Use customer managed KMS keys for OKE envelope encryption of Kubernetes secrets

ÉlevéeNiveau 1Revue manuelleoke

Description

Using customer managed OCI Vault keys for OKE Kubernetes secrets encryption adds a customer managed protection layer for Kubernetes secrets stored through the Kubernetes API. This strengthens data at rest protection while allowing organizations to manage key ownership, rotation, policy, and audit visibility for the key used to protect secret data. The benchmark marks this recommendation Manual.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Review the OKE cluster configuration and verify that Kubernetes secrets are protected with a customer managed OCI Vault key, not only the default Oracle managed encryption for the block volumes used by etcd. For this control, the important check is whether the cluster is associated with a customer managed key for Kubernetes secrets encryption. Also verify that the key is usable by the cluster and has not been disabled, deleted, or stripped of required permissions.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Configure the OKE cluster to use a customer managed OCI Vault key for envelope encryption of Kubernetes secrets so secret data stored through the Kubernetes API is protected with a customer managed master encryption key. This requires an existing master encryption key in OCI Vault, with policy permissions that allow OKE clusters to use the key. OKE does not allow you to enable customer managed Kubernetes secrets encryption on an existing cluster after creation. Oracle documents that this option is selected when creating a new cluster through the Custom Create workflow or with the OCI CLI by specifying the Vault key OCID. • After the new cluster is created, the key must remain enabled and accessible. Disabling, deleting, or breaking access to the associated key can place the cluster in a degraded or unrecoverable state.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: okemanaged-servicessecrets
Référence: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 5.3.1 Use customer managed KMS keys for OKE envelope encryption of Kubernetes secrets