Project setup script authorizes GCE to use Cloud KMS keys on the dev project.
# This script will setup the given project with a Service Account that has the correct
# restricted permissions to run the gcp_compute_persistent_disk_csi_driver and download
-# the keys to a specified directory
+# the keys to a specified directory. This script also authorizes GCE to encrypt/decrypt
+# using Cloud KMS keys for the CMEK feature.
# WARNING: This script will delete and recreate the service accounts, bindings, and keys
# associated with ${GCE_PD_SA_NAME}. Great care must be taken to not run the script
# PROJECT: GCP project
# GCE_PD_SA_NAME: Name of the service account to create
# GCE_PD_SA_DIR: Directory to save the service account key
+# ENABLE_KMS: If true, it will enable Cloud KMS and configure IAM ACLs.
set -o nounset
@@ -24,6 +26,7 @@ source "${PKGDIR}/deploy/common.sh"
ensure_var PROJECT
ensure_var GCE_PD_SA_NAME
ensure_var GCE_PD_SA_DIR
+ensure_var ENABLE_KMS
# If the project id includes the org name in the format "org-name:project", the
# gCloud api will format the project part of the iam email domain as
@@ -38,6 +41,7 @@ fi
readonly KUBEDEPLOY="${PKGDIR}/deploy/kubernetes"
readonly BIND_ROLES=$(get_needed_roles)
readonly IAM_NAME="${GCE_PD_SA_NAME}@${IAM_PROJECT}.iam.gserviceaccount.com"
+readonly PROJECT_NUMBER=`gcloud projects describe ${PROJECT} --format="value(projectNumber)"`
# Check if SA exists
CREATE_SA=true
@@ -91,6 +95,15 @@ do
gcloud projects add-iam-policy-binding "${PROJECT}" --member serviceAccount:"${IAM_NAME}" --role "${role}"
done
+# Authorize GCE to encrypt/decrypt using Cloud KMS encryption keys.
+# https://cloud.google.com/compute/docs/disks/customer-managed-encryption#before_you_begin
+if [ "${ENABLE_KMS}" = true ];
+then
+ gcloud services enable cloudkms.googleapis.com --project="${PROJECT}"
+ gcloud projects add-iam-policy-binding "${PROJECT}" --member serviceAccount:"service-${PROJECT_NUMBER}@compute-system.iam.gserviceaccount.com" --role "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+fi
+
+
# Export key if needed
if [ "${CREATE_SA}" = true ];
then
