Change:
Ref Ref ref /sig auth /kind feature /milestone v1.11 /priority important-longterm /status approved-for-milestone cc
What's need to be done here? I can think only about renaming to and updating the docs. What else?
What's required to promote encryption at rest with static configs to beta?
an example of promoting flags is here: If there's a feature gate, we're going to want to enable it by default too.
/assign
submitted PRs for that: and
[MILESTONENOTIFIER] Milestone Removed From Issue Important: Code freeze is in effect and only issues with may remain in the v1.11 milestone. <details<summaryHelp</summary<ul<li<a href=""Additional instructions</a</li<li<a href=""Commands for setting labels</a</li</ul</details
Will this make it to Beta in 1.12? From sig-auth on 7/11, it sounded like this was missing a release shepherd. Is anyone owning pushing this forward?
I'll do my best to push this. edit: I did not realize that 1.12 feature freeze is today (or so I heard), I don't think I'll be able to make it :slightlyfrowningface:
Ack - that's what I was wondering (with the feature freeze). Thanks
- Is this making it to the 1.12 ?
The current plan is 1.13

Discussion:
//   "-c",      - Index 1 //   "exec /usr/local/bin/kube-apiserver " - Index 2 execArgsIndex        = 2 <del> encryptionConfigFlag = "--experimental-encryption-provider-config" </del> <ins> encryptionConfigFlag = "--encryption-provider-config" </ins> ) testCases := []struct {

# Sets-up etcd encryption. # Configuration of etcd level encryption consists of the following steps: # 1. Writing encryption provider config to disk <del> # 2. Adding experimental-encryption-provider-config flag to kube-apiserver </del> <ins> # 2. Adding encryption-provider-config flag to kube-apiserver </ins> # 3. Add kms-socket-vol and kms-socket-vol-mnt to enable communication with kms-plugin (if requested) # # Expects parameters:

encryption_provider_config_path=${ENCRYPTION_PROVIDER_CONFIG_PATH:-/etc/srv/kubernetes/encryption-provider-config.yml} echo "${ENCRYPTION_PROVIDER_CONFIG}" | base64 --decode > "${encryption_provider_config_path}" <del> kube_api_server_params+=" --experimental-encryption-provider-config=${encryption_provider_config_path}" </del> <ins> kube_api_server_params+=" --encryption-provider-config=${encryption_provider_config_path}" </ins> default_encryption_provider_config_vol=$(echo "{ "name": "encryptionconfig", "hostPath": {"path": "${encryption_provider_config_path}", "type": "File"}}" | base64 | tr -d 'rn') default_encryption_provider_config_vol_mnt=$(echo "{ "name": "encryptionconfig", "mountPath": "${encryption_provider_config_path}", "readOnly": true}" | base64 | tr -d 'rn')

fs.StringVar(&s.EncryptionProviderConfigFilepath, "experimental-encryption-provider-config", s.EncryptionProviderConfigFilepath, "The file containing configuration for encryption providers to be used for storing secrets in etcd") <ins> fs.MarkDeprecated("experimental-encryption-provider-config", "use --encryption-provider-config.") fs.StringVar(&s.EncryptionProviderConfigFilepath, "encryption-provider-config", s.EncryptionProviderConfigFilepath, "The file containing configuration for encryption providers to be used for storing secrets in etcd") </ins> fs.DurationVar(&s.StorageConfig.CompactionInterval, "etcd-compaction-interval", s.StorageConfig.CompactionInterval, "The interval of compaction requests. If 0, the compaction request from apiserver is disabled.")

func (e *transformTest) getEncryptionOptions() []string { if e.transformerConfig != "" { <del> return []string{"--experimental-encryption-provider-config", path.Join(e.configDir, encryptionConfigFileName)} </del> <ins> return []string{"--encryption-provider-config", path.Join(e.configDir, encryptionConfigFileName)} </ins> } return nil