Chapter 3. Enabling user-managed encryption for Azure

Procedure

1. Set the following environment variables for the Azure resource group by running the following command:

   $ export RESOURCEGROUP="<resource_group>" \

   1

   
       LOCATION="<location>" 

   2

   Copy to Clipboard Toggle word wrap

   1

   Specifies the name of the Azure resource group where you will create the Disk Encryption Set and encryption key. To avoid losing access to your keys after destroying the cluster, you should create the Disk Encryption Set in a different resource group than the resource group where you install the cluster.

   2

   Specifies the Azure location where you will create the resource group.

2. Set the following environment variables for the Azure Key Vault and Disk Encryption Set by running the following command:

   $ export KEYVAULT_NAME="<keyvault_name>" \

   1

   
       KEYVAULT_KEY_NAME="<keyvault_key_name>" \

   2

   
       DISK_ENCRYPTION_SET_NAME="<disk_encryption_set_name>" 

   3

   Copy to Clipboard Toggle word wrap

   1

   Specifies the name of the Azure Key Vault you will create.

   2

   Specifies the name of the encryption key you will create.

   3

   Specifies the name of the disk encryption set you will create.

3. Set the environment variable for the ID of your Azure Service Principal by running the following command:

   $ export CLUSTER_SP_ID="<service_principal_id>" 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specifies the ID of the service principal you will use for this installation.

4. Enable host-level encryption in Azure by running the following commands:

   $ az feature register --namespace "Microsoft.Compute" --name "EncryptionAtHost"

   Copy to Clipboard Toggle word wrap

   $ az feature show --namespace Microsoft.Compute --name EncryptionAtHost

   Copy to Clipboard Toggle word wrap

   $ az provider register -n Microsoft.Compute

   Copy to Clipboard Toggle word wrap

5. Create an Azure Resource Group to hold the disk encryption set and associated resources by running the following command:

   $ az group create --name $RESOURCEGROUP --location $LOCATION

   Copy to Clipboard Toggle word wrap

6. Create an Azure key vault by running the following command:

   $ az keyvault create -n $KEYVAULT_NAME -g $RESOURCEGROUP -l $LOCATION \
       --enable-purge-protection true

   Copy to Clipboard Toggle word wrap

7. Create an encryption key in the key vault by running the following command:

   $ az keyvault key create --vault-name $KEYVAULT_NAME -n $KEYVAULT_KEY_NAME \
       --protection software

   Copy to Clipboard Toggle word wrap

8. Capture the ID of the key vault by running the following command:

   $ KEYVAULT_ID=$(az keyvault show --name $KEYVAULT_NAME --query "[id]" -o tsv)

   Copy to Clipboard Toggle word wrap

9. Capture the key URL in the key vault by running the following command:

   $ KEYVAULT_KEY_URL=$(az keyvault key show --vault-name $KEYVAULT_NAME --name \
       $KEYVAULT_KEY_NAME --query "[key.kid]" -o tsv)

   Copy to Clipboard Toggle word wrap

10. Create a disk encryption set by running the following command:

    $ az disk-encryption-set create -n $DISK_ENCRYPTION_SET_NAME -l $LOCATION -g \
        $RESOURCEGROUP --source-vault $KEYVAULT_ID --key-url $KEYVAULT_KEY_URL

    Copy to Clipboard Toggle word wrap

11. Grant the DiskEncryptionSet resource access to the key vault by running the following commands:

    $ DES_IDENTITY=$(az disk-encryption-set show -n $DISK_ENCRYPTION_SET_NAME -g \
        $RESOURCEGROUP --query "[identity.principalId]" -o tsv)

    Copy to Clipboard Toggle word wrap

    $ az keyvault set-policy -n $KEYVAULT_NAME -g $RESOURCEGROUP --object-id \
        $DES_IDENTITY --key-permissions wrapkey unwrapkey get

    Copy to Clipboard Toggle word wrap

12. Grant the Azure Service Principal permission to read the DiskEncryptionSet by running the following commands:

    $ DES_RESOURCE_ID=$(az disk-encryption-set show -n $DISK_ENCRYPTION_SET_NAME -g \
        $RESOURCEGROUP --query "[id]" -o tsv)

    Copy to Clipboard Toggle word wrap

    $ az role assignment create --assignee $CLUSTER_SP_ID --role "<reader_role>" \

    1

    
        --scope $DES_RESOURCE_ID -o jsonc

    Copy to Clipboard Toggle word wrap

    1

    Specifies an Azure role with read permissions to the disk encryption set. You can use the Owner role or a custom role with the necessary permissions.