Feat/k8s config etcd encryption

[clementnuss]

Pull Request

Note to the Contributor

I started implementing this feature after reading issue #10899 and more specifically @smira's comment.
As suggested, I created a new k8s document config package, in which I added the new EtcdEncryptionConfig config.

I made a few assumptions that require validation:

• only 1 EtcdEncryptionConfig can be specified per machine config
• I do not validate the content of the custom EtcdEncryptionConfig (i.e. if the user uploads a broken etcd config, etcd will crash as a result). we could import k8s upstream types and try to marshal, let me know if it should be done.
• when an EtcdEncryptionConfig is specified, talos default etcd encryptionconfig.yaml is completely bypassed

something else that got me thinking: if there are multiple documents to be added in the future to permit customize all k8s moving parts, wouldn't be smart if instead of creating multiple talos configs to embed the corresponding k8s config we directly allowed specifying the k8s config? with an example, instead of:

apiVersion: v1alpha1
kind: EtcdEncryptionConfig
config: |4
    apiVersion: apiserver.config.k8s.io/v1
    kind: EncryptionConfiguration
    ...

directly offer the possibility to use as a patch document

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
...

What? (description)

offers a config document based solution for the user to provide a custom
etcd encryption configuration. when specified, the custom encryption
config is applied as-is band it bypases the talos etcd encryption config

Why? (reasoning)

a custom etcd configuration is needed as soon as you want to rotate, or if you want to have more specific parameters than talos defaults (e.g. other encryption scheme, key names, resources to be encrypted, etc)

Acceptance

⚠️ still draft, I have some open questions before finalizing the PR and going through the checklist again.

Please use the following checklist:

• you linked an issue (if applicable)
• you included tests (if applicable)
• you ran conformance (make conformance) (GPG key missing)
• you formatted your code (make fmt)
• you linted your code (make lint)
• you generated documentation (make docs)
• you ran unit-tests (make unit-tests)

See make help for a description of the available targets.

[github-actions]

This PR is stale because it has been open 45 days with no activity.