6.2. Enabling etcd encryption

Procedure

1. Modify the APIServer object:

   $ oc edit apiserver

   Copy to Clipboard Toggle word wrap

2. Set the encryption field type to aescbc:

   spec:
     encryption:
       type: aescbc 

   1

   Copy to Clipboard Toggle word wrap

   1

   The aescbc type means that AES-CBC with PKCS#7 padding and a 32 byte key is used to perform the encryption.

3. Save the file to apply the changes.

   The encryption process starts. It can take 20 minutes or longer for this process to complete, depending on the size of your cluster.

4. Verify that etcd encryption was successful.

   1. Review the Encrypted status condition for the OpenShift API server to verify that its resources were successfully encrypted:

      $ oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      Copy to Clipboard Toggle word wrap

      The output shows EncryptionCompleted upon successful encryption:

      EncryptionCompleted
      All resources encrypted: routes.route.openshift.io, oauthaccesstokens.oauth.openshift.io, oauthauthorizetokens.oauth.openshift.io

      Copy to Clipboard Toggle word wrap

      If the output shows EncryptionInProgress, this means that encryption is still in progress. Wait a few minutes and try again.

   2. Review the Encrypted status condition for the Kubernetes API server to verify that its resources were successfully encrypted:

      $ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      Copy to Clipboard Toggle word wrap

      The output shows EncryptionCompleted upon successful encryption:

      EncryptionCompleted
      All resources encrypted: secrets, configmaps

      Copy to Clipboard Toggle word wrap

      If the output shows EncryptionInProgress, this means that encryption is still in progress. Wait a few minutes and try again.