Skip to content

Commit f635cee

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #40899 from sftim/20230429_revise_encryption_table
Revise table for API encryption at rest task
2 parents cd4cad9 + fac97a1 commit f635cee

File tree

2 files changed

+125
-10
lines changed

2 files changed

+125
-10
lines changed

‎assets/scss/_custom.scss

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,30 @@ body {
4545
}
4646
}
4747

48+
/* Complex table layout support */
49+
50+
.td-content, body.td-content {
51+
table.complex-layout {
52+
tbody tr,
53+
tbody tr:nth-of-type(2n+1) {
54+
/* Avoid stripes */
55+
background-color: initial;
56+
}
57+
tbody tr:not(:last-child) > td[colspan] {
58+
/* provide a visual break between rows */
59+
padding-bottom: 1.5em;
60+
}
61+
tbody > tr > th[scope="row"]:first-child {
62+
min-width: 9em;
63+
}
64+
tbody > tr > th[rowspan] {
65+
vertical-align: middle;
66+
}
67+
border-collapse: separate;
68+
border-spacing: 0 0;
69+
max-width: calc(max(min(100vw, 110%), 40vw));
70+
}
71+
}
4872

4973
/* Emphasize first paragraph of running text on site front page */
5074
body.td-home main[role="main"] > section:first-of-type .content p:first-child {

‎content/en/docs/tasks/administer-cluster/encrypt-data.md

Lines changed: 101 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -138,16 +138,107 @@ read that resource will fail until it is deleted or a valid decryption key is pr
138138

139139
### Providers
140140

141-
{{< table caption="Providers for Kubernetes encryption at rest" >}}
142-
Name | Encryption | Strength | Speed | Key Length | Other Considerations
143-
-----|------------|----------|-------|------------|---------------------
144-
`identity` | None | N/A | N/A | N/A | Resources written as-is without encryption. When set as the first provider, the resource will be decrypted as new values are written.
145-
`secretbox` | XSalsa20 and Poly1305 | Strong | Faster | 32-byte | A newer standard and may not be considered acceptable in environments that require high levels of review.
146-
`aesgcm` | AES-GCM with random nonce | Must be rotated every 200k writes | Fastest | 16, 24, or 32-byte | Is not recommended for use except when an automated key rotation scheme is implemented.
147-
`aescbc` | AES-CBC with [PKCS#7](https://datatracker.ietf.org/doc/html/rfc2315) padding | Weak | Fast | 32-byte | Not recommended due to CBC's vulnerability to padding oracle attacks.
148-
`kms v1` | Uses envelope encryption scheme: Data is encrypted by data encryption keys (DEKs) using AES-CBC with [PKCS#7](https://datatracker.ietf.org/doc/html/rfc2315) padding (prior to v1.25), using AES-GCM starting from v1.25, DEKs are encrypted by key encryption keys (KEKs) according to configuration in Key Management Service (KMS) | Strongest | Slow (_compared to `kms v2`_) | 32-bytes | Simplifies key rotation, with a new DEK generated for each encryption, and KEK rotation controlled by the user. [Configure the KMS V1 provider](/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v1).
149-
`kms v2` | Uses envelope encryption scheme: Data is encrypted by data encryption keys (DEKs) using AES-GCM, DEKs are encrypted by key encryption keys (KEKs) according to configuration in Key Management Service (KMS) | Strongest | Fast | 32-bytes | The recommended choice for using a third party tool for key management. Available in beta from `v1.27`. A new DEK is generated at startup and reused for encryption. The DEK is rotated when the KEK is rotated. [Configure the KMS V2 provider](/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v2).
150-
{{< /table >}}
141+
The following table describes each available provider:
142+
143+
<!-- localization note: if it makes sense to adapt this table to work for your localization,
144+
please do that. Each sentence in the English original should have a direct equivalent in the adapted
145+
layout, although this may not always be possible -->
146+
<table class="complex-layout">
147+
<caption style="display: none;">Providers for Kubernetes encryption at rest</caption>
148+
<thead>
149+
<tr>
150+
<th>Name</th>
151+
<th>Encryption</th>
152+
<th>Strength</th>
153+
<th>Speed</th>
154+
<th>Key length</th>
155+
</tr>
156+
</thead>
157+
<tbody id="encryption-providers-identity">
158+
<!-- list identity first, even when the remaining rows are sorted alphabetically -->
159+
<tr>
160+
<th rowspan="2" scope="row"><tt>identity</tt></th>
161+
<td><strong>None</strong></td>
162+
<td>N/A</td>
163+
<td>N/A</td>
164+
<td>N/A</td>
165+
</tr>
166+
<tr>
167+
<td colspan="4">Resources written as-is without encryption. When set as the first provider, the resource will be decrypted as new values are written. Existing encrypted resources are <strong>not</strong> automatically overwritten with the plaintext data.
168+
The <tt>identity</tt> provider is the default if you do not specify otherwise.</td>
169+
</tr>
170+
</tbody>
171+
<tbody id="encryption-providers-that-encrypt">
172+
<tr>
173+
<th rowspan="2" scope="row"><tt>aescbc</tt></th>
174+
<td>AES-CBC with <a href="https://datatracker.ietf.org/doc/html/rfc2315">PKCS#7</a> padding</td>
175+
<td>Weak</td>
176+
<td>Fast</td>
177+
<td>32-byte</td>
178+
</tr>
179+
<tr>
180+
<td colspan="4">Not recommended due to CBC's vulnerability to padding oracle attacks. Key material accessible from control plane host.</td>
181+
</tr>
182+
<tr>
183+
<th rowspan="2" scope="row"><tt>aesgcm</tt></th>
184+
<td>AES-GCM with random nonce</td>
185+
<td>Must be rotated every 200,000 writes</td>
186+
<td>Fastest</td>
187+
<td>16, 24, or 32-byte</td>
188+
</tr>
189+
<tr>
190+
<td colspan="4">Not recommended for use except when an automated key rotation scheme is implemented. Key material accessible from control plane host.</td>
191+
</tr>
192+
<tr>
193+
<th rowspan="2" scope="row"><tt>kms</tt> v1</th>
194+
<td>Uses envelope encryption scheme with DEK per resource.</td>
195+
<td>Strongest</td>
196+
<td>Slow (<em>compared to <tt>kms</tt> version 2</em>)</td>
197+
<td>32-bytes</td>
198+
</tr>
199+
<tr>
200+
<td colspan="4">
201+
Data is encrypted by data encryption keys (DEKs) using AES-GCM;
202+
DEKs are encrypted by key encryption keys (KEKs) according to
203+
configuration in Key Management Service (KMS).
204+
Simple key rotation, with a new DEK generated for each encryption, and
205+
KEK rotation controlled by the user.
206+
<br />
207+
Read how to <a href="/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v1">configure the KMS V1 provider</a>.
208+
</td>
209+
</tr>
210+
<tr>
211+
<th rowspan="2" scope="row"><tt>kms</tt> v2 <em>(beta)</em></th>
212+
<td>Uses envelope encryption scheme with DEK per API server.</td>
213+
<td>Strongest</td>
214+
<td>Fast</td>
215+
<td>32-bytes</td>
216+
</tr>
217+
<tr>
218+
<td colspan="4">
219+
Data is encrypted by data encryption keys (DEKs) using AES-GCM; DEKs
220+
are encrypted by key encryption keys (KEKs) according to configuration
221+
in Key Management Service (KMS).
222+
A new DEK is generated at API server startup, and is then reused for
223+
encryption. The DEK is rotated whenever the KEK is rotated.
224+
A good choice if using a third party tool for key management.
225+
Available in beta from Kubernetes v1.27.
226+
<br />
227+
Read how to <a href="/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v2">configure the KMS V2 provider</a>.
228+
</td>
229+
</tr>
230+
<tr>
231+
<th rowspan="2" scope="row"><tt>secretbox</tt></th>
232+
<td>XSalsa20 and Poly1305</td>
233+
<td>Strong</td>
234+
<td>Faster</td>
235+
<td>32-byte</td>
236+
</tr>
237+
<tr>
238+
<td colspan="4">Uses relatively new encryption technologies that may not be considered acceptable in environments that require high levels of review. Key material accessible from control plane host.</td>
239+
</tr>
240+
</tbody>
241+
</table>
151242

152243
Each provider supports multiple keys - the keys are tried in order for decryption, and if the provider
153244
is the first provider, the first key is used for encryption.

0 commit comments

Comments
 (0)