Creating KMS Keys
Here you'll find instructions for creating a cloud managed key for different cloud providers. The key is used as a part of the Vault auto-unseal process for users that choose to bundle Vault with their Garden Enterprise installation.

AWS Key Management Service

For auto-unsealing Vault on AWS, you'll need to first create a KMS key. Below you'll find a step-by-step guide for doing that.
Note that you may do things differently in your organization which is fine, as long as you have the following values at hand during the Garden Enterprise installation:
    The AWS KMS ID of the KMS Key you intend to use.
    The AWS Region where the key was created.
    The AWS Access Key ID of the principal assigned to the key.
    The AWS Secret Access Key of the principal assigned to the key.

Policy Principal

For auto-unsealing Vault on AWS, you'll need a policy principal that has permissions to perform cryptographic operations on a symmetric KMS key.
These permissions are:
1
[
2
"kms:Decrypt",
3
"kms:DescribeKey",
4
"kms:Encrypt",
5
"kms:GenerateDataKey*",
6
"kms:ReEncrypt*
7
]
Copied!
How you create and manage the principal depends on your organization, but one approach is to create an IAM user with the appropriate permissions and assign it as the KMS key principal.

Create an AWS KMS key via the AWS console

Go to the Key Management Service page in your AWS console and click Create key.
Make sure the key type is Symmetric:
Key type
Click Next.

Add a label

Add a label to your key so that you can identify it later:
Add label and description
The next steps pertain to defining administrative and/or usage permissions for the key. If and how you do this depends on your organization and is out of scope for this guide.

Review and Edit Key Policy

Review the key policy and assign the policy principal (from the Policy Principal section above).
Add the policy principal to the key
And that’s it.
During the installation of Garden Enterprise you will be asked to provide the IAM credentials for the policy principal, and the ID of the KMS key just created.

Google Cloud Key Management

For auto-unsealing Vault on GCP, you'll need to create a KMS key and configure the permissions of the instance groups service account to encrypt and decrypt that key. Below you'll find a step-by-step guide for doing that.
Note that you may do things differently in your organization which is fine, as long as you have the following values at hand during the Garden Enterprise installation:
    GCP Region
    GCP Project
    GCP Key Ring
    GCP Crypto Key
In order for your GKE cluster nodes to be able to access the API for fetching the KMS key for encryption/decryption you need to give the node pools service account the permissions to do so. You can either create a service account with the correct permissions in the IAM section or if you choose to use the Compute Engine default service account make sure to allow it full access to all Cloud APIs when creating the cluster.
Node pool service account

Create a GCP KMS key via the GCP console

Go to the Cryptographic Keys page in your GCP console and click Create key ring. Add a name for your new key ring and set the key ring location to the same location your GKE cluster uses.
Key ring
Next create a key in that key ring with the purpose symmetric encrypt/decrypt.
Key ring

Allow your service account to use the key for encryption/decryption

Select the created key and under the permissions tab choose Add a member. The member is the service account you have associated with your GKE clusters instance group. If your are not sure which one it is, go to Kubernetes Engine and check the node pool configuration of your cluster. Give your service account the role Cloud KMS CryptoKey Encrypter/Decrypter.
Key permissions
And that’s it.
During the installation of Garden Enterprise you will be asked to provide the key ring and crypto key name of the KMS key just created.

Azure Key Vault

For auto-unsealing Vault on Azure, you'll need to create an Azure Key Vault Instance and an app registration in Azure Active Directory. Then you'll need to add that service principle into the access policies of the key vault. Below you'll find a step-by-step guide for doing that.
Note that you may do things differently in your organization which is fine, as long as you have the following values at hand during the Garden Enterprise installation:
    Azure Application Client Id
    Azure Application Client Secret
    Azure Account Tenant Id
    Azure Vault Name
    Azure Key Name

Create an app registration

Go to the App Registrations page in Azure Active Directory and add a new registration.
App registration
After registering the application go to the API permissions tab and configure your apps access to Azure Vault Key.
App API permissions
Next navigate to Certificates & secrets and add a new client secret. You will need the Application Client Id and Application Client Secret for your Garden Enterprise installation.

Add an Azure Key Vault instance

Go to the Key Vaults page and create a new key vault. Enter your subscription, key vault name and region in the basics section and then navigate to the Access policy tab and choose the configuration template Key, Secret & Certificate Management. Then select the principal to be the app that you registered earlier.
Azure Vault access policy

Add a KMS key for auto-unsealing Garden Enterprise Vault

Once you have created your Azure Key Vault instance, add a key into it by navigating to the Keys tab in the Azure Key Vault instance and click Generate/Import. Your new key should be an RSA key, permit all operations and be enabled.
Key configuration
Once you have done that, take note of your Azure Vault Name and Azure Key Name and you should be all set.
Last modified 6mo ago