include encryption_at_rest path

charms/kubernetes_snaps.py

@@ -47,6 +47,14 @@ class ExternalCloud(Protocol):
 ]
 
 
+def _snap_common_path(component) -> Path:
+    return Path("/var/snap/{}/common".format(component))
+
+
+def encryption_config_path() -> Path:
+    return _snap_common_path("kube-apiserver") / "encryption/encryption_config.yaml"
+
+
 def configure_apiserver(
     advertise_address,
     audit_policy,
@@ -84,8 +92,9 @@ def configure_apiserver(
     api_opts["kubelet-preferred-address-types"] = (
         "InternalIP,Hostname,InternalDNS,ExternalDNS,ExternalIP"
     )
-    # TODO: encryption at rest
-    # api_opts["encryption-provider-config"] = str(encryption_config_path())
+    enc_provider_config = encryption_config_path()
+    if enc_provider_config.exists():
+        api_opts["encryption-provider-config"] = str(enc_provider_config)
 
     api_opts["advertise-address"] = advertise_address
 

tox.ini

@@ -23,7 +23,7 @@ deps =
     ruff
 commands =
     black {[vars]all_path}
-    ruff --fix {[vars]all_path}
+    ruff format {[vars]all_path}
 
 [testenv:lint]
 description = Check code against coding style standards
@@ -33,7 +33,7 @@ deps =
     codespell
 commands =
     codespell {toxinidir}
-    ruff {[vars]all_path}
+    ruff check {[vars]all_path}
     black --check --diff {[vars]all_path}
 
 [testenv:unit]