Class: KubeKrypt::Encryptor

Inherits:
Object
  • Object
show all
Defined in:
lib/kubekrypt/encryptor.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(key_name) ⇒ Encryptor

Returns a new instance of Encryptor.



5
6
7
8
 
# File 'lib/kubekrypt/encryptor.rb', line 5

def initialize(key_name)
  @client = Google::Cloud::Kms.key_management_service
  @key_name = key_name
end

Instance Attribute Details

#client ⇒ Object (readonly)

Returns the value of attribute client.



3
4
5
 
# File 'lib/kubekrypt/encryptor.rb', line 3

def client
  @client
end

#key_name ⇒ Object (readonly)

Returns the value of attribute key_name.



3
4
5
 
# File 'lib/kubekrypt/encryptor.rb', line 3

def key_name
  @key_name
end

Class Method Details

.call(content:, key_name:) ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/kubekrypt/encryptor.rb', line 16

def self.call(content:, key_name:)
  unless content["data"]
    raise InvalidSecretError,
      "no data key found — refusing to write the manifest through unencrypted"
  end

  encryptor = new(key_name)

  content["data"].transform_values! { |plaintext| encryptor.call(plaintext) }

  content[METADATA_KEY] = {
    KMS_KEY.to_s => key_name,
    "version" => VERSION,
    "modified_at" => Time.now.utc.iso8601
  }

  content.to_yaml
end

Instance Method Details

#call(plaintext) ⇒ Object 



10
11
12
13
14
 
# File 'lib/kubekrypt/encryptor.rb', line 10

def call(plaintext)
  ciphertext = client.encrypt(name: key_name, plaintext:).ciphertext

  "#{ENC_PREFIX}:#{Base64.strict_encode64(ciphertext)}"
end