search

airshipit / treasuremap

Reference Airship manifests, CICD, and reference architecture.
http://openstack.org
Apache License 2.0
52 stars 39 forks source link

Secret Management for Sub-Clusters #192

Open lb4368 opened 3 years ago

lb4368 commented 3 years ago

Problem description Currently all encrypted secrets such as CAs, ssh keys, Dex client secrets, etc. are managed as part of the management cluster. As sub-clusters are added to multi-tenant sites, there needs to be a mechanism to manage secrets specific to individual sub-clusters.

Proposed change

  1. Provide a mechanism to generate and encrypt secrets specific to an individual sub-cluster.
  2. Provide a mechanism to provide external secrets specific to an individual sub-cluster.
  3. All secrets must be encrypted at rest and encryption key for sub-cluster may be the same or different from one used in management cluster.