From 8ae495ed9075bc21666f36227c1136ff25957711 Mon Sep 17 00:00:00 2001 From: Ross Kirkpatrick Date: Fri, 26 Mar 2021 10:33:45 -0400 Subject: [PATCH] add instructions for custom encryption with user generated key --- .../secrets-encryption/_index.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/content/rke/latest/en/config-options/secrets-encryption/_index.md b/content/rke/latest/en/config-options/secrets-encryption/_index.md index c4dc378a249..5801592df0a 100644 --- a/content/rke/latest/en/config-options/secrets-encryption/_index.md +++ b/content/rke/latest/en/config-options/secrets-encryption/_index.md @@ -122,6 +122,37 @@ With custom encryption configuration, RKE allows the user to provide their own c >**Warning:** Using invalid Encryption Provider Configuration could cause several issues with your cluster, ranging from crashing the Kubernetes API service, `kube-api`, to completely losing access to encrypted data. +### Example: Using Custom Encryption Configuration with User Provided 32-byte Random Key + +The following describes the steps required to configure custom encryption with a user provided 32-byte random key. + +Step 1: Generate a 32 byte random key and base64 encode it. If you're on Linux or macOS, run the following command: + +``` +head -c 32 /dev/urandom | base64 +``` + +Place that value in the secret field. + +```yaml +kube-api: + secrets_encryption_config: + enabled: true + custom_config: + api_version: apiserver.config.k8s.io/v1 + kind: EncryptionConfiguration + resources: + - Providers: + - AESCBC: + Keys: + - Name: key1 + Secret: + Resources: + - secrets + - identity: {} +``` + + ### Example: Using Custom Encryption Configuration with Amazon KMS An example for custom configuration would be enabling an external key management system like [Amazon KMS](https://aws.amazon.com/kms/). The following is an example of the configuration for AWS KMS: