Encrypting etcd with KMS v2

Mon, 01 Jan 0001 00:00:00 +0000

This guide moves the encryption key of the management cluster etcd out of the cluster. kube-apiserver encrypts each object with a data encryption key (DEK), and the DEK is encrypted by a key encryption key (KEK) that stays in HashiCorp Vault Transit. vault-kubernetes-kms is the KMS v2 plugin that connects kube-apiserver to Vault.

After you finish, an etcd snapshot or a stolen disk no longer exposes Secrets or application values: decrypting them requires a call to Vault from one of the control-plane nodes. See Encryption at Rest for what is stored where.

Encrypting Keycloak User Data

Mon, 01 Jan 0001 00:00:00 +0000

The platform Keycloak keeps its users in PostgreSQL in plain text: anyone with access to the database, a dump or a backup can read every username, email and name. keycloak-kms-proxy sits between Keycloak and PostgreSQL and encrypts these columns on the way in and decrypts them on the way out, so the database holds only ciphertext.

The proxy encrypts the columns with data encryption keys (DEKs). The DEKs are stored wrapped by a key in HashiCorp Vault Transit and are unwrapped in memory when the proxy starts.

Encryption at Rest on Cozystack

Encrypting etcd with KMS v2

Encrypting Keycloak User Data