# 2022-12-26-20:53:38+0800 Create a kms key CR

- Cause:

The autonomous team want to enable the OOM volume feature for our internal cluster(cluster_id: 1379661944580644069), but it did not work.

After investigation, I found that there is no kms key CR for this cluster, which makes the reconciliation will always fail at [here](https://github.com/tidbcloud/infra-provider/blob/b051f865ea56135699938a2c6892d293a841a86c/infra-api/controllers/cluster/cluster_reconcilation.go#L95) ([logs](https://grafana.oauth.prod.aws.tidbcloud.com/explore?orgId=1&left=%7B%22datasource%22:%22ITBYlsjGz%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22expr%22:%22%7Bcluster%3D%5C%22base%2Feks%2Fus-west-2%5C%22,%20container%3D%5C%22manager%5C%22%7D%20%7C%3D%20%601379661944580644069%60%22,%22queryType%22:%22range%22,%22editorMode%22:%22builder%22%7D%5D,%22range%22:%7B%22from%22:%22now-1h%22,%22to%22:%22now%22%7D%7D)) and can not go to the logic of the OOM volume feature.

By checking the cluster's tc, we found it actually has a kms key, whose id is `5cb30744-9e15-4f3d-9b09-62bf324724d9` (maybe it's created manually, since the cluster's age is 494d).

To fix this, I want to create a kms key CR for this cluster with the annotation `crossplane.io/external-name` (the value is the kms key id), then the crossplane will import the resource.

- Operation:

```bash
# The content is mostly copied from the cluster 1379661944579024068's kms key CR.

kubectl create -f-<<EOF
apiVersion: kms.aws.crossplane.io/v1alpha1
kind: Key
metadata:
  annotations:
    crossplane.io/external-name: 5cb30744-9e15-4f3d-9b09-62bf324724d9
  labels:
    cloud.pingcap.com/provider-type: aws
    cluster.cloud.pingcap.com/name: "1379661944580644069"
    cluster.cloud.pingcap.com/namespace: prod-1372813089187041280
  name: prod-1372813089187041280-1379661944580644069
spec:
  deletionPolicy: Delete
  forProvider:
    enabled: true
    policy: |-
      {
        "Version" : "2012-10-17",
        "Id" : "key-default-1",
        "Statement" : [ {
          "Sid" : "Enable IAM User Permissions",
          "Effect" : "Allow",
          "Principal" : {
            "AWS" : "arn:aws:iam::380838443567:root"
          },
          "Action" : "kms:*",
          "Resource" : "*"
        } ]
      }
    region: us-west-2
  providerConfigRef:
    name: provider-aws
EOF
```

- Impact: Nothing

- Recovery operation: delete the kms key CR via `kubectl delete key.kms prod-1372813089187041280-1379661944580644069`

- Time window: Tue Dec 27 10:30:00 CST 2022 ~ Tue Dec 27 10:40:00 CST 2022