Add kmsKeyRef value for Bucket CRD

[philchristensen]

Is your feature request related to a problem?
I'm trying to create a Helm chart to deploy an S3 bucket that follows our company security credentials. For each bucket, we create a dedicated KMS key, but I'm not currently able to do that in a single Helm installation.

The Bucket CRD only has a encryption/rules/applyServerSideEncryptionByDefault/kmsMasterKeyID field, and I need to be able to pass a kmsKeyRef object, much like I can when creating a DBInstance object for RDS.

Describe the solution you'd like
I'd like the Bucket CRD to support encryption/rules/applyServerSideEncryptionByDefault/kmsKeyRef so I can pass in the key object I'm creating.

Describe alternatives you've considered
All the examples I can find online depend on using Bash variables to combine k8s manifests with AWS CLI lookups, but I don't have access to these things in an automated, GitOps-based installation process.

[jaypipes]

This should be a relatively straightforward thing to add, right @RedbackThomson?

[ack-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/aws-controllers-k8s/community.
/lifecycle stale

[ack-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/aws-controllers-k8s/community.
/lifecycle rotten

[ack-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Provide feedback via https://github.com/aws-controllers-k8s/community.
/close

[ack-prow]

@ack-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Provide feedback via https://github.com/aws-controllers-k8s/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jessebye]

@jaypipes @RedbackThomson Can this be reopened? We have the same use case.

[jessebye]

@jaypipes @a-hilaly we may be able to contribute towards a fix here, but I need a bit of guidance on where to start. This is impacting a use case we have where we create a new KMS key for each bucket and want to reference that KMS key's ARN in the bucket policy (as well as an IAM policy).

[michaelhtm]

Hello!
Thank you for taking initiative to contribute. To allow resource references please follow the following steps: https://aws-controllers-k8s.github.io/community/docs/contributor-docs/code-generator-config/#references-making-a-field-refer-to-another-resource

Feel free to reach out with any questions :)