k8s.io/apiserver@v0.31.1/pkg/storage/value/encrypt/identity/identity.go (about)

     1  /*
     2  Copyright 2017 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package identity
    18  
    19  import (
    20  	"bytes"
    21  	"context"
    22  	"fmt"
    23  
    24  	"k8s.io/apiserver/pkg/storage/value"
    25  )
    26  
    27  var (
    28  	transformer      = identityTransformer{}
    29  	encryptedPrefix  = []byte("k8s:enc:")
    30  	errEncryptedData = fmt.Errorf("identity transformer tried to read encrypted data")
    31  )
    32  
    33  // identityTransformer performs no transformation on provided data, but validates
    34  // that the data is not encrypted data during TransformFromStorage
    35  type identityTransformer struct{}
    36  
    37  // NewEncryptCheckTransformer returns an identityTransformer which returns an error
    38  // on attempts to read encrypted data
    39  func NewEncryptCheckTransformer() value.Transformer {
    40  	return transformer
    41  }
    42  
    43  // TransformFromStorage returns the input bytes if the data is not encrypted
    44  func (identityTransformer) TransformFromStorage(ctx context.Context, data []byte, dataCtx value.Context) ([]byte, bool, error) {
    45  	// identityTransformer has to return an error if the data is encoded using another transformer.
    46  	// JSON data starts with '{'. Protobuf data has a prefix 'k8s[\x00-\xFF]'.
    47  	// Prefix 'k8s:enc:' is reserved for encrypted data on disk.
    48  	if bytes.HasPrefix(data, encryptedPrefix) {
    49  		return nil, false, errEncryptedData
    50  	}
    51  	return data, false, nil
    52  }
    53  
    54  // TransformToStorage implements the Transformer interface for identityTransformer
    55  func (identityTransformer) TransformToStorage(ctx context.Context, data []byte, dataCtx value.Context) ([]byte, error) {
    56  	return data, nil
    57  }