IBM Cloud
TMA-IBMCLOUD-7.1.1
Ensure data in Kubernetes secrets is encrypted using a Key Management Service (KMS) provider
Mô tả
Protect sensitive information in your IBM Cloud Kubernetes Service cluster to ensure data integrity and to prevent your data from being exposed to unauthorized users. Understanding Key Management Service (KMS) providers When you enable a key management service (KMS) provider for your cluster, you bring your own root key. The root key is used to encrypt the data encryption keys (DEKs) which are then used to encrypt the secrets in your cluster. The root key is stored in the KMS provider instance that you control. The encrypted DEKs are stored in etcd and can only be unencrypted using the root key from the KMS provider. Supported KMS providers IBM Cloud Kubernetes Service supports the following KMS providers: - IBM Key Protect for IBM Cloud. - Hyper Protect Crypto Services. Key Protect leverages FIPS 140-2 Level 3 certified cloud-based hardware security modules. Hyper Protect Crypto Serv...
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
1. To check that KMS encryption is enabled, verify that the Key Management Service status is set to enabled in the output of the following command. ibmcloud ks cluster get -c <cluster_name_or_ID> 2. Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster. 3. Verify that you can list the secrets in your cluster kubectl get secrets --all-namespaces 4. In your KMS instance, disable the root key that is used to encrypt your cluster. Note: the CRK can only be disabled from the account where it is located. 5. Wait for the cluster to detect the change to your root key. 6. Try to list your secrets. You will get a timeout error because you can no longer connect to your cluster. If you try to set the context for your cluster by running ibmcloud ks cluster config, the command fails. kubectl get secrets --all-namespaces 7. Check that your cluster is in a warning state. Your cluster remains in this state and is unusable until you enable your root key again. ibmcloud ks cluster get -c <cluster_name_or_ID> 8. In your KMS instance, enable the root key so that your cluster returns to a normal state and becomes usable again.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Using Console: The following remediation steps assume you are not using cross account KMS encryption. 1. Create a KMS instance and root key. 2. Log in to the IBM Cloud console. 3. To view a list of your resources, go to Menu, Containers, Clusters. 4. From the Clusters page, select your cluster. 5. In the Cluster details section, under Cluster encryption click Enable. If you already enabled the KMS provider, click Update. 6. Select the Root key that you want to use for the encryption, by KMS instance or Root key CRN. 7. Click Enable (or Update). 8. Verify that the KMS enablement process is finished. The process is finished when that the Master Status is Ready and Key management service is enabled. 9. After the KMS provider is enabled in the cluster, all cluster secrets are automatically encrypted. Using Command Line: The following remediation steps assume you are not using cross account KMS encryption. 1. Create a KMS instance and root key. 2. Obtain the ID of the KMS instance that you previously created. ibmcloud ks kms instance ls 3. Get the ID of the root key that you previously created. ibmcloud ks kms crk ls --instance-id <KMS_instance_ID> 4. Enable the KMS provider to encry...
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- cloudcryptoencryptionibmcloud
- Tham chiếu
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 7.1.1 Ensure data in Kubernetes secrets is encrypted using a Key Management Service (KMS) provider