Skip to content

docs: update manual installation #384

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yoyocircle wants to merge 2 commits into
base: master
Choose a base branch
from
Open

docs: update manual installation #384

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
05c7b79
docs: adjust used fields and fix typos
yoyocircle May 14, 2024
8199421
docs: update the descriptions of setting steps
yoyocircle May 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 17 additions & 8 deletions docs/manual-install.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,11 @@ This guide demonstrates steps required to enable the KMS Plugin for Key Vault in

[`/etc/kubernetes/azure.json`](https://kubernetes-sigs.github.io/cloud-provider-azure/install/configs/) is a well-known JSON file in each node that provides the details about which method KMS Plugin uses for access to Keyvault:

| Authentication method | `/etc/kubernetes/azure.json` fields used |
| -------------------------------- | ------------------------------------------------------------------------------------------- |
| System-assigned managed identity | `useManagedIdentityExtension: true` and `userAssignedIdentityID:""` |
| User-assigned managed identity | `useManagedIdentityExtension: true` and `userAssignedIdentityID:"<UserAssignedIdentityID>"` |
| Service principal (default) | `aadClientID: "<AADClientID>"` and `aadClientSecret: "<AADClientSecret>"` |
| Authentication method | `/etc/kubernetes/azure.json` fields used |
| -------------------------------- | ------------------------------------------------------------------------------------------------------ |
| System-assigned managed identity | `useManagedIdentityExtension: true` and `userAssignedIdentityID:""` |
| User-assigned managed identity | `useManagedIdentityExtension: true` and `userAssignedIdentityID:"<UserAssignedIdentityID>"` |
| Service principal (default) | `tenantId: "<AADTenantID>"`, `aadClientId: "<AADClientID>"` and `aadClientSecret: "<AADClientSecret>"` |

#### Obtaining the ID of the cluster managed identity/service principal

Expand Down Expand Up @@ -137,7 +137,7 @@ This guide demonstrates steps required to enable the KMS Plugin for Key Vault in

### 4. Create encryption configuration

Create a new encryption configuration file `/etc/kubernetes/manifests/encryptionconfig.yaml` using the appropriate properties for the `kms` provider:
Create a new encryption configuration file `/etc/kubernetes/enc/encryptionconfig.yaml` using the appropriate properties for the `kms` provider:
Copy link
Copy Markdown

@benjaminapetersen benjaminapetersen Aug 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These bits look important to get right, I imagine incorrect paths will result in a broken install. I'm not familiar off the top of my head.

@enj @aramase for 👀 ?


```yaml
kind: EncryptionConfiguration
Expand All @@ -147,6 +147,8 @@ This guide demonstrates steps required to enable the KMS Plugin for Key Vault in
- secrets
providers:
- kms:
# if you are using KMSv2, please specify the api version
# apiVersion: v2
name: azurekmsprovider
endpoint: unix:///opt/azurekms.socket # This endpoint must match the value defined in --listen-addr for the KMS plugin
cachesize: 1000
Expand All @@ -155,23 +157,30 @@ This guide demonstrates steps required to enable the KMS Plugin for Key Vault in

The encryption configuration file needs to be accessible by all the api servers.

### 5. Modify `/etc/kubernetes/kube-apiserver.yaml`
### 5. Modify `/etc/kubernetes/manifests/kube-apiserver.yaml`

Add the following flag:

```yaml
--encryption-provider-config=/etc/kubernetes/encryptionconfig.yaml
--encryption-provider-config=/etc/kubernetes/enc/encryptionconfig.yaml
```

Mount `/opt` to access the socket:

```yaml
...
volumeMounts:
- name: enc
mountPath: /etc/kubernetes/enc
readOnly: true
- name: "sock"
mountPath: "/opt"
...
volumes:
- name: enc
hostPath:
path: /etc/kubernetes/enc
type: DirectoryOrCreate
- name: "sock"
hostPath:
path: "/opt"
Expand Down