Enable Customer-Managed Encryption Keys (Cmek) For Gke Persistent Disks

#!/usr/bin/env bash
#
# Report GKE PD encryption (CMEK vs Google-managed) for all PersistentVolumes
# that use GCE Persistent Disk in the current cluster.
#
# REQUIREMENTS:
#   - Run on: any machine with kubectl and gcloud configured
#   - kubectl context set to target cluster
#   - gcloud project set (or pass --project explicitly)
#
# USAGE:
#   export PROJECT_ID="my-gcp-project"   # optional if gcloud default is set
#   ./check_gke_pv_cmek.sh

set -euo pipefail

PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project 2>/dev/null || true)}"

if [[ -z "$PROJECT_ID" || "$PROJECT_ID" == "(unset)" ]]; then
  echo "ERROR: PROJECT_ID is not set and gcloud default project is unset."
  echo "Set it with: export PROJECT_ID='my-gcp-project'"
  exit 1
fi

echo "Using GCP project: $PROJECT_ID" >&2

# List all GCE PD-backed PVs
echo "Collecting PersistentVolumes using GCE Persistent Disks..." >&2
pv_json=$(kubectl get pv -o json)

# Extract relevant fields: PV name, storage class, and PD identifier
# Supports both:
#   - pdName (kubernetes.io/gce-pd)
#   - volumeHandle (CSI pd.csi.storage.gke.io)
echo "pv_name,storage_class,driver,type,pd_identifier,zone_or_region,kms_key_name" 

echo "$pv_json" | jq -r '.items[]
  | {
      pv_name: .metadata.name,
      storage_class: (.spec.storageClassName // ""),
      gce_pd_name: (
        ( .spec.gcePersistentDisk.pdName // "" ) as $pd
        | if $pd == "" then null else $pd end
      ),
      csi_driver: (.spec.csi.driver // ""),
      csi_handle: (.spec.csi.volumeHandle // "")
    }
  | select(.gce_pd_name != null or .csi_driver == "pd.csi.storage.gke.io")
  | if .gce_pd_name != null then
      {
        pv_name: .pv_name,
        storage_class: .storage_class,
        driver: "in-tree-gce-pd",
        type: "zonal-or-regional-unknown",
        pd_identifier: .gce_pd_name
      }
    else
      # CSI PD handles look like:
      #   projects/PROJECT/zones/ZONE/disks/DISK
      #   projects/PROJECT/regions/REGION/disks/DISK
      #   or similar variants
      ( .csi_handle
        | capture("^projects/(?<project>[^/]+)/(?<loc_type>zones|regions)/(?<location>[^/]+)/disks/(?<disk>.+)$")
      ) as $h
      | {
          pv_name: .pv_name,
          storage_class: .storage_class,
          driver: "csi-pd",
          type: $h.loc_type,
          pd_identifier: $h.disk,
          location: $h.location
        }
    end
  | @tsv' | while IFS=$'\t' read -r PV_NAME STORAGE_CLASS DRIVER TYPE PD_ID LOCATION; do

  # Determine API location flag and value for gcloud based on TYPE
  LOCATION_FLAG=""
  LOCATION_VALUE=""

  case "$DRIVER" in
    in-tree-gce-pd)
      # For in-tree PD we don't know zone/region from PV alone.
      # Try to find from an attached node (best-effort); if not found, skip.
      # This is a heuristic: we inspect nodes with this PV mounted.
      NODE=$(kubectl get pods --all-namespaces -o json \
        | jq -r --arg pv "$PV_NAME" '
            .items[]
            | select(.spec.volumes[]? | .persistentVolumeClaim? | .persistentVolumeClaim.claimName != null)
            | .spec.nodeName' \
        | head -n1)

      if [[ -z "$NODE" || "$NODE" == "null" ]]; then
        echo "$PV_NAME,$STORAGE_CLASS,$DRIVER,$TYPE,$PD_ID,UNKNOWN,UNKNOWN (node/zone not inferred)" 
        continue
      fi

      ZONE=$(kubectl get node "$NODE" -o json \
        | jq -r '.metadata.labels["topology.gke.io/zone"] // .metadata.labels["topology.kubernetes.io/zone"] // empty')

      if [[ -z "$ZONE" ]]; then
        echo "$PV_NAME,$STORAGE_CLASS,$DRIVER,$TYPE,$PD_ID,UNKNOWN,UNKNOWN (zone label missing)" 
        continue
      fi

      LOCATION_FLAG="--zone"
      LOCATION_VALUE="$ZONE"
      ;;
    csi-pd)
      if [[ "$TYPE" == "zones" ]]; then
        LOCATION_FLAG="--zone"
        LOCATION_VALUE="$LOCATION"
      elif [[ "$TYPE" == "regions" ]]; then
        LOCATION_FLAG="--region"
        LOCATION_VALUE="$LOCATION"
      else
        echo "$PV_NAME,$STORAGE_CLASS,$DRIVER,$TYPE,$PD_ID,UNKNOWN,UNKNOWN (unrecognized CSI handle type)" 
        continue
      fi
      ;;
    *)
      echo "$PV_NAME,$STORAGE_CLASS,$DRIVER,$TYPE,$PD_ID,UNKNOWN,UNKNOWN (unsupported driver)" 
      continue
      ;;
  esac

  # Query GCE disk encryption key
  KMS_KEY_NAME=$(gcloud compute disks describe "$PD_ID" \
    $LOCATION_FLAG "$LOCATION_VALUE" \
    --project "$PROJECT_ID" \
    --format json 2>/dev/null \
    | jq -r '.diskEncryptionKey.kmsKeyName // "GOOGLE-MANAGED-DEFAULT"')

  echo "$PV_NAME,$STORAGE_CLASS,$DRIVER,$TYPE,$PD_ID,${LOCATION_VALUE:-UNKNOWN},$KMS_KEY_NAME"
done