Skip to content

Commit

Permalink
OCPBUGS-33948: Clairfy encryption ciphers available for use in OpenShift
Browse files Browse the repository at this point in the history
Previously, we were only advertising aescbc, even though the rule checks
for aesgcm, too. This commit updates the instruction so that it is
consistent with what OpenShift supports.
  • Loading branch information
rhmdnd committed Jun 24, 2024
1 parent 644de12 commit bd235d7
Showing 1 changed file with 6 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -68,11 +68,12 @@ platform: not ocp4-on-hypershift-hosted
ocil_clause: '<tt>aescbc</tt> is not configured as the encryption provider'

ocil: |-
OpenShift supports encryption of data at rest of etcd datastore, but it is up to the
customer to configure. The asecbc cipher is used. No other ciphers are supported. Keys
are stored on the filesystem of the master and automatically rotated.
Run the following command to review the Encrypted status condition for the OpenShift
API server to verify that its resources were successfully encrypted:
OpenShift supports encryption of data at rest of etcd datastore, but it is
up to the customer to configure. The asecbc and aesgcm ciphers are
available for use within OpenShift. Keys are stored on the filesystem of
the master and automatically rotated. Run the following command to review
the Encrypted status condition for the OpenShift API server to verify that its
resources were successfully encrypted:
<pre>
# encrypt the etcd datastore
$ oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.status}{"\n"}{.reason}{"\n"}{.message}{"\n"}{end}'
Expand Down

0 comments on commit bd235d7

Please sign in to comment.