Backing up and restoring the Stormshield KMaaS files

In Docker mode, you must configure your orchestrator to guarantee data persistence. Implement a regular file backup strategy, as well as secure file storage on a separate infrastructure.

In RPM mode, Stormshield recommends that you deploy Stormshield KMaaS in a cluster to improve performance and limit the impact if a failure occurs. However, some of the files used by the service and the configuration of the server must be backed up if you have deployed the solution via an RPM.

  • Back up the files below every time changes are made:
Name Description Level Consequences if file is lost
config.json File that describes the configuration of the Stormshield KMaaS server Moderate Configuration must be rebuilt
keks.json File containing all the KEKs Very high Users’ encrypted data cannot be decrypted
HTTPS certificates Files used for the HTTPS connection Moderate Configuration must be rebuilt
KMS certificates Files used for the KMS connection Moderate Configuration must be rebuilt

In Docker mode, the various configuration files are made available to containers via a volume. If one of the containers fails, recreate the Stormshield KMaaS container so that the configuration files are automatically taken into account.

For more information, please refer to your orchestrator documentation.

If any node of the cluster fails, follow the procedure below to restore files on each node:

  1. Disconnect the node from the cluster.
  2. Reconfigure the Red Hat instance if necessary.
  3. Reinstall the service if necessary.
  4. Deploy the backed up files:
  5. Restart the service and check whether it runs.
  6. Reconnect the node(s) of the cluster.