Add support for ETCD encryption in Cloudstack

[abhinavmpandey08]

Description of changes:
Add support for ETCD Encryption in Cloudstack using KMS encryption provider.

Testing (if applicable):
Created a cluster, deployed pod-identity-webhook and configured IRSA, and deployed aws-encryption-provider daemonset to start the KMS provider. Then ran upgrade with the encryption config and verified on the etcd node that the secrets were encrypted.

Sample CloudStack cluster spec with encryption config:

apiVersion: anywhere.eks.amazonaws.com/v1alpha1
kind: Cluster
metadata:
  name: test-workload-2
  namespace: default
spec:
  clusterNetwork:
    cniConfig:
      cilium: {}
    pods:
      cidrBlocks:
      - 192.168.0.0/16
    services:
      cidrBlocks:
      - 10.96.0.0/12
  controlPlaneConfiguration:
    count: 1
    endpoint:
      host: 10.80.193.31
    machineGroupRef:
      kind: CloudStackMachineConfig
      name: test-workload-2-cp
  datacenterRef:
    kind: CloudStackDatacenterConfig
    name: test-workload-2
  eksaVersion: v0.0.0-dev+build.7604
  externalEtcdConfiguration:
    count: 1
    machineGroupRef:
      kind: CloudStackMachineConfig
      name: test-workload-2-etcd
  kubernetesVersion: "1.24"
  machineHealthCheck:
    nodeStartupTimeout: 10m0s
    unhealthyMachineTimeout: 5m0s
  managementCluster:
    name: test-mgmt
  podIamConfig:
    serviceAccountIssuer: https://s3.us-west-2.amazonaws.com/<s3-bucket-name>
  etcdEncryption:
  - providers:
    - kms:
        name: config1
        socketListenAddress: unix:///var/run/kmsplugin/socket.sock
        cacheSize: 1000
        timeout: 3s
    resources:
    - secrets
  workerNodeGroupConfigurations:
  - count: 1
    machineGroupRef:
      kind: CloudStackMachineConfig
      name: test-workload-2
    name: md-0

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[abhinavmpandey08]

/hold

[codecov]

Codecov Report

Patch coverage: 89.65% and project coverage change: +0.01% 🎉

Comparison is base (89bbfa3) 75.64% compared to head (95ef6a7) 75.66%.
Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6557      +/-   ##
==========================================
+ Coverage   75.64%   75.66%   +0.01%     
==========================================
  Files         474      475       +1     
  Lines       38303    38359      +56     
==========================================
+ Hits        28973    29023      +50     
- Misses       7723     7727       +4     
- Partials     1607     1609       +2     

Files Changed	Coverage Δ
pkg/providers/cloudstack/template.go	88.61% <62.50%> (-0.66%)	⬇️
...kg/providers/common/encryption_config_generator.go	92.68% <92.68%> (ø)
pkg/api/v1alpha1/etcdencryption.go	100.00% <100.00%> (ø)
pkg/clusterapi/extraargs.go	97.32% <100.00%> (+0.17%)	⬆️

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[abhinavmpandey08]

/unhold

[pokearu]

/lgtm
/woof
/approve

[eks-distro-bot]

@pokearu:

In response to this:

/lgtm
/woof
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[eks-distro-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pokearu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [pokearu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment