Encryption in Managed Service for Kubernetes
Yandex Cloud adopts many information security measures. They include multi-level encryption of Managed Service for Kubernetes data:
- Data is encrypted using system keys when it is transferred to a Yandex Cloud storage. This protects your data from being compromised in the event of a physical theft of disks from the Yandex Cloud data centers.
- Data is encrypted when transmitted over the network using the TLS protocol. The keys for TLS are stored on hosts that use the protocol. This ensures protection of your data against interception.
The following cryptographic algorithms are used:
- Symmetric: AES, ChaCha.
- Asymmetric: RSA, Ed25519.
The minimum key length is 128 bits for symmetric encryption, and 2048 bits for asymmetric encryption.
Yandex Cloud manages these keys.
Encryption with custom symmetric keys
Managed Service for Kubernetes supports encryption with custom Yandex Key Management Service symmetric keys for the following resources:
Such keys are managed on the user side, which provides these extra advantages:
-
Auditing key-related events using Yandex Audit Trails.
-
Tracking operations with keys using Yandex Monitoring.
-
Operations with keys, such as rotation, modification, deactivation, and deletion.
-
Granular management of access permissions to the key at the level of individual Yandex Cloud accounts.
-
Using the hardware security module (HSM) when needed.
Note
In Managed Service for Kubernetes, a Yandex Cloud service account is called a cloud service account to avoid confusion with a Kubernetes service account.
Encrypting Kubernetes secrets
A Kubernetes secret is sensitive information the Kubernetes clusters use when managing pods, e.g., OAuth keys, passwords, SSH keys, etc.
By default, cluster secrets are stored unencrypted. If you specified an encryption key when creating a Managed Service for Kubernetes cluster, the cluster secrets will be encrypted.
Warning
You can specify an encryption key only when creating a cluster.
If you need to use another key, create a new cluster with that key.
The encryption of an individual secret includes these steps:
-
Kubernetes encrypts the secret using the KMS provider.
-
During encryption, the KMS provider accesses the KMS plugin that employs the encryption key you specified when creating the cluster.
This key is not used to encrypt secrets directly. Instead, the envelope encryption algorithm involving the key is used.
For a general description of the algorithm, see Envelope encryption.
-
During encryption, the KMS plugin enables interaction with Yandex Key Management Service where the encryption key is stored.
This plugin as well as the provider using it are already installed in the Managed Service for Kubernetes cluster and properly configured.
Secrets are decrypted in a similar way.