Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

Chapter 12. Encrypting etcd data

12.1. About etcd encryption
Copiar enlace

By default, etcd data is not encrypted in OpenShift Container Platform. You can enable etcd encryption for your cluster to provide an additional layer of data security. For example, it can help protect the loss of sensitive data if an etcd backup is exposed to the incorrect parties.

When you enable etcd encryption, the following OpenShift API server and Kubernetes API server resources are encrypted:

  • Secrets
  • Config maps
  • Routes
  • OAuth access tokens
  • OAuth authorize tokens

When you enable etcd encryption, encryption keys are created. These keys are rotated on a weekly basis. You must have these keys to restore from an etcd backup.

Note

Etcd encryption only encrypts values, not keys. Resource types, namespaces, and object names are unencrypted.

If etcd encryption is enabled during a backup, the 

static_kuberesources_<datetimestamp>.tar.gz
file contains the encryption keys for the etcd snapshot. For security reasons, store this file separately from the etcd snapshot. However, this file is required to restore a previous state of etcd from the respective etcd snapshot.

12.2. Enabling etcd encryption
Copiar enlace

You can enable etcd encryption to encrypt sensitive resources in your cluster.

Warning

Do not back up etcd resources until the initial encryption process is completed. If the encryption process is not completed, the backup might be only partially encrypted.

After you enable etcd encryption, several changes can occur:

  • The etcd encryption might affect the memory consumption of a few resources.
  • You might notice a transient affect on backup performance because the leader must serve the backup.
  • A disk I/O can affect the node that receives the backup state.

Prerequisites

  • Access to the cluster as a user with the 
    cluster-admin
    role.

Procedure

  1. Modify the 

    APIServer
    object: 

    $ oc edit apiserver

  2. Set the 

    encryption
    field type to 
    aescbc
    : 

    spec:
  encryption:
    type: aescbc
    1
    1
    The aescbc type means that AES-CBC with PKCS#7 padding and a 32 byte key is used to perform the encryption.

  3. Save the file to apply the changes.

    The encryption process starts. It can take 20 minutes or longer for this process to complete, depending on the size of your cluster.

  4. Verify that etcd encryption was successful.

    1. Review the 

      Encrypted
      status condition for the OpenShift API server to verify that its resources were successfully encrypted: 

      $ oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      The output shows 

      EncryptionCompleted
      upon successful encryption: 

      EncryptionCompleted
All resources encrypted: routes.route.openshift.io

      If the output shows 

      EncryptionInProgress
      , encryption is still in progress. Wait a few minutes and try again.

    2. Review the 

      Encrypted
      status condition for the Kubernetes API server to verify that its resources were successfully encrypted: 

      $ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      The output shows 

      EncryptionCompleted
      upon successful encryption: 

      EncryptionCompleted
All resources encrypted: secrets, configmaps

      If the output shows 

      EncryptionInProgress
      , encryption is still in progress. Wait a few minutes and try again.

    3. Review the 

      Encrypted
      status condition for the OpenShift OAuth API server to verify that its resources were successfully encrypted: 

      $ oc get authentication.operator.openshift.io -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      The output shows 

      EncryptionCompleted
      upon successful encryption: 

      EncryptionCompleted
All resources encrypted: oauthaccesstokens.oauth.openshift.io, oauthauthorizetokens.oauth.openshift.io

      If the output shows 

      EncryptionInProgress
      , encryption is still in progress. Wait a few minutes and try again.

12.3. Disabling etcd encryption
Copiar enlace

You can disable encryption of etcd data in your cluster.

Prerequisites

  • Access to the cluster as a user with the 
    cluster-admin
    role.

Procedure

  1. Modify the 

    APIServer
    object: 

    $ oc edit apiserver

  2. Set the 

    encryption
    field type to 
    identity
    : 

    spec:
  encryption:
    type: identity
    1
    1
    The identity type is the default value and means that no encryption is performed.

  3. Save the file to apply the changes.

    The decryption process starts. It can take 20 minutes or longer for this process to complete, depending on the size of your cluster.

  4. Verify that etcd decryption was successful.

    1. Review the 

      Encrypted
      status condition for the OpenShift API server to verify that its resources were successfully decrypted: 

      $ oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      The output shows 

      DecryptionCompleted
      upon successful decryption: 

      DecryptionCompleted
Encryption mode set to identity and everything is decrypted

      If the output shows 

      DecryptionInProgress
      , decryption is still in progress. Wait a few minutes and try again.

    2. Review the 

      Encrypted
      status condition for the Kubernetes API server to verify that its resources were successfully decrypted: 

      $ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      The output shows 

      DecryptionCompleted
      upon successful decryption: 

      DecryptionCompleted
Encryption mode set to identity and everything is decrypted

      If the output shows 

      DecryptionInProgress
      , decryption is still in progress. Wait a few minutes and try again.

    3. Review the 

      Encrypted
      status condition for the OpenShift OAuth API server to verify that its resources were successfully decrypted: 

      $ oc get authentication.operator.openshift.io -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      The output shows 

      DecryptionCompleted
      upon successful decryption: 

      DecryptionCompleted
Encryption mode set to identity and everything is decrypted

      If the output shows 

      DecryptionInProgress
      , decryption is still in progress. Wait a few minutes and try again.

Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2026 Red HatVolver arriba