Skip to content

Commit 8b88a5b

Browse files
authored
docs: add release cadence to readme (#163)
* docs: add release cadence to readme * remove AKS engine references
1 parent b952953 commit 8b88a5b

File tree

1 file changed

+22
-21
lines changed

1 file changed

+22
-21
lines changed

README.md

+22-21
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,18 @@ Enables encryption at rest of your Kubernetes data in etcd using Azure Key Vault
99

1010
From the Kubernetes documentation on [Encrypting Secret Data at Rest]:
1111

12-
> *[KMS Plugin for Key Vault is]* the recommended choice for using a third party tool for key management. Simplifies key rotation, with a new data encryption key (DEK) generated for each encryption, and key encryption key (KEK) rotation controlled by the user.
12+
> _[KMS Plugin for Key Vault is]_ the recommended choice for using a third party tool for key management. Simplifies key rotation, with a new data encryption key (DEK) generated for each encryption, and key encryption key (KEK) rotation controlled by the user.
1313
1414
⚠️ **NOTE**: Currently, KMS plugin for Key Vault does not support key rotation. If you create a new key version in KMS, decryption will fail since it won't match the key used for encryption when the cluster was created.
1515

1616
💡 **NOTE**: To integrate your application secrets from a key management system outside of Kubernetes, use [Azure Key Vault Provider for Secrets Store CSI Driver].
1717

1818
## Features
1919

20-
* Use a key in Key Vault for etcd encryption
21-
* Use a key in Key Vault protected by a Hardware Security Module (HSM)
22-
* Bring your own keys
23-
* Store secrets, keys, and certs in etcd, but manage them as part of Kubernetes
20+
- Use a key in Key Vault for etcd encryption
21+
- Use a key in Key Vault protected by a Hardware Security Module (HSM)
22+
- Bring your own keys
23+
- Store secrets, keys, and certs in etcd, but manage them as part of Kubernetes
2424

2525
## Getting Started
2626

@@ -46,25 +46,25 @@ Now that Azure KMS provider is running in your cluster and the encryption config
4646

4747
1. Create a new secret:
4848

49-
```bash
50-
kubectl create secret generic secret1 -n default --from-literal=mykey=mydata
51-
```
49+
```bash
50+
kubectl create secret generic secret1 -n default --from-literal=mykey=mydata
51+
```
5252

5353
2. Using `etcdctl`, read the secret from etcd:
5454

55-
```bash
56-
sudo ETCDCTL_API=3 etcdctl --cacert=/etc/kubernetes/certs/ca.crt --cert=/etc/kubernetes/certs/etcdclient.crt --key=/etc/kubernetes/certs/etcdclient.key get /registry/secrets/default/secret1
57-
```
55+
```bash
56+
sudo ETCDCTL_API=3 etcdctl --cacert=/etc/kubernetes/certs/ca.crt --cert=/etc/kubernetes/certs/etcdclient.crt --key=/etc/kubernetes/certs/etcdclient.key get /registry/secrets/default/secret1
57+
```
5858

5959
3. Check that the stored secret is prefixed with `k8s:enc:kms:v1:azurekmsprovider`. This indicates the Azure KMS provider has encrypted the data.
6060

6161
4. Verify the secret is decrypted correctly when retrieved via the Kubernetes API:
6262

63-
```bash
64-
kubectl get secrets secret1 -o yaml
65-
```
63+
```bash
64+
kubectl get secrets secret1 -o yaml
65+
```
6666

67-
The output should match `mykey: bXlkYXRh`, which is the encoded data of `mydata`.
67+
The output should match `mykey: bXlkYXRh`, which is the encoded data of `mydata`.
6868

6969
## Rotation
7070

@@ -74,6 +74,10 @@ Refer to [doc](docs/rotation.md) for steps to rotate the KMS Key on an existing
7474

7575
The KMS Plugin for Key Vault project welcomes contributions and suggestions. Please see [CONTRIBUTING](CONTRIBUTING.md) for details.
7676

77+
## Release
78+
79+
Currently, this project releases monthly to patch security vulnerabilities, and bi-monthly for new features. We target the **first week** of the month for release.
80+
7781
## Code of conduct
7882

7983
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
@@ -82,9 +86,6 @@ This project has adopted the [Microsoft Open Source Code of Conduct](https://ope
8286

8387
KMS Plugin for Key Vault is an open source project that is [**not** covered by the Microsoft Azure support policy](https://support.microsoft.com/en-us/help/2941892/support-for-linux-and-open-source-technology-in-azure). [Please search open issues here](https://github.com/Azure/kubernetes-kms/issues), and if your issue isn't already represented please [open a new one](https://github.com/Azure/kubernetes-kms/issues/new/choose). The project maintainers will respond to the best of their abilities.
8488

85-
[AKS]: https://azure.microsoft.com/services/kubernetes-service/
86-
[AKS Engine]: https://github.com/Azure/aks-engine
87-
[Azure Key Vault Data Encryption]: https://github.com/Azure/aks-engine/blob/master/docs/topics/features.md#azure-key-vault-data-encryption
88-
[Encrypting Secret Data at Rest]: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers
89-
[example cluster configuration]: https://github.com/Azure/aks-engine/blob/master/examples/kubernetes-config/kubernetes-keyvault-encryption.json
90-
[Azure Key Vault Provider for Secrets Store CSI Driver]: https://github.com/Azure/secrets-store-csi-driver-provider-azure
89+
[aks]: https://azure.microsoft.com/services/kubernetes-service/
90+
[encrypting secret data at rest]: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers
91+
[azure key vault provider for secrets store csi driver]: https://github.com/Azure/secrets-store-csi-driver-provider-azure

0 commit comments

Comments
 (0)