Skip to content

k8s-kms-plugin_serve.md

Latest commit

 

History

History
95 lines (75 loc) · 4.25 KB

k8s-kms-plugin_serve.md

File metadata and controls

95 lines (75 loc) · 4.25 KB
Raw

k8s-kms-plugin serve

Handles Kubernetes KMS v2 requests

Synopsis

Handles Kubernetes KMS v2 requests but do not support key rotation. Use "k8s-kms-plugin serve rotation" subcommand to support key rotation. Kubernetes KMS documentation: https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/#configuring-the-kms-provider-kms-v2

KMS v2 API: https://pkg.go.dev/k8s.io/kms@v0.34.1/apis/v2

k8s-kms-plugin serve [flags]

Examples


Using flags and serving on unix socket (gRPC plaintext):
	k8s-kms-plugin 
	  serve \
		--log-level=info \
		--socket /run/user/1000/k8s-kms-plugin.sock \
		--p11-lib /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1 \
		--p11-label mylabel \
		--p11-pin mypin \
		--p11-key-label rsa0 \
		--algorithm rsa-oaep

Using both environment variables and configuration file and serving on unix socket:
	K8S_KMS_PLUGIN_SERVE_P11_PIN="mypin" k8s-kms-plugin serve --config my-kms-plugin-config.yaml

Using both CLI Flags, environment variables and configuration file and serving on unix socket:
	K8S_KMS_PLUGIN_SERVE_P11_PIN="mypin" k8s-kms-plugin --log-format=json serve --config my-kms-plugin-config.yaml

Using AES-CBC with HMAC authentication, using CKA_ID, using CLI flags and serving on unix socket:
	k8s-kms-plugin 
	  serve \
		--log-level=trace  \
		--socket /run/user/1000/k8s-kms-plugin.sock \
		--p11-lib /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1 \
		--p11-label mylabel \
		--p11-pin mypin \
		--p11-key-id 64636138353931326363356537313264 \
		--p11-hmac-id 30663536623936326235663530363234 \
		--algorithm aes-cbc

Options

      --algorithm string         Set the algorithm for encryption/decryption. Possible values: aes-gcm, aes-cbc, rsa-oaep. (default "aes-gcm")
      --allow-any                Allow any device (accepts all ids/secrets).
      --auto-create              Auto create the keys if needed.
      --ca-id string             Cert ID for CA Cert record. (default "1c3d30d5-dfa8-4167-a9f9-2c768464181b")
      --disable-socket           Disable socket based server.
      --enable-server            Enable TLS based server.
  -h, --help                     help for serve
      --host string              Hostname without port. (default "0.0.0.0")
  -p, --native-path string       Path to key store for native provider(Files only). (default ".keys")
      --p11-hmac-id string       Key ID CKA_ID for KMS HMAC.
      --p11-hmac-label string    Key Label CKA_LABEL to use for sha based verifications.
      --p11-key-id string        Key ID CKA_ID for KMS KEK.
      --p11-key-label string     Key Label CKA_LABEL to use for encrypt/decrypt.
      --p11-label string         P11 token label.
      --p11-lib string           Path to p11 library/client.
      --p11-pin string           P11 Pin.
      --p11-slot int             P11 token slot.
      --port uint16              TCP Port for gRPC service. (default 31400)
      --provider string          Provider. Possible values: p11, softhsm, luna, dpod. (default "p11")
      --socket string            Unix Socket. Example: /run/user/$(id -u $USER)/k8s-kms-plugin.sock. (default "/tmp/run/hsm-plugin-server.sock")
      --tls-ca string            TLS CA cert. (default "certs/ca.crt")
      --tls-certificate string   TLS server cert. (default "certs/tls.crt")
      --tls-key string           TLS server key. (default "certs/tls.key")

Options inherited from parent commands

      --config string       ConfigFile. Env var: K8S_KMS_PLUGIN_CONFIG_FILE (default "k8s-kms-plugin.config.yaml")
      --debug               Set logrus.SetLevel to "debug". This is equivalent to using --log-level=debug. Flags --log-level and --debug flag are mutually exclusive. Env var: K8S_KMS_PLUGIN_DEBUG.
      --log-format string   Logrus log output format. Possible values: text, json. Env var: K8S_KMS_PLUGIN_LOG_FORMAT (default "text")
      --log-level string    Set logrus.SetLevel. Possible values: trace, debug, info, warning, error, fatal and panic. Flags --log-level and --debug flag are mutually exclusive. Env var: K8S_KMS_PLUGIN_LOG_LEVEL. (default "info")

SEE ALSO

Auto generated by spf13/cobra on 6-Oct-2025