whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix indentation of list and code snippet for kms-provider

Browse Source
This commit is contained in:
Qiming Teng
2020-07-04 12:31:10 +08:00
parent c452e65a62
commit f03c187987
1 changed files with 90 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tasks/administer-cluster/kms-provider.md
+90 -86
View File
@@ -7,10 +7,8 @@ content_type: task
<!-- overview --> <!-- overview -->
This page shows how to configure a Key Management Service (KMS) provider and plugin to enable secret data encryption. This page shows how to configure a Key Management Service (KMS) provider and plugin to enable secret data encryption.
## {{% heading "prerequisites" %}} ## {{% heading "prerequisites" %}}
* {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
* Kubernetes version 1.10.0 or later is required * Kubernetes version 1.10.0 or later is required
@@ -19,8 +17,6 @@ This page shows how to configure a Key Management Service (KMS) provider and plu
{{< feature-state for_k8s_version="v1.12" state="beta" >}} {{< feature-state for_k8s_version="v1.12" state="beta" >}}
<!-- steps --> <!-- steps -->
The KMS encryption provider uses an envelope encryption scheme to encrypt data in etcd. The data is encrypted using a data encryption key (DEK); a new DEK is generated for each encryption. The DEKs are encrypted with a key encryption key (KEK) that is stored and managed in a remote KMS. The KMS provider uses gRPC to communicate with a specific KMS The KMS encryption provider uses an envelope encryption scheme to encrypt data in etcd. The data is encrypted using a data encryption key (DEK); a new DEK is generated for each encryption. The DEKs are encrypted with a key encryption key (KEK) that is stored and managed in a remote KMS. The KMS provider uses gRPC to communicate with a specific KMS
@@ -30,10 +26,12 @@ plugin. The KMS plugin, which is implemented as a gRPC server and deployed on th
To configure a KMS provider on the API server, include a provider of type ```kms``` in the providers array in the encryption configuration file and set the following properties: To configure a KMS provider on the API server, include a provider of type ```kms``` in the providers array in the encryption configuration file and set the following properties:
* `name`: Display name of the KMS plugin. * `name`: Display name of the KMS plugin.
* `endpoint`: Listen address of the gRPC server (KMS plugin). The endpoint is a UNIX domain socket. * `endpoint`: Listen address of the gRPC server (KMS plugin). The endpoint is a UNIX domain socket.
* `cachesize`: Number of data encryption keys (DEKs) to be cached in the clear. When cached, DEKs can be used without another call to the KMS; whereas DEKs that are not cached require a call to the KMS to unwrap. * `cachesize`: Number of data encryption keys (DEKs) to be cached in the clear.
* `timeout`: How long should kube-apiserver wait for kms-plugin to respond before returning an error (default is 3 seconds). When cached, DEKs can be used without another call to the KMS;
whereas DEKs that are not cached require a call to the KMS to unwrap.
* `timeout`: How long should kube-apiserver wait for kms-plugin to respond before returning an error (default is 3 seconds).
See [Understanding the encryption at rest configuration.](/docs/tasks/administer-cluster/encrypt-data) See [Understanding the encryption at rest configuration.](/docs/tasks/administer-cluster/encrypt-data)
@@ -57,17 +55,18 @@ Then use the functions and data structures in the stub file to develop the serve
* kms plugin version: `v1beta1` * kms plugin version: `v1beta1`
In response to procedure call Version, a compatible KMS plugin should return v1beta1 as VersionResponse.version In response to procedure call Version, a compatible KMS plugin should return v1beta1 as VersionResponse.version.
* message version: `v1beta1` * message version: `v1beta1`
All messages from KMS provider have the version field set to current version v1beta1 All messages from KMS provider have the version field set to current version v1beta1.
* protocol: UNIX domain socket (`unix`) * protocol: UNIX domain socket (`unix`)
The gRPC server should listen at UNIX domain socket The gRPC server should listen at UNIX domain socket.
### Integrating a KMS plugin with the remote KMS ### Integrating a KMS plugin with the remote KMS
The KMS plugin can communicate with the remote KMS using any protocol supported by the KMS. The KMS plugin can communicate with the remote KMS using any protocol supported by the KMS.
All configuration data, including authentication credentials the KMS plugin uses to communicate with the remote KMS, All configuration data, including authentication credentials the KMS plugin uses to communicate with the remote KMS,
are stored and managed by the KMS plugin independently. The KMS plugin can encode the ciphertext with additional metadata that may be required before sending it to the KMS for decryption. are stored and managed by the KMS plugin independently. The KMS plugin can encode the ciphertext with additional metadata that may be required before sending it to the KMS for decryption.
@@ -80,108 +79,113 @@ To encrypt the data:
1. Create a new encryption configuration file using the appropriate properties for the `kms` provider: 1. Create a new encryption configuration file using the appropriate properties for the `kms` provider:
```yaml ```yaml
apiVersion: apiserver.config.k8s.io/v1 apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration kind: EncryptionConfiguration
resources: resources:
- resources: - resources:
- secrets - secrets
providers: providers:
- kms: - kms:
name: myKmsPlugin name: myKmsPlugin
endpoint: unix:///tmp/socketfile.sock endpoint: unix:///tmp/socketfile.sock
cachesize: 100 cachesize: 100
timeout: 3s timeout: 3s
- identity: {} - identity: {}
``` ```
2. Set the `--encryption-provider-config` flag on the kube-apiserver to point to the location of the configuration file. 1. Set the `--encryption-provider-config` flag on the kube-apiserver to point to the location of the configuration file.
3. Restart your API server. 1. Restart your API server.
Note:
The alpha version of the encryption feature prior to 1.13 required a config file with
`kind: EncryptionConfig` and `apiVersion: v1`, and used the `--experimental-encryption-provider-config` flag.
## Verifying that the data is encrypted ## Verifying that the data is encrypted
Data is encrypted when written to etcd. After restarting your kube-apiserver, any newly created or updated secret should be encrypted when stored. To verify, you can use the etcdctl command line program to retrieve the contents of your secret.
Data is encrypted when written to etcd. After restarting your `kube-apiserver`,
any newly created or updated secret should be encrypted when stored. To verify,
you can use the `etcdctl` command line program to retrieve the contents of your secret.
1. Create a new secret called secret1 in the default namespace: 1. Create a new secret called secret1 in the default namespace:
``` ```
kubectl create secret generic secret1 -n default --from-literal=mykey=mydata kubectl create secret generic secret1 -n default --from-literal=mykey=mydata
``` ```
2. Using the etcdctl command line, read that secret out of etcd: 1. Using the etcdctl command line, read that secret out of etcd:
``` ```
ETCDCTL_API=3 etcdctl get /kubernetes.io/secrets/default/secret1 [...] | hexdump -C ETCDCTL_API=3 etcdctl get /kubernetes.io/secrets/default/secret1 [...] | hexdump -C
``` ```
where `[...]` must be the additional arguments for connecting to the etcd server. where `[...]` must be the additional arguments for connecting to the etcd server.
3. Verify the stored secret is prefixed with `k8s:enc:kms:v1:`, which indicates that the `kms` provider has encrypted the resulting data. 1. Verify the stored secret is prefixed with `k8s:enc:kms:v1:`, which indicates that the `kms` provider has encrypted the resulting data.
4. Verify that the secret is correctly decrypted when retrieved via the API: 1. Verify that the secret is correctly decrypted when retrieved via the API:
``` ```
kubectl describe secret secret1 -n default kubectl describe secret secret1 -n default
``` ```
should match `mykey: mydata` should match `mykey: mydata`
## Ensuring all secrets are encrypted ## Ensuring all secrets are encrypted
Because secrets are encrypted on write, performing an update on a secret encrypts that content. Because secrets are encrypted on write, performing an update on a secret encrypts that content.
The following command reads all secrets and then updates them to apply server side encryption. If an error occurs due to a conflicting write, retry the command. For larger clusters, you may wish to subdivide the secrets by namespace or script an update. The following command reads all secrets and then updates them to apply server side encryption.
If an error occurs due to a conflicting write, retry the command.
For larger clusters, you may wish to subdivide the secrets by namespace or script an update.
``` ```
kubectl get secrets --all-namespaces -o json | kubectl replace -f - kubectl get secrets --all-namespaces -o json | kubectl replace -f -
``` ```
## Switching from a local encryption provider to the KMS provider ## Switching from a local encryption provider to the KMS provider
To switch from a local encryption provider to the `kms` provider and re-encrypt all of the secrets: To switch from a local encryption provider to the `kms` provider and re-encrypt all of the secrets:
1. Add the `kms` provider as the first entry in the configuration file as shown in the following example. 1. Add the `kms` provider as the first entry in the configuration file as shown in the following example.
```yaml ```yaml
apiVersion: apiserver.config.k8s.io/v1 apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration kind: EncryptionConfiguration
resources: resources:
- resources: - resources:
- secrets - secrets
providers: providers:
- kms: - kms:
name : myKmsPlugin name : myKmsPlugin
endpoint: unix:///tmp/socketfile.sock endpoint: unix:///tmp/socketfile.sock
cachesize: 100 cachesize: 100
- aescbc: - aescbc:
keys: keys:
- name: key1 - name: key1
secret: <BASE 64 ENCODED SECRET> secret: <BASE 64 ENCODED SECRET>
``` ```
2. Restart all kube-apiserver processes. 1. Restart all kube-apiserver processes.
3. Run the following command to force all secrets to be re-encrypted using the `kms` provider. 1. Run the following command to force all secrets to be re-encrypted using the `kms` provider.
``` ```
kubectl get secrets --all-namespaces -o json| kubectl replace -f - kubectl get secrets --all-namespaces -o json| kubectl replace -f -
``` ```
## Disabling encryption at rest ## Disabling encryption at rest
To disable encryption at rest: To disable encryption at rest:
1. Place the `identity` provider as the first entry in the configuration file: 1. Place the `identity` provider as the first entry in the configuration file:
```yaml ```yaml
apiVersion: apiserver.config.k8s.io/v1 apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration kind: EncryptionConfiguration
resources: resources:
- resources: - resources:
- secrets - secrets
providers: providers:
- identity: {} - identity: {}
- kms: - kms:
name : myKmsPlugin name : myKmsPlugin
endpoint: unix:///tmp/socketfile.sock endpoint: unix:///tmp/socketfile.sock
cachesize: 100 cachesize: 100
``` ```
2. Restart all kube-apiserver processes. 1. Restart all kube-apiserver processes.
3. Run the following command to force all secrets to be decrypted. 1. Run the following command to force all secrets to be decrypted.
``` ```
kubectl get secrets --all-namespaces -o json | kubectl replace -f - kubectl get secrets --all-namespaces -o json | kubectl replace -f -
``` ```