Repository navigation
docs(operations): add encryption at rest guides for etcd and Keycloak - #742
Andrei Kvapil (kvaps) wants to merge 3 commits into
Conversation
Add an Encryption at Rest section that explains what Cozystack stores where and how it is protected by default, and a guide to encrypt the management cluster etcd with KMS v2 and HashiCorp Vault Transit on Talos v1.14. The guide also encrypts Flux HelmReleases, which carry application values, explains what applies to aggregated API servers, and shows the local-key option for tenant Kubernetes clusters, where KMS is not supported yet. Assisted-by: LLM Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Describe how to enable keycloak-kms-proxy on the platform Keycloak with HashiCorp Vault Transit: Vault setup, creating the shared DEK set, encrypting existing rows in a maintenance window, enabling the proxy through the cozystack.keycloak package, verification and limits. The guide makes deksetSecretName mandatory: without it the proxy mints a new key on every start and cannot read data written before a restart. Assisted-by: LLM Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The keycloak chart now refuses to enable encryption without encryption.deksetSecretName, so describe that instead of a default to avoid. Assisted-by: LLM Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
Andrei Kvapil (@kvaps) NOT LGTM. The pages themselves hold up against the code I checked; the Keycloak page has to wait for cozystack/cozystack#4818, which I just sent back with changes requested.
The Keycloak page says "The chart refuses to enable encryption without it". On cozystack main 52f542c4 that is false: deksetSecretName is optional there and the proxy falls back to an in-memory DEK. Since next/ is published from main, merging this first would document a guard that does not exist. #4818 may also still change in ways this page should mention, for example how the static KEK Secret survives disabling encryption. So please re-check the page against what #4818 merges with.
The PR description starts with "Do not merge until cozystack/cozystack#4818 is merged." This repo uses the description as the merge commit message, so that line would stay in main's history. Please drop it before merging.
What I checked on the Keycloak page and found correct: every encryption.* key and its default against packages/system/keycloak/values.yaml, the backfill flags (generate-dekset, encrypt-rows, -vault-mount, -dsn) against keycloak-kms-proxy v0.2.3, the encrypted columns against internal/config/fields.go, and the metrics port and kkp_decrypt_failures_total. The Vault policy is enough too, because the proxy only calls encrypt/ and decrypt/ on the key. The suspend step is safe as well: the Package reconciler keeps the HelmRelease's spec.suspend as it finds it. For the tenant part, --encryption-provider-config is not one of the flags the kubernetes chart drops or refuses, and secret volumes are allowed in extraVolumes.
One non-blocking note: the prerequisites say "Talos v1.14.1 runs etcd v3.7.1", but next already pins Talos v1.14.2, so the etcd version in that sentence should follow the pinned Talos.
This branch has not been deployed
2 participants
Do not merge until cozystack/cozystack#4818 is merged. The Keycloak page describes the chart behaviour from that PR: encryption is refused without a DEK set, and the static KEK is generated in a form the proxy accepts.
New section under Operations: Encryption at Rest. It goes to
next/only, because the etcd part needs Talos v1.14, which ships with the upcoming release.Three pages:
vault-kubernetes-kmsrunning as a Talos static pod. It also encrypts Flux HelmReleases, because application values (passwords included) live inspec.values. Short notes for aggregated API servers (the Cozystack API has no storage of its own, so it is already covered) and for tenant clusters, where KMS is not possible yet and the page shows the local-key option through the existingcontrolPlane.apiServervalues.The Keycloak page makes
deksetSecretNamemandatory. With the current chart default (empty) the proxy mints a new DEK on every start and keeps it only in memory, so after a proxy restart it cannot decrypt anything it wrote before (cmd/proxy/main.go,buildCipher). The fix is cozystack/cozystack#4818, which also makes the default static backend start at all.How this was checked:
kubernetesandkeycloakcharts on main.helm templateon main.Not run end to end on a clean cluster: the Talm node-file flow with
$patch: deleteforsecretboxEncryptionSecret, and the local-key option for tenant clusters.