cloudfoundry / concourse-infra-for-fiwg

This repo holds the deployment tooling used to deploy a Concourse instance for the Foundation Infrastructure Working Group
2 stars 7 forks source link

Store credhub encryption key in google secret manager #24

Closed StefanWutz closed 3 years ago

StefanWutz commented 3 years ago

The encryption key is used to encrypt the database for credhub. Anytime the encryption key object (QuarksSecret) in the k8s cluster will be removed it is lost. Make sure we have a backup in gcp of the encryption key. Write a document how to recover the encryption key so that credhub can access the database again after the removal of encryption key.

Possible options are: 1) Use gcloud command

2) Use ConfigConnector's SecretManagerSecret (https://cloud.google.com/config-connector/docs/reference/resource-docs/secretmanager/secretmanagersecret)