Understanding the requirements

Environment

• The server on which SDS for Kubernetes KMS Plugin is installed must be healthy. There must be an information system security policy whose requirements are met on the server. This policy shall ensure that the installed software is regularly updated and the system is protected against viruses and spyware or malware (firewall properly configured, antivirus updates, etc.). It is imperative to follow the operating system security recommendations issued by the ANSSI in their document ANSSI-BP-028-EN.

• Access to the administrative functions of the workstation system is restricted only to system administrators.

• The operating system must manage the logs generated by the product in accordance with the security policy of the company. It must for example restrict read access to these logs to only those explicitly permitted. For more information, refer to the section To meet the logging requirements for SDS for Kubernetes KMS Plugin, you must follow the security recommendations for logging systems issued by the ANSSI in their document ANSSI-PA-012 (French only)..

• SDS for Kubernetes KMS Plugin must be installed on a server whose system and OpenSource contributions are kept up to date.

• The server hosting the solution must be located in a secure physical environment with access control protocols and must be trusted.

Administration

• SDS for Kubernetes KMS Plugin administrators are considered as trusted. They are responsible for defining SDS for Kubernetes KMS Plugin security policy in compliance with the state-of-the-art standards.

• The system administrator is also considered as trusted. He/She is responsible for the installation and maintenance of the application and server. He/She applies the security policy defined by SDS for Kubernetes KMS Plugin administrators.

KMaaS

Stormshield recommends having a dedicated tenant for SDS for Kubernetes KMS Plugin to allow the API key to be revoked without interfering with other applications. We also recommend using only one API key per instance of SDS for Kubernetes KMS Plugin.

The SDS for Kubernetes KMS Plugin requires:

• A Kubernetes cluster version v1.29 or higher with etcd v3 or higher. For more information about Kubernetes requirements for the KMS provider, refer to the Kubernetes documentation,

• An available KMaaS instance version 4.5 or higher. The instance requires:

  • A base KMaaS URL,

  • A tenant identifier with enabled KAS feature,

  • An API key for authentication.

  For more information, refer to the KMaaS Administration Guide.

• Node.js 20 or higher.

• An operating system supporting Unix sockets.

• The following network streams must be open:

  Description	Protocol	Source	Base URL	Port	Route
  KMaaS KAS decrypt endpoint	HTTP SDS for Kubernetes KMS Plugin must be able to reach the KMaaS kas/decrypt route in order to decrypt the DEK.	SDS for Kubernetes KMS Plugin	<KMAAS_URL>	<KMAAS_PORT>	api/v1/<tenant_id>/kas/decrypt
  KMaaS KAS encrypt endpoint	HTTP SDS for Kubernetes KMS Plugin must be able to reach the KMaaS kas/encrypt route in order to encrypt the DEK.	SDS for Kubernetes KMS Plugin	<KMAAS_URL>	<KMAAS_PORT>	api/v1/<tenant_id>/kas/encrypt

Contact your KMaaS administrator to get the KMaaS URL and port.