k3s secrets-encrypt
K3s supports enabling secrets encryption at rest. For more information, see Secrets Encryption.
Secrets Encryption Tool
Available as of v1.21.8+k3s1
K3s contains a CLI tool secrets-encrypt
, which enables automatic control over the following:
- Disabling/Enabling secrets encryption
- Adding new encryption keys
- Rotating and deleting encryption keys
- Reencrypting secrets
Failure to follow proper procedure for rotating encryption keys can leave your cluster permanently corrupted. Proceed with caution.
Encryption Key Rotation
- Single-Server
- High-Availability
To rotate secrets encryption keys on a single-server cluster:
- Start the K3s server with the flag
--secrets-encryption
Starting K3s without encryption and enabling it at a later time is currently not supported.
-
Prepare
k3s secrets-encrypt prepare
-
Kill and restart the K3s server with same arguments. If running K3s as a service:
# If using systemd
systemctl restart k3s
# If using openrc
rc-service k3s restart -
Rotate
k3s secrets-encrypt rotate
-
Kill and restart the K3s server with same arguments
-
Reencrypt
정보K3s will reencrypt ~5 secrets per second.
Clusters with large # of secrets can take several minutes to reencrypt.k3s secrets-encrypt reencrypt
The steps are the same for both embedded DB and external DB clusters.
To rotate secrets encryption keys on HA setups:
- Starting K3s without encryption and enabling it at a later time is currently not supported.
- While not required, it is recommended that you pick one server node from which to run the
secrets-encrypt
commands.
-
Start up all three K3s servers with the
--secrets-encryption
flag. For brevity, the servers will be referred to as S1, S2, S3. -
Prepare on S1
k3s secrets-encrypt prepare
-
Kill and restart S1 with same arguments. If running K3s as a service:
# If using systemd
systemctl restart k3s
# If using openrc
rc-service k3s restart -
Once S1 is up, kill and restart the S2 and S3
-
Rotate on S1
k3s secrets-encrypt rotate
-
Kill and restart S1 with same arguments
-
Once S1 is up, kill and restart the S2 and S3
-
Reencrypt on S1
정보K3s will reencrypt ~5 secrets per second.
Clusters with large # of secrets can take several minutes to reencrypt.k3s secrets-encrypt reencrypt
-
Kill and restart S1 with same arguments
-
Once S1 is up, kill and restart the S2 and S3
Secrets Encryption Disable/Enable
- Single-Server
- High-Availability
After launching a server with --secrets-encryption
flag, secrets encryption can be disabled.
To disable secrets encryption on a single-node cluster:
-
Disable
k3s secrets-encrypt disable
-
Kill and restart the K3s server with same arguments. If running K3s as a service:
# If using systemd
systemctl restart k3s
# If using openrc
rc-service k3s restart -
Reencrypt with flags
k3s secrets-encrypt reencrypt --force --skip