Deploying SDS for Kubernetes KMS Plugin

The SDS for Kubernetes KMS Plugin is provided as a compressed archive containing:

  • The Node.js server for SDS for Kubernetes KMS Plugin: stormshield-kubernetes-kms-plugin.cjs,

  • The sbom.json file containing a list of all the dependencies and libraries used by stormshield-kubernetes-kms-plugin.cjs,

  • The gRPC service definition file: api.proto, which contains the API configuration that SDS for Kubernetes KMS Plugin must use to communicate with the Kubernetes control plane,

  • The LICENSE file containing the SDS for Kubernetes KMS Plugin terms and conditions.

You must deploy SDS for Kubernetes KMS Plugin on each host where a Kubernetes control plane is installed.

Stormshield recommends running the server SDS for Kubernetes KMS Plugin as a systemd service.

  1. Create a new file /etc/systemd/system/sds-kms-plugin.service from the following sample:

    [Unit]
    Description=Stormshield Data Security for Kubernetes KMS Plugin

    [Service]
    ExecStart=node <PATH_TO_SCRIPT>/stormshield-kubernetes-kms-plugin.cjs
    Restart=always
    StandardOutput=journal
    StandardError=journal
    SyslogIdentifier=sds-kms-plugin

    Environment="KMAAS_URL=<KMAAS_URL>"
    Environment="KMAAS_TENANT_ID=<KMAAS_TENANT_ID>"
    Environment="KMAAS_API_KEY=<KMAAS_API_KEY>"
    Environment="PROTO_FILE_PATH=<PROTO_FILE_PATH>"
    # Environment="BIND_STRING=<BIND_STRING>"
    # Environment="KEY_ID=<KEY_ID>"
    # Environment="GRPC_VERBOSITY=DEBUG"

    [Install]
    WantedBy=multi-user.target

    The file must have permission 600 to ensure that the API key is secure.

  2. Indicate the path to the stormshield-kubernetes-kms-plugin.cjs script by replacing the <PATH_TO_SCRIPT> string.
  3. Set the following environment variables by replacing the strings between tags:
    Environment variableDescriptionMandatory/Optional
    KMAAS_URLURL of the KMaaS.Mandatory
    KMAAS_TENANT_IDID of the tenant declared in the tenant_id parameter of the KMaaS config.json file.Mandatory
    KMAAS_API_KEY

    Base64 string of the concatenated values _KAS_AUTHENTICATION_API_KEY_NAME:_KAS_AUTHENTICATION_API_KEY_VALUE of the KMaaS config.json file.

    On Unix-like systems, generate the KMaaS API key with this command:

    $ echo -n "<API_KEY_NAME>:<API_KEY_PASSWORD>" | base64

    NOTE
    Stormshield recommends that you use one different API key per control plane.

    		Mandatory
    PROTO_FILE_PATH

    Local path to the api.proto file provided by SDS for Kubernetes KMS Plugin.

    Example: "/mnt/shared/api.proto"

    		Mandatory
    BIND_STRING

    Path to the Unix socket used to communicate with Kubernetes. If a socket already exists, it will be deleted and then recreated.

    Default value: "unix:///tmp/sds-kms-plugin.sock"

    		Optional
    KEY_ID

    Identifier used for key rotation. The KEY_ID value must be less than 1 KB and must contain only alphanumeric characters.

    Default value: "stormshield-kms-plugin-key-id"

    For more information, see Configuring seed rotation.

    		Optional
    GRPC_VERBOSITY

    Enables gRPC server debug logs.

    Default value: "NONE"

    For more information, see Setting gRPC dependencies logging verbosity.

    		Optional

A new seed is generated by Kubernetes each time the cluster starts. If you want to rotate the seed more frequently, modify the value of the KEY_ID environment variable. The value of this variable is an alphanumeric string. If Kubernetes detects a change in this value, then it generates a new seed. For more information and best practices, see the Kubernetes documentation.

Stormshield recommends modifying the KEY_ID variable value each time the Key Encryption Key (KEK) of your KMaaS is rotated.

  1. Start the SDS for Kubernetes KMS Plugin service using the following systemd commands:

    2. systemctl enable sds-kms-plugin
    systemctl start sds-kms-plugin

  2. Check the server status using the following command:

    3. systemctl status sds-kms-plugin

  1. If you need to uninstall the SDS for Kubernetes KMS Plugin, run the following systemd commands:

    2. systemctl stop sds-kms-plugin
    systemctl disable sds-kms-plugin

  2. Delete the service file with the following command:

    3. rm /etc/systemd/system/sds-kms-plugin.service