You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: README.md
+22-21
Original file line number
Diff line number
Diff line change
@@ -9,18 +9,18 @@ Enables encryption at rest of your Kubernetes data in etcd using Azure Key Vault
9
9
10
10
From the Kubernetes documentation on [Encrypting Secret Data at Rest]:
11
11
12
-
> *[KMS Plugin for Key Vault is]* the recommended choice for using a third party tool for key management. Simplifies key rotation, with a new data encryption key (DEK) generated for each encryption, and key encryption key (KEK) rotation controlled by the user.
12
+
> _[KMS Plugin for Key Vault is]_ the recommended choice for using a third party tool for key management. Simplifies key rotation, with a new data encryption key (DEK) generated for each encryption, and key encryption key (KEK) rotation controlled by the user.
13
13
14
14
⚠️ **NOTE**: Currently, KMS plugin for Key Vault does not support key rotation. If you create a new key version in KMS, decryption will fail since it won't match the key used for encryption when the cluster was created.
15
15
16
16
💡 **NOTE**: To integrate your application secrets from a key management system outside of Kubernetes, use [Azure Key Vault Provider for Secrets Store CSI Driver].
17
17
18
18
## Features
19
19
20
-
* Use a key in Key Vault for etcd encryption
21
-
* Use a key in Key Vault protected by a Hardware Security Module (HSM)
22
-
* Bring your own keys
23
-
* Store secrets, keys, and certs in etcd, but manage them as part of Kubernetes
20
+
- Use a key in Key Vault for etcd encryption
21
+
- Use a key in Key Vault protected by a Hardware Security Module (HSM)
22
+
- Bring your own keys
23
+
- Store secrets, keys, and certs in etcd, but manage them as part of Kubernetes
24
24
25
25
## Getting Started
26
26
@@ -46,25 +46,25 @@ Now that Azure KMS provider is running in your cluster and the encryption config
sudo ETCDCTL_API=3 etcdctl --cacert=/etc/kubernetes/certs/ca.crt --cert=/etc/kubernetes/certs/etcdclient.crt --key=/etc/kubernetes/certs/etcdclient.key get /registry/secrets/default/secret1
57
-
```
55
+
```bash
56
+
sudo ETCDCTL_API=3 etcdctl --cacert=/etc/kubernetes/certs/ca.crt --cert=/etc/kubernetes/certs/etcdclient.crt --key=/etc/kubernetes/certs/etcdclient.key get /registry/secrets/default/secret1
57
+
```
58
58
59
59
3. Check that the stored secret is prefixed with `k8s:enc:kms:v1:azurekmsprovider`. This indicates the Azure KMS provider has encrypted the data.
60
60
61
61
4. Verify the secret is decrypted correctly when retrieved via the Kubernetes API:
62
62
63
-
```bash
64
-
kubectl get secrets secret1 -o yaml
65
-
```
63
+
```bash
64
+
kubectl get secrets secret1 -o yaml
65
+
```
66
66
67
-
The output should match `mykey: bXlkYXRh`, which is the encoded data of `mydata`.
67
+
The output should match `mykey: bXlkYXRh`, which is the encoded data of `mydata`.
68
68
69
69
## Rotation
70
70
@@ -74,6 +74,10 @@ Refer to [doc](docs/rotation.md) for steps to rotate the KMS Key on an existing
74
74
75
75
The KMS Plugin for Key Vault project welcomes contributions and suggestions. Please see [CONTRIBUTING](CONTRIBUTING.md) for details.
76
76
77
+
## Release
78
+
79
+
Currently, this project releases monthly to patch security vulnerabilities, and bi-monthly for new features. We target the **first week** of the month for release.
80
+
77
81
## Code of conduct
78
82
79
83
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
@@ -82,9 +86,6 @@ This project has adopted the [Microsoft Open Source Code of Conduct](https://ope
82
86
83
87
KMS Plugin for Key Vault is an open source project that is [**not** covered by the Microsoft Azure support policy](https://support.microsoft.com/en-us/help/2941892/support-for-linux-and-open-source-technology-in-azure). [Please search open issues here](https://github.com/Azure/kubernetes-kms/issues), and if your issue isn't already represented please [open a new one](https://github.com/Azure/kubernetes-kms/issues/new/choose). The project maintainers will respond to the best of their abilities.
0 commit comments