Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCPBUGS-33948: Clairfy encryption ciphers available for use in OpenShift #12089

Merged
merged 1 commit into from
Jun 26, 2024
+12 −10
Merged

OCPBUGS-33948: Clairfy encryption ciphers available for use in OpenShift #12089

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 12 additions & 10 deletions applications/openshift/api-server/api_server_encryption_provider_cipher/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,9 @@ description: |-
to restore from an etcd backup.
</p>
<p>
To ensure the correct cipher, set the encryption type <tt>aescbc</tt> in the
<tt>apiserver</tt> object which configures the API server itself.
To ensure the correct cipher, set the encryption type to <tt>aescbc</tt> or
<tt>aesgcm</tt> in the <tt>apiserver</tt> object which configures the API
server itself.
<pre>
spec:
encryption:
Expand All @@ -49,7 +50,7 @@ rationale: |-
sensitive in nature and should be encrypted at rest to avoid any
disclosures. Where etcd encryption is used, it is important to ensure that the
appropriate set of encryption providers is used. Currently, <tt>aescbc</tt>
is the only type supported by OCP.
and <tt>aesgcm</tt> are the only types supported by OCP.

identifiers:
cce@ocp4: CCE-83585-0
Expand All @@ -65,14 +66,15 @@ references:

platform: not ocp4-on-hypershift-hosted

ocil_clause: '<tt>aescbc</tt> is not configured as the encryption provider'
ocil_clause: '<tt>aescbc</tt> or <tt>aesgcm</tt> is not configured as the encryption provider'

ocil: |-
OpenShift supports encryption of data at rest of etcd datastore, but it is up to the
customer to configure. The asecbc cipher is used. No other ciphers are supported. Keys
are stored on the filesystem of the master and automatically rotated.
Run the following command to review the Encrypted status condition for the OpenShift
API server to verify that its resources were successfully encrypted:
OpenShift supports encryption of data at rest of etcd datastore, but it is
up to the customer to configure. The asecbc and aesgcm ciphers are
available for use within OpenShift. Keys are stored on the filesystem of
the master and automatically rotated. Run the following command to review
the Encrypted status condition for the OpenShift API server to verify that its
resources were successfully encrypted:
<pre>
# encrypt the etcd datastore
$ oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.status}{"\n"}{.reason}{"\n"}{.message}{"\n"}{end}'
Expand All @@ -82,7 +84,7 @@ ocil: |-
progress. Wait a few minutes and try again.
To display the encryption configured, run the following command:
<pre>$ oc get --raw {{.var_apiserver_encryption_path}} | jq {{.var_apiserver_encryption_filter}} </pre>
If the output does not list <tt>aescbc</tt>, the encryption is not configured correctly.
If the output does not list <tt>aescbc</tt> or <tt>aesgcm</tt>, the encryption is not configured correctly.

warnings:
- general: |-
Expand Down
Loading