From a206a4f60365f15b9a3dec25f53ad8c47436cd4c Mon Sep 17 00:00:00 2001 From: Natorator Date: Tue, 9 Nov 2021 02:20:45 -0800 Subject: [PATCH 1/2] correct key lengths I'm no cryptographer, but 32 bits for encryption/decryption keys for AES sound dangerously small. Later on in this same document, 32 //bytes// are mentioned. Is that the intended size? --- .../rke/latest/en/config-options/secrets-encryption/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rke/latest/en/config-options/secrets-encryption/_index.md b/content/rke/latest/en/config-options/secrets-encryption/_index.md index 5801592df0a..f2a17364746 100644 --- a/content/rke/latest/en/config-options/secrets-encryption/_index.md +++ b/content/rke/latest/en/config-options/secrets-encryption/_index.md @@ -56,7 +56,7 @@ services: ``` Once enabled, RKE will perform the following [actions](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#encrypting-your-data) to enable at-rest data encryption: -- Generate a new random 32-bit encryption key +- Generate a new random 32-byte encryption key - Generate an encryption provider configuration file using the new key The default [provider](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers) used is `aescbc` - Deploy the provider configuration file to all nodes with `controlplane` role - Update the `kube-apiserver` container arguments to point to the provider configuration file. @@ -105,7 +105,7 @@ OPTIONS: ``` This command will perform the following actions: -- Generate a new random 32-bit encryption key +- Generate a new random 32-byte encryption key - Generate a new provider configuration with the new key as the first provider and the second key as the second provider. When the secrets are rewritten, the first key will be used to encrypt the data on the write operation, while the second key (the old key) will be used to decrypt the stored data during the the read operation - Deploy the new provider configuration to all `controlplane` nodes and restart the `kube-apiserver` - Rewrite all secrets. This process will re-encrypt all the secrets with the new key. From 041e911b181c96077df83638f176dc6e26e15c52 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 9 Nov 2021 11:40:46 -0500 Subject: [PATCH 2/2] Added hyphen to update changes --- .../rke/latest/en/config-options/secrets-encryption/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/secrets-encryption/_index.md b/content/rke/latest/en/config-options/secrets-encryption/_index.md index f2a17364746..81e24ff9bf9 100644 --- a/content/rke/latest/en/config-options/secrets-encryption/_index.md +++ b/content/rke/latest/en/config-options/secrets-encryption/_index.md @@ -126,7 +126,7 @@ With custom encryption configuration, RKE allows the user to provide their own c The following describes the steps required to configure custom encryption with a user provided 32-byte random key. -Step 1: Generate a 32 byte random key and base64 encode it. If you're on Linux or macOS, run the following command: +Step 1: Generate a 32-byte random key and base64 encode it. If you're on Linux or macOS, run the following command: ``` head -c 32 /dev/urandom | base64