In an ACK Edge Pro cluster, use keys from Alibaba Cloud Key Management Service (KMS) to encrypt Kubernetes Secrets at rest and strengthen data protection. This topic explains how to enable Secret encryption at rest with KMS-managed keys.ACK Edge Pro cluster with Key Management Service (KMS) keys to protect sensitive data stored in etcd.
Prerequisites
|
Item |
Description |
|
KMS key |
You have created a KMS key in the Key Management Service console, and the key is in the same region as the target ACK Pro cluster. ACK Pro clusters support default keys, software keys, and hardware keys. You can select a key type. For more information about key management and related operations, see Key management quick start. For details about KMS billing, see billing. Important
After you enable encryption at rest, do not use the KMS console or API to disable or delete the key that is used for secret encryption and decryption. Otherwise, the cluster API server becomes unavailable. As a result, you cannot retrieve objects such as secrets and ServiceAccounts, which disrupts your applications. |
|
Cluster network ACL rules |
When encryption at rest is enabled, the KMS plug-in on the control plane must access Alibaba Cloud KMS APIs to encrypt and decrypt secrets. To allow this, you must add rules that permit traffic to the |
|
Authorization |
Make sure that the required permissions are granted based on your account type.
|
Secret encryption
In a Kubernetes cluster, sensitive information for applications, such as passwords, TLS certificates, and Docker image credentials, is typically stored and managed by using secret objects. Kubernetes stores all secret object data in the cluster's etcd database. For more information about secrets, see Secrets.
In an ACK Edge Pro cluster, you can encrypt Kubernetes Secrets stored in etcd with a KMS key. The process uses the Kubernetes KMS Encryption Provider with envelope encryption:
-
When you store a Secret, the API server generates a data encryption key (DEK) to encrypt it, then encrypts the DEK with the KMS key. Both the encrypted Secret and encrypted DEK are stored in etcd.
-
When you retrieve a Secret, the API server calls KMS to decrypt the DEK, then uses the plaintext DEK to decrypt and return the Secret data.
For more information, see KMS Encryption Provider mechanism and Use a KMS key for envelope encryption.
Enable Secret encryption at rest in an ACK Edge Pro cluster
New clusters
Log on to the ACK console. In the left navigation pane, click Clusters.
-
On the Clusters page, click Create Kubernetes Cluster.
-
Click the ACK Edge tab. Expand Advanced Options (Optional). For Secret Encryption, select Select Key and choose a KMS key ID.
If you do not have a KMS key, click Create Key to create one in the KMS console.
For other ACK Edge Pro cluster parameters, see Create a cluster.
To verify, log on to the ActionTrail console and click Cluster Events Query. On the Cluster Events Query page, check for encryption and decryption events that use the
aliyuncsmanagedsecurityrolesystem role.
Existing clusters
Log on to the ACK console. In the left navigation pane, click Clusters.
-
On the Clusters page, click the name of the target cluster. On the cluster details page, click the Basic Information tab. In the Security and Auditing section, turn on the Secret Encryption switch.
The first time you enable this feature, you are prompted to grant permissions. Click Go to RAM console. On the Cloud Resource Access Authorization page for Resource Access Management (RAM), click Confirm.
Note-
To enable encryption at rest, make sure the logged-in RAM user or RAM role has RBAC administrator or O&M permissions on the cluster. For more information, see Authorize resources in a cluster by using RBAC.
-
To grant permissions to the AliyunCSManagedSecurityRole role, make sure you are logged in with an Alibaba Cloud account or a RAM user or RAM role that has RAM management permissions.
-
-
In the Secret Encryption dialog box, select an existing KMS key and click OK.
If you do not have a KMS key, click Create Key to go to the Key Management Service console and create a key. For more information, see Create a key.
When the cluster status changes from Updating to Running, secret encryption at rest is enabled for the cluster.
If you no longer need this feature, you can turn off the Security and Auditing switch in the Secret Encryption section.
Automatic key rotation
You can use the automatic key rotation feature of KMS to encrypt secrets at rest. When a key is automatically rotated, existing secrets remain encrypted with the previous key version. New secrets are encrypted with the new key version. For more information about automatic key rotation, see Key rotation.
To ensure that existing secrets are also encrypted with the new key version, run the following command to re-encrypt all existing secrets after the key is automatically rotated.
kubectl get secrets --all-namespaces -o json | kubectl annotate --overwrite -f - encryption-key-rotation-time="$(date -u +'%Y-%m-%dT%H:%M:%S%z')"FAQ
Are kubectl-retrieved secrets encrypted?
No. Encryption at rest encrypts the raw secret data in etcd, which is then stored as ciphertext. However, when you use the Secret API through the API server, you receive the plaintext secret data.
How to prevent a RAM user or RAM role from enabling or disabling Secret encryption at rest in an existing ACK Edge cluster
Attach the following RAM policy with a Deny effect to a RAM user or role to prevent them from enabling or disabling encryption at rest for an existing ACK Edge cluster.ACK Edge Pro cluster. See Use RAM to grant permissions to access clusters and cloud resources.
{
"Action": [
"cs:UpdateKMSEncryption"
],
"Effect": "Deny",
"Resource": [
"*"
]
}