Encrypting Kubernetes Secrets At Rest In Etcd

#!/usr/bin/env bash
#
# Check OKE clusters for Secrets encryption at rest in etcd (CIS OKE 5.3.1)
#
# Requirements:
#   - OCI CLI configured with a profile that can list clusters and compartments
#   - jq
#
# Usage:
#   ./check_oke_secrets_encryption.sh \
#       --compartment-ids "ocid1.compartment.oc1..aaaa,ocid1.compartment.oc1..bbbb" \
#       [--profile MYPROFILE] \
#       [--region eu-frankfurt-1]

set -euo pipefail

COMPARTMENT_IDS=""
OCI_PROFILE=""
OCI_REGION=""

while [[ $# -gt 0 ]]; do
  case "$1" in
    --compartment-ids)
      COMPARTMENT_IDS="$2"
      shift 2
      ;;
    --profile)
      OCI_PROFILE="--profile $2"
      shift 2
      ;;
    --region)
      OCI_REGION="--region $2"
      shift 2
      ;;
    *)
      echo "Unknown argument: $1" >&2
      exit 1
      ;;
  esac
done

if [[ -z "${COMPARTMENT_IDS}" ]]; then
  echo "ERROR: --compartment-ids is required (comma-separated list)" >&2
  exit 1
fi

if ! command -v oci >/dev/null 2>&1; then
  echo "ERROR: oci CLI not found in PATH" >&2
  exit 1
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "ERROR: jq not found in PATH" >&2
  exit 1
fi

IFS=',' read -r -a COMPARTMENTS <<< "${COMPARTMENT_IDS}"

echo "=== OKE Secrets Encryption at Rest Report (CIS OKE 5.3.1) ==="
echo "Timestamp: $(date -u +"%Y-%m-%dT%H:%M:%SZ")"
echo

for COMP_ID in "${COMPARTMENTS[@]}"; do
  COMP_ID_TRIMMED="$(echo "${COMP_ID}" | xargs)"
  echo "Compartment: ${COMP_ID_TRIMMED}"
  echo "-----------------------------------------------------------------"

  # List all clusters in this compartment
  CLUSTERS_JSON="$(oci ce cluster list \
      --compartment-id "${COMP_ID_TRIMMED}" \
      ${OCI_PROFILE} ${OCI_REGION} \
      --all 2>/dev/null || true)"

  CLUSTER_COUNT="$(echo "${CLUSTERS_JSON}" | jq '.data | length')"

  if [[ -z "${CLUSTER_COUNT}" || "${CLUSTER_COUNT}" -eq 0 ]]; then
    echo "  No clusters found."
    echo
    continue
  fi

  echo "${CLUSTERS_JSON}" | jq -c '.data[]' | while read -r CL; do
    CL_OCID="$(echo "${CL}" | jq -r '.id')"
    CL_NAME="$(echo "${CL}" | jq -r '.name')"
    CL_LIFECYCLE_STATE="$(echo "${CL}" | jq -r '.lifecycle-state')"

    # Get full cluster details (includes kms-key-id)
    CL_DESC_JSON="$(oci ce cluster get \
        --cluster-id "${CL_OCID}" \
        ${OCI_PROFILE} ${OCI_REGION} 2>/dev/null || true)"

    KMS_KEY_ID="$(echo "${CL_DESC_JSON}" | jq -r '.data."kms-key-id" // empty')"

    echo "  Cluster: ${CL_NAME}"
    echo "    OCID: ${CL_OCID}"
    echo "    State: ${CL_LIFECYCLE_STATE}"

    if [[ -z "${KMS_KEY_ID}" || "${KMS_KEY_ID}" == "null" ]]; then
      echo "    KMS key: NONE CONFIGURED  <== REVIEW: Secrets likely NOT encrypted at rest"
    else
      echo "    KMS key: ${KMS_KEY_ID}    (Secrets encryption at rest ENABLED)"
    fi
    echo
  done
done

cat <<'EOF'

Interpretation:

- For each cluster:
  - "KMS key: <ocid1.key...> (Secrets encryption at rest ENABLED)"
      => Cluster is configured to use an OCI Vault (KMS) key for etcd secrets encryption.
         Next manual step: verify that cross-tenancy policies (if applicable) are correctly
         defined in both ClusterTenancy and KeyTenancy as per CIS OKE 5.3.1 remediation.

  - "KMS key: NONE CONFIGURED  <== REVIEW: Secrets likely NOT encrypted at rest"
      => Cluster was created without --kms-key-id and Secrets are likely stored
         unencrypted in etcd. This is a FINDING.
         Manual remediation:
           * For new clusters: create them with --kms-key-id pointing to a Vault key.
           * For cross-tenancy keys: define the required cross-tenancy policies in both
             tenancies, then recreate or newly create clusters with the desired key.

This script cannot automatically:
  - Create or rotate Vault keys
  - Configure or change the kms-key-id on existing clusters
  - Create the required cross-tenancy policies

Those must be designed and applied manually using OCI Console/CLI/IaC, following
the benchmark's guidance.
EOF