloud. + Do not configure Managed HSM on an earlier release because its control plane operator does not configure the Managed HSM endpoint or authentication scope. + Downgrading a HostedCluster after enabling Managed HSM is not supported. + + The KMS vault type is immutable. An existing HostedCluster that uses Azure Key Vault cannot migrate to Managed HSM through key rotation; create a new HostedCluster to change between those services. + Custom Azure Stack Key Vault endpoints are not supported. + +There is a `setup_etcd_kv.sh` script in the contrib folder in the HyperShift repo to help automate the first couple of +steps mentioned above. For Managed HSM, use `setup_etcd_managed_hsm.sh` instead. This guide will manually walk through the Key Vault setup steps below. 1a) Create a resource group for the key vault that will house the key used for etcd encryption. @@ -33928,6 +33937,7 @@ applications and dev/test.

SecretEncryptionKeyStatus)

+

AzureKMSKey defines an Azure Key Vault or Managed HSM key used for KMS encryption.

@@ -33945,8 +33955,8 @@ string @@ -33958,7 +33968,7 @@ string @@ -33974,13 +33984,36 @@ string
-

keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name -Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: +

keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name +Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn <YOUR APPLICATION CLIENT ID>
-

keyName is the name of the keyvault key used for encrypt/decrypt

+

keyName is the name of the key used for encrypt/decrypt.
+###AzureKMSKeyVaultType { #hypershift.openshift.io/v1beta1.AzureKMSKeyVaultType } +

+(Appears on: +AzureKMSSpec) +

+

+

AzureKMSKeyVaultType specifies the Azure service that hosts a KMS key.

+

+ + + + + + + + + + + + +
ValueDescription

"KeyVault"

AzureKMSKeyVaultTypeKeyVault indicates that the key is hosted by Azure Key Vault.

+

"ManagedHSM"

AzureKMSKeyVaultTypeManagedHSM indicates that the key is hosted by Azure Managed HSM.

+
###AzureKMSSpec { #hypershift.openshift.io/v1beta1.AzureKMSSpec }

(Appears on: KMSSpec)

-

AzureKMSSpec defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure key vault

+

AzureKMSSpec defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure Key Vault or Managed HSM.

@@ -34035,6 +34068,25 @@ ManagedIdentity + + + + @@ -39022,9 +39074,10 @@ string @@ -39150,9 +39203,10 @@ string @@ -39286,9 +39340,10 @@ string @@ -55121,4 +55176,3 @@ This video demonstrates how to deploy a Hosted Control Plane using the Multiclus This video demonstrates how to deploy an IPv6, fully disconnected Hosted Control Plane using the Agent provider. - diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md index d7b624088949..83e5e7513d18 100644 --- a/docs/content/reference/api.md +++ b/docs/content/reference/api.md @@ -3480,6 +3480,7 @@ applications and dev/test.

SecretEncryptionKeyStatus)

+

AzureKMSKey defines an Azure Key Vault or Managed HSM key used for KMS encryption.

+keyVaultType
+ + +AzureKMSKeyVaultType + + +		 +(Optional) +

keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. +Valid values are “KeyVault” and “ManagedHSM”. +When set to “KeyVault”, both keys are hosted by Azure Key Vault. +When set to “ManagedHSM”, both keys are hosted by Azure Managed HSM. +The type is immutable; key rotation must remain within the same service. +When omitted, the keys are treated as Key Vault keys.

+
keyVaultAccess
@@ -34436,7 +34488,7 @@ string 		(Optional) -

cloud is the cloud environment identifier, valid values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33

+

cloud is the Azure cloud environment identifier.
(Optional) -

encryptionKeyURL is the URL of the Azure Key Vault key used for encryption. -Must be a valid Azure Key Vault key URL in the format -“https://.vault.azure.net/keys/[/]”. +

encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption. +Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). +Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). +Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. This field is immutable once set and cannot be removed.
-

encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. -Must be a valid Azure Key Vault key URL in the format -“https://.vault.azure.net/keys/[/]”.

+

encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. +Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). +Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). +Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver.
-

encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. -Must be a valid Azure Key Vault key URL in the format -“https://.vault.azure.net/keys/[/]”.

+

encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption of the backup. +Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). +Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). +Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver.
@@ -3497,8 +3498,8 @@ string @@ -3510,7 +3511,7 @@ string @@ -3526,13 +3527,36 @@ string
-

keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name -Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: +

keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name +Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn <YOUR APPLICATION CLIENT ID>
-

keyName is the name of the keyvault key used for encrypt/decrypt

+

keyName is the name of the key used for encrypt/decrypt.
+###AzureKMSKeyVaultType { #hypershift.openshift.io/v1beta1.AzureKMSKeyVaultType } +

+(Appears on: +AzureKMSSpec) +

+

+

AzureKMSKeyVaultType specifies the Azure service that hosts a KMS key.

+

+ + + + + + + + + + + + +
ValueDescription

"KeyVault"

AzureKMSKeyVaultTypeKeyVault indicates that the key is hosted by Azure Key Vault.

+

"ManagedHSM"

AzureKMSKeyVaultTypeManagedHSM indicates that the key is hosted by Azure Managed HSM.

+
###AzureKMSSpec { #hypershift.openshift.io/v1beta1.AzureKMSSpec }

(Appears on: KMSSpec)

-

AzureKMSSpec defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure key vault

+

AzureKMSSpec defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure Key Vault or Managed HSM.

@@ -3587,6 +3611,25 @@ ManagedIdentity + + + + @@ -8574,9 +8617,10 @@ string @@ -8702,9 +8746,10 @@ string @@ -8838,9 +8883,10 @@ string From 4f7f8f7c1f31069569d04df01ede625791cf4279 Mon Sep 17 00:00:00 2001 From: Hilliary Lipsig Date: Thu, 27 Aug 2026 13:37:21 -0700 Subject: [PATCH 7/8] chore(api): regenerate release 4.22 manifests Regenerate feature-gated and install CRDs against the release-4.22 API set after resolving the backport conflicts. Signed-off-by: Hilliary Lipsig Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../AAA_ungated.yaml | 50 +++++++++------ .../AutoNodeKarpenter.yaml | 50 +++++++++------ .../ClusterUpdateAcceptRisks.yaml | 50 +++++++++------ .../ClusterVersionOperatorConfiguration.yaml | 50 +++++++++------ .../ExternalOIDC.yaml | 50 +++++++++------ ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 50 +++++++++------ .../ExternalOIDCWithUpstreamParity.yaml | 50 +++++++++------ .../GCPPlatform.yaml | 50 +++++++++------ .../HCPEtcdBackup.yaml | 61 ++++++++++++------- ...perShiftOnlyDynamicResourceAllocation.yaml | 50 +++++++++------ .../ImageStreamImportMode.yaml | 50 +++++++++------ .../KMSEncryptionProvider.yaml | 50 +++++++++------ .../OpenStack.yaml | 50 +++++++++------ .../AAA_ungated.yaml | 50 +++++++++------ .../AutoNodeKarpenter.yaml | 50 +++++++++------ .../ClusterUpdateAcceptRisks.yaml | 50 +++++++++------ .../ClusterVersionOperatorConfiguration.yaml | 50 +++++++++------ .../ExternalOIDC.yaml | 50 +++++++++------ ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 50 +++++++++------ .../ExternalOIDCWithUpstreamParity.yaml | 50 +++++++++------ .../GCPPlatform.yaml | 50 +++++++++------ .../HCPEtcdBackup.yaml | 61 ++++++++++++------- ...perShiftOnlyDynamicResourceAllocation.yaml | 50 +++++++++------ .../ImageStreamImportMode.yaml | 50 +++++++++------ .../KMSEncryptionProvider.yaml | 50 +++++++++------ .../OpenStack.yaml | 50 +++++++++------ ...usters-Hypershift-CustomNoUpgrade.crd.yaml | 61 ++++++++++++------- ...hostedclusters-Hypershift-Default.crd.yaml | 50 +++++++++------ ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 61 ++++++++++++------- ...planes-Hypershift-CustomNoUpgrade.crd.yaml | 61 ++++++++++++------- ...dcontrolplanes-Hypershift-Default.crd.yaml | 50 +++++++++------ ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 61 ++++++++++++------- docs/content/reference/aggregated-docs.md | 1 + 33 files changed, 1061 insertions(+), 606 deletions(-) diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml index bfb02b5417ee..ea9f513e9864 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml @@ -5039,13 +5039,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6012,15 +6012,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6045,15 +6045,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6080,6 +6080,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6140,6 +6152,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6926,15 +6942,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7161,15 +7176,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml index edd20bc7bd97..3b40155ca88e 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml @@ -5166,13 +5166,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6131,15 +6131,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6164,15 +6164,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6199,6 +6199,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6259,6 +6271,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7065,15 +7081,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7300,15 +7315,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index 8f516f4fce3d..397fedeebf2a 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -5030,13 +5030,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -5995,15 +5995,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6028,15 +6028,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6063,6 +6063,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6123,6 +6135,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6909,15 +6925,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7144,15 +7159,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index 7fdee82f7644..ba86ab0b81f9 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -5050,13 +5050,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6015,15 +6015,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6048,15 +6048,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6083,6 +6083,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6143,6 +6155,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6929,15 +6945,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7164,15 +7179,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml index fbabbd81852a..b108f11a96ab 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml @@ -5363,13 +5363,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6328,15 +6328,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6361,15 +6361,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6396,6 +6396,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6456,6 +6468,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7407,15 +7423,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7642,15 +7657,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index 9a628fd1e9dc..2412ecac050b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -5503,13 +5503,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6468,15 +6468,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6501,15 +6501,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6536,6 +6536,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6596,6 +6608,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7547,15 +7563,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7782,15 +7797,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index 79f43c9a8b80..0bb659752073 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -5484,13 +5484,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6449,15 +6449,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6482,15 +6482,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6517,6 +6517,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6577,6 +6589,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7363,15 +7379,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7598,15 +7613,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml index b914e5c54625..959b6aaf24e5 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml @@ -5030,13 +5030,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6415,15 +6415,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6448,15 +6448,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6483,6 +6483,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6543,6 +6555,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7329,15 +7345,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7564,15 +7579,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml index 2e533f729c66..4b0550f1156b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -2501,16 +2501,17 @@ spec: properties: encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure - Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + Key Vault or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object @@ -5095,13 +5096,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6060,15 +6061,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6093,15 +6094,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6128,6 +6129,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6188,6 +6201,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6986,15 +7003,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7221,15 +7237,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index 894b65fa84e9..d492dd3da6f3 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -5052,13 +5052,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6017,15 +6017,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6050,15 +6050,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6085,6 +6085,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6145,6 +6157,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6931,15 +6947,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7166,15 +7181,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml index 55d6d2fda030..985f265fe249 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -5048,13 +5048,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6013,15 +6013,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6046,15 +6046,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6081,6 +6081,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6141,6 +6153,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6938,15 +6954,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7173,15 +7188,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml index ee3000e356c0..d9bf4f967740 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -5106,13 +5106,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6071,15 +6071,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6104,15 +6104,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6139,6 +6139,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6199,6 +6211,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6985,15 +7001,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7220,15 +7235,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml index c8991b80bd5a..f274ac47b0ee 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml @@ -5030,13 +5030,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6546,15 +6546,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6579,15 +6579,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6614,6 +6614,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6674,6 +6686,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7460,15 +7476,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7695,15 +7710,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml index dd571e490c7c..d54fe9f0b232 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml @@ -4915,13 +4915,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -5863,15 +5863,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5896,15 +5896,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5931,6 +5931,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -5991,6 +6003,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6756,15 +6772,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6991,15 +7006,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AutoNodeKarpenter.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AutoNodeKarpenter.yaml index 2d17d950869b..73009e863a07 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AutoNodeKarpenter.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AutoNodeKarpenter.yaml @@ -5044,13 +5044,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -5984,15 +5984,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6017,15 +6017,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6052,6 +6052,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6112,6 +6124,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6897,15 +6913,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7132,15 +7147,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index d31de0d4b587..e1a5892c96a2 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -4906,13 +4906,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -5846,15 +5846,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5879,15 +5879,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5914,6 +5914,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -5974,6 +5986,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6739,15 +6755,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6974,15 +6989,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index 120511f48cf0..b7b6f6cfc729 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -4926,13 +4926,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -5866,15 +5866,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5899,15 +5899,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5934,6 +5934,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -5994,6 +6006,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6759,15 +6775,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6994,15 +7009,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml index 5f76bbf48e51..16edb727bed6 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDC.yaml @@ -5239,13 +5239,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6179,15 +6179,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6212,15 +6212,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6247,6 +6247,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6307,6 +6319,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7237,15 +7253,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7472,15 +7487,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml index 540b77443c0e..96285bc8b97f 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml @@ -5379,13 +5379,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6319,15 +6319,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6352,15 +6352,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6387,6 +6387,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6447,6 +6459,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7377,15 +7393,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7612,15 +7627,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml index 833b3fdbcb9f..9f1383ae691e 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml @@ -5360,13 +5360,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6300,15 +6300,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6333,15 +6333,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6368,6 +6368,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6428,6 +6440,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7193,15 +7209,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7428,15 +7443,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml index 649e4f7894b0..f3c969ee1d7b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/GCPPlatform.yaml @@ -4906,13 +4906,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6266,15 +6266,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6299,15 +6299,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6334,6 +6334,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6394,6 +6406,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7159,15 +7175,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7394,15 +7409,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml index a6a52da20e1a..e92faea4e84b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -2418,16 +2418,17 @@ spec: properties: encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure - Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + Key Vault or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object @@ -4971,13 +4972,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -5911,15 +5912,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5944,15 +5945,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5979,6 +5980,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6039,6 +6052,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6804,15 +6821,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7039,15 +7055,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml index c43d47e96d49..c3cfac6239ff 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml @@ -4928,13 +4928,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -5868,15 +5868,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5901,15 +5901,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5936,6 +5936,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -5996,6 +6008,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6761,15 +6777,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6996,15 +7011,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml index ea472e73807a..3e8c3d231fae 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ImageStreamImportMode.yaml @@ -4924,13 +4924,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -5864,15 +5864,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5897,15 +5897,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5932,6 +5932,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -5992,6 +6004,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6768,15 +6784,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7003,15 +7018,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml index 174be75197cd..ef386420af74 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryptionProvider.yaml @@ -4982,13 +4982,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -5922,15 +5922,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5955,15 +5955,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -5990,6 +5990,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6050,6 +6062,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -6815,15 +6831,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7050,15 +7065,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml index 1cebfc2a0dc8..4692aa7a5d8b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/OpenStack.yaml @@ -4906,13 +4906,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6397,15 +6397,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6430,15 +6430,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6465,6 +6465,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6525,6 +6537,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7290,15 +7306,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7525,15 +7540,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml index 23efa259fd20..79f590b7bb99 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml @@ -3354,16 +3354,17 @@ spec: properties: encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure - Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + Key Vault or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object @@ -5968,13 +5969,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -7894,15 +7895,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7927,15 +7928,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7962,6 +7963,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -8022,6 +8035,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -9016,15 +9033,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -9251,15 +9267,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml index 053f49bd94df..94c985ae613c 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-Default.crd.yaml @@ -5532,13 +5532,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6505,15 +6505,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6538,15 +6538,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6573,6 +6573,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6633,6 +6645,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7584,15 +7600,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7819,15 +7834,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml index 807ffe110c25..56500294355e 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -3265,16 +3265,17 @@ spec: properties: encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure - Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + Key Vault or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object @@ -5879,13 +5880,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -7805,15 +7806,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7838,15 +7839,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7873,6 +7874,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -7933,6 +7946,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -8916,15 +8933,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -9151,15 +9167,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml index 381b5f25d2dc..0cd1489e926c 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml @@ -3273,16 +3273,17 @@ spec: properties: encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure - Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + Key Vault or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object @@ -5846,13 +5847,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -7747,15 +7748,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7780,15 +7781,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7815,6 +7816,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -7875,6 +7888,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -8836,15 +8853,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -9071,15 +9087,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml index 6f1e2814a3bd..81166b1745db 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-Default.crd.yaml @@ -5408,13 +5408,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -6356,15 +6356,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6389,15 +6389,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -6424,6 +6424,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -6484,6 +6496,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -7414,15 +7430,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7649,15 +7664,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml index ff77c7e8ba7b..2a9c5f40a51a 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -3184,16 +3184,17 @@ spec: properties: encryptionKeyURL: description: |- - encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. - Must be a valid Azure Key Vault key URL in the format - "https://.vault.azure.net/keys/[/]". + encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. + Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). + Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). + Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - message: encryptionKeyURL must be a valid Azure - Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) - rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + Key Vault or Managed HSM HTTPS URL + rule: self.matches('^https://[a-zA-Z0-9-]+\\.(vault\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr)|managedhsm\\.(azure\\.net|usgovcloudapi\\.net|azure\\.cn|microsoftazure\\.de|sovcloud-api\\.fr))/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object @@ -5757,13 +5758,13 @@ spec: ? has(self.workloadIdentities) : !has(self.workloadIdentities)' cloud: default: AzurePublicCloud - description: 'cloud is the cloud environment identifier, valid - values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33' + description: cloud is the Azure cloud environment identifier. enum: - AzurePublicCloud - AzureUSGovernmentCloud - AzureChinaCloud - AzureGermanCloud + - AzureBleuCloud - AzureStackCloud type: string containerRegistry: @@ -7658,15 +7659,15 @@ spec: encrypt new secrets properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7691,15 +7692,15 @@ spec: The system automatically manages the previous key via the status field. properties: keyName: - description: keyName is the name of the keyvault key - used for encrypt/decrypt + description: keyName is the name of the key used for + encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -7726,6 +7727,18 @@ spec: - Private - "" type: string + keyVaultType: + description: |- + keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. + Valid values are "KeyVault" and "ManagedHSM". + When set to "KeyVault", both keys are hosted by Azure Key Vault. + When set to "ManagedHSM", both keys are hosted by Azure Managed HSM. + The type is immutable; key rotation must remain within the same service. + When omitted, the keys are treated as Key Vault keys. + enum: + - KeyVault + - ManagedHSM + type: string kms: description: kms is a pre-existing managed identity used to authenticate with Azure KMS. @@ -7786,6 +7799,10 @@ spec: both keys must reside in the same Key Vault rule: '!has(self.backupKey) || self.backupKey.keyVaultName == self.activeKey.keyVaultName' + - message: keyVaultType is immutable + rule: '(has(self.keyVaultType) ? self.keyVaultType : ''KeyVault'') + == (has(oldSelf.keyVaultType) ? oldSelf.keyVaultType : + ''KeyVault'')' ibmcloud: description: ibmcloud defines metadata for the IBM Cloud KMS encryption strategy @@ -8736,15 +8753,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 @@ -8971,15 +8987,14 @@ spec: description: azure holds the Azure KMS key identity fields. properties: keyName: - description: keyName is the name of the keyvault key used - for encrypt/decrypt + description: keyName is the name of the key used for encrypt/decrypt. maxLength: 255 minLength: 1 type: string keyVaultName: description: |- - keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name - Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI: + keyVaultName is the name of the Key Vault or Managed HSM. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name + Your Microsoft Entra application used to create the cluster must be authorized to access this resource, e.g using the AzureCLI: `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn ` maxLength: 255 minLength: 1 diff --git a/docs/content/reference/aggregated-docs.md b/docs/content/reference/aggregated-docs.md index 0f1a01aae0e1..d9658c283277 100644 --- a/docs/content/reference/aggregated-docs.md +++ b/docs/content/reference/aggregated-docs.md @@ -55176,3 +55176,4 @@ This video demonstrates how to deploy a Hosted Control Plane using the Multiclus This video demonstrates how to deploy an IPv6, fully disconnected Hosted Control Plane using the Agent provider. + From ad40fdd2f22e6b6fd9f56927a482d273b3ae392f Mon Sep 17 00:00:00 2001 From: Hilliary Lipsig Date: Thu, 27 Aug 2026 15:41:33 -0700 Subject: [PATCH 8/8] test(control-plane-operator): cover Managed HSM KMS configuration Port the Managed HSM sidecar flag and provider identity tests to the release-4.22 Azure KMS provider API. Signed-off-by: Hilliary Lipsig Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../v2/kas/kms/azure_test.go | 112 ++++++++++++++++++ 1 file changed, 112 insertions(+) create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure_test.go diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure_test.go new file mode 100644 index 000000000000..38b0b0a9cbbd --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/kms/azure_test.go @@ -0,0 +1,112 @@ +package kms + +import ( + "testing" + + . "github.com/onsi/gomega" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + + corev1 "k8s.io/api/core/v1" +) + +func TestBuildKASContainerAzureKMS(t *testing.T) { + tests := []struct { + name string + keyVaultType hyperv1.AzureKMSKeyVaultType + expectManagedHSM bool + }{ + { + name: "When keyVaultType is omitted, it should not pass the managed HSM flag", + }, + { + name: "When keyVaultType is KeyVault, it should not pass the managed HSM flag", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeKeyVault, + }, + { + name: "When keyVaultType is ManagedHSM, it should pass the managed HSM flag", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + expectManagedHSM: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + g := NewWithT(t) + spec := &hyperv1.AzureKMSSpec{ + ActiveKey: hyperv1.AzureKMSKey{ + KeyVaultName: "vault", + KeyName: "key", + KeyVersion: "1", + }, + BackupKey: &hyperv1.AzureKMSKey{ //nolint:staticcheck + KeyVaultName: "vault", + KeyName: "backup", + KeyVersion: "1", + }, + KeyVaultType: tt.keyVaultType, + } + provider, err := NewAzureKMSProvider(spec.ActiveKey, spec.BackupKey, spec, "test-kms-image:latest") //nolint:staticcheck + g.Expect(err).NotTo(HaveOccurred()) + + podConfig, err := provider.GenerateKMSPodConfig() + g.Expect(err).NotTo(HaveOccurred()) + for _, name := range []string{"azure-kms-provider-active", "azure-kms-provider-backup"} { + container := findContainer(podConfig.Containers, name) + g.Expect(container).NotTo(BeNil()) + if tt.expectManagedHSM { + g.Expect(container.Args).To(ContainElement("--managed-hsm")) + } else { + g.Expect(container.Args).NotTo(ContainElement("--managed-hsm")) + } + } + }) + } +} + +func TestAzureKMSProviderName(t *testing.T) { + const legacyProviderName = "azure-be23a676" + key := hyperv1.AzureKMSKey{KeyVaultName: "vault", KeyName: "key", KeyVersion: "1"} + + tests := []struct { + name string + keyVaultType hyperv1.AzureKMSKeyVaultType + expectLegacy bool + }{ + { + name: "When keyVaultType is omitted, it should produce the legacy provider name", + expectLegacy: true, + }, + { + name: "When keyVaultType is KeyVault, it should preserve the legacy provider name", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeKeyVault, + expectLegacy: true, + }, + { + name: "When keyVaultType is ManagedHSM, it should produce a different provider name", + keyVaultType: hyperv1.AzureKMSKeyVaultTypeManagedHSM, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + g := NewWithT(t) + name, err := AzureKMSProviderName(key, tt.keyVaultType) + g.Expect(err).NotTo(HaveOccurred()) + if tt.expectLegacy { + g.Expect(name).To(Equal(legacyProviderName)) + } else { + g.Expect(name).NotTo(Equal(legacyProviderName)) + } + }) + } +} + +func findContainer(containers []corev1.Container, name string) *corev1.Container { + for i := range containers { + if containers[i].Name == name { + return &containers[i] + } + } + return nil +}
+keyVaultType
+ + +AzureKMSKeyVaultType + + +		 +(Optional) +

keyVaultType specifies whether activeKey and backupKey are hosted by Azure Key Vault or Azure Managed HSM. +Valid values are “KeyVault” and “ManagedHSM”. +When set to “KeyVault”, both keys are hosted by Azure Key Vault. +When set to “ManagedHSM”, both keys are hosted by Azure Managed HSM. +The type is immutable; key rotation must remain within the same service. +When omitted, the keys are treated as Key Vault keys.

+
keyVaultAccess
@@ -3988,7 +4031,7 @@ string 		(Optional) -

cloud is the cloud environment identifier, valid values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33

+

cloud is the Azure cloud environment identifier.
(Optional) -

encryptionKeyURL is the URL of the Azure Key Vault key used for encryption. -Must be a valid Azure Key Vault key URL in the format -“https://.vault.azure.net/keys/[/]”. +

encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption. +Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). +Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). +Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver. This field is immutable once set and cannot be removed.
-

encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. -Must be a valid Azure Key Vault key URL in the format -“https://.vault.azure.net/keys/[/]”.

+

encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key to use for encrypting etcd backup artifacts. +Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). +Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). +Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver.
-

encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. -Must be a valid Azure Key Vault key URL in the format -“https://.vault.azure.net/keys/[/]”.

+

encryptionKeyURL is the URL of the Azure Key Vault or Managed HSM key used for encryption of the backup. +Key Vault URLs are supported in Azure Public Cloud (vault.azure.net), Azure US Government Cloud (vault.usgovcloudapi.net), Azure China Cloud (vault.azure.cn), Azure German Cloud (vault.microsoftazure.de), and Azure Bleu Cloud (vault.sovcloud-api.fr). +Managed HSM URLs are supported in Azure Public Cloud (managedhsm.azure.net), Azure US Government Cloud (managedhsm.usgovcloudapi.net), Azure China Cloud (managedhsm.azure.cn), Azure German Cloud (managedhsm.microsoftazure.de), and Azure Bleu Cloud (managedhsm.sovcloud-api.fr). +Supporting another cloud requires adding its DNS suffix to this validation and the Azure endpoint resolver.