Use customer managed KMS keys for OKE envelope encryption of Kubernetes secrets

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Review the OKE cluster configuration and verify that Kubernetes secrets are protected with a customer managed OCI Vault key, not only the default Oracle managed encryption for the block volumes used by etcd. For this control, the important check is whether the cluster is associated with a customer managed key for Kubernetes secrets encryption. Also verify that the key is usable by the cluster and has not been disabled, deleted, or stripped of required permissions.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Configure the OKE cluster to use a customer managed OCI Vault key for envelope encryption of Kubernetes secrets so secret data stored through the Kubernetes API is protected with a customer managed master encryption key. This requires an existing master encryption key in OCI Vault, with policy permissions that allow OKE clusters to use the key. OKE does not allow you to enable customer managed Kubernetes secrets encryption on an existing cluster after creation. Oracle documents that this option is selected when creating a new cluster through the Custom Create workflow or with the OCI CLI by specifying the Vault key OCID. • After the new cluster is created, the key must remain enabled and accessible. Disabling, deleting, or breaking access to the associated key can place the cluster in a degraded or unrecoverable state.