public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-26 13:08:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

correct key lengths

Browse Source 
I'm no cryptographer, but 32 bits for encryption/decryption keys for AES sound dangerously small. Later on in this same document, 32 //bytes// are mentioned. Is that the intended size?
This commit is contained in:
Natorator
2021-11-09 02:20:45 -08:00
committed by GitHub
parent f82bc0cfe0
commit a206a4f603
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rke/latest/en/config-options/secrets-encryption/_index.md
+2 -2
View File
@@ -56,7 +56,7 @@ services:
```
Once enabled, RKE will perform the following [actions](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#encrypting-your-data) to enable at-rest data encryption:
- Generate a new random 32-bit encryption key
- Generate a new random 32-byte encryption key
- Generate an encryption provider configuration file using the new key The default [provider](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers) used is `aescbc`
- Deploy the provider configuration file to all nodes with `controlplane` role
- Update the `kube-apiserver` container arguments to point to the provider configuration file.
@@ -105,7 +105,7 @@ OPTIONS:
```
This command will perform the following actions:
- Generate a new random 32-bit encryption key
- Generate a new random 32-byte encryption key
- Generate a new provider configuration with the new key as the first provider and the second key as the second provider. When the secrets are rewritten, the first key will be used to encrypt the data on the write operation, while the second key (the old key) will be used to decrypt the stored data during the the read operation
- Deploy the new provider configuration to all `controlplane` nodes and restart the `kube-apiserver`
- Rewrite all secrets. This process will re-encrypt all the secrets with the new key.