4.12.3. Enabling etcd encryption

You can enable etcd encryption to encrypt sensitive resources in your cluster.

주의

Do not back up etcd resources until the initial encryption process is completed. If the encryption process is not completed, the backup might be only partially encrypted.

After you enable etcd encryption, several changes can occur:

The etcd encryption might affect the memory consumption of a few resources.
You might notice a transient affect on backup performance because the leader must serve the backup.
A disk I/O can affect the node that receives the backup state.

You can encrypt the etcd database in either AES-GCM or AES-CBC encryption.

참고

To migrate your etcd database from one encryption type to the other, you can modify the API server’s spec.encryption.type field. Migration of the etcd data to the new encryption type occurs automatically.

Prerequisites

Access to the cluster as a user with the cluster-admin role.

Procedure

Modify the APIServer object:
```
$ oc edit apiserver
```
Set the spec.encryption.type field to aesgcm or aescbc:
```
spec:
  encryption:
    type: aesgcm 
```
1
1 1
Set to aesgcm for AES-GCM encryption or aescbc for AES-CBC encryption.
Save the file to apply the changes.
The encryption process starts. It can take 20 minutes or longer for this process to complete, depending on the size of the etcd database.
Verify that etcd encryption was successful.
1. Review the Encrypted status condition for the OpenShift API server to verify that its resources were successfully encrypted:
  $ oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'
  The output shows EncryptionCompleted upon successful encryption:
  EncryptionCompleted All resources encrypted: routes.route.openshift.io
  If the output shows EncryptionInProgress, encryption is still in progress. Wait a few minutes and try again.
2. Review the Encrypted status condition for the Kubernetes API server to verify that its resources were successfully encrypted:
  $ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'
  The output shows EncryptionCompleted upon successful encryption:
  EncryptionCompleted All resources encrypted: secrets, configmaps
  If the output shows EncryptionInProgress, encryption is still in progress. Wait a few minutes and try again.
3. Review the Encrypted status condition for the OpenShift OAuth API server to verify that its resources were successfully encrypted:
  $ oc get authentication.operator.openshift.io -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'
  The output shows EncryptionCompleted upon successful encryption:
  EncryptionCompleted All resources encrypted: oauthaccesstokens.oauth.openshift.io, oauthauthorizetokens.oauth.openshift.io
  If the output shows EncryptionInProgress, encryption is still in progress. Wait a few minutes and try again.

4.12.3. Enabling etcd encryption

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 소개

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 문서 정보

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links