In Tencent Cloud TKE dedicated and managed clusters, Key Management Service (KMS) is used to implement Kubernetes data-at-rest encryption, providing comprehensive key management features and robust encryption/decryption capabilities for Secrets in Kubernetes clusters. This document describes how to encrypt data in Kubernetes clusters using KMS.
Basic Concepts
KMS
KMS (Key Management Service, KMS) is a security management service that uses third-party certified hardware security modules HSM (Hardware Security Module) to generate and protect keys. KMS helps users easily create and manage keys, meeting their key management needs for multiple applications and businesses while complying with regulatory and compliance requirements.
Data Encryption
In Kubernetes, the Secrets object can be used to store various sensitive data used within clusters, such as database usernames, passwords, certificates, OAuth Tokens, SSH KEYs, and so on, thereby effectively decoupling sensitive information from regular configuration files. By default, Secrets are stored in etcd.
In Tencent Cloud TKE standard clusters, including dedicated and managed clusters, you can use keys created in KMS to encrypt Kubernetes Secrets data. The KMS encryption process is based on the KMS Encryption Provider mechanism provided by Kubernetes, which uses envelope encryption to automatically encrypt and decrypt Kubernetes Secrets data stored in etcd. The process of encrypting and decrypting Kubernetes Secrets keys is as follows:
When a business key needs to be stored via the Kubernetes Secrets API, the data is first encrypted by a random data encryption key generated by the API server. Then, the business key is encrypted by a specified KMS key into a ciphertext key and stored in etcd.
When a Kubernetes Secrets key needs to be decrypted, the system first calls the decryption OpenAPI of KMS to decrypt the ciphertext key. Then, it uses the decrypted plaintext key to decrypt the Secrets data and returns the data to the user.
Prerequisites
Before using Tencent Cloud KMS to encrypt Kubernetes Secrets, ensure that you have created TKE dedicated clusters or managed clusters meeting the following conditions:
Kubernetes version is 1.18.0 or later.
The ETCD version is 3.0 or later.
Note:
Kubernetes version. You can go to the TKE console cluster management page, select a cluster, and view its basic information.
To check the ETCD version, connect to the Kubernetes cluster via kubectl.
Usage Limitations and Precautions
Using Tencent Cloud KMS to encrypt Kubernetes Secrets will incur charges. KMS charges for API calls (per 10,000 calls) and the hosting of user-uploaded keys. For detailed information about KMS service billing, see KMS Pricing Overview.
After enabling the data encryption feature, do not disable, delete, or schedule deletion of the keys selected for cluster data encryption/decryption via KMS OpenAPI or the console. Otherwise, the cluster API Server will become unavailable, resulting in failure to obtain objects such as Secrets and ServiceAccounts, affecting normal operation of business applications.
Operation Steps
Enable Data Encryption When Creating a Cluster
1. Log in to the TKE console and click Clusters in the left sidebar.
2. On the cluster management page, click New above the cluster list.
3. Select Standard Cluster and click Create.
4. On the Creating Cluster page, click to expand Advanced Settings, then click
to enable Data Encryption.
5. After enabling Data Encryption, select the region and KMS key.
If you have not yet created a KMS key, please click Create New KMS Key to go to the KMS (Compliant) console to create a key. For specific operations, see Create Key.
6. For details on other configuration items for creating a cluster, see Creating a Cluster via Console. After configuration, click Done.
7. The created cluster will appear in the cluster list. You can click the cluster ID to go to the cluster details page and view the enabled status of the data encryption feature in the cluster's Basic Information.
Enable Data Encryption in Existing Clusters
Note:
If you need to enable the data encryption feature, ensure that the currently logged-in account has CAM permissions and possesses administrator or Ops personnel RBAC permissions in the cluster. For more information, see TKE Kubernetes Object-Level Permission Control.
If you need to authorize the TKE_QCSRole, ensure that you are using a Tencent Cloud account (root account) or a user/role with CAM management permissions. For descriptions of permissions related to service authorization roles, see Description of Permissions for Service Authorization Roles.
1. Log in to the TKE console and click Clusters in the left sidebar.
2. On the Clusters page, select the cluster ID that requires enabling data encryption, and go to the cluster details page.
3. In the cluster's Basic Information, click beside
to enable data encryption.
4. In ETCD Data Encryption, select the region and existing KMS key, and click Submit.
Disable Data Encryption
If you no longer need to use the data encryption feature, you can disable it in the TKE console.
1. Log in to the TKE console and click Clusters in the left sidebar.
2. On the cluster management page, select the cluster ID for which you need to disable data encryption, and go to the cluster details page.
3. In the cluster's Basic Information, click
beside Data Encryption to disable data encryption.
4. In the ETCD data encryption confirmation window, confirm whether to disable, click Submit.
