mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2025-06-13 18:43:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

util: add vaultDestroyKeys option to destroy Vault kv-v2 secrets

Browse Source 
Hashicorp Vault does not completely remove the secrets in a kv-v2
backend when the keys are deleted. The metadata of the keys will be
kept, and it is possible to recover the contents of the keys afterwards.

With the new `vaultDestroyKeys` configuration parameter, this behaviour
can now be selected. By default the parameter will be set to `true`,
indicating that the keys and contents should completely be destroyed.
Setting it to any other value will make it possible to recover the
deleted keys.

Signed-off-by: Niels de Vos <ndevos@redhat.com>
This commit is contained in:
Niels de Vos
2021-08-02 11:35:26 +02:00
committed by mergify[bot]
parent d7bcb42481
commit f584db41e6
6 changed files with 82 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
examples/kms/vault/kms-config.yaml
View File

@ -10,6 +10,7 @@ data:
"vaultAuthPath": "/v1/auth/kubernetes/login",
"vaultRole": "csi-kubernetes",
"vaultBackend": "kv-v2",
"vaultDestroyKeys": "true",
"vaultPassphraseRoot": "/v1/secret",
"vaultPassphrasePath": "ceph-csi/",
"vaultCAVerify": "false"
@ -29,7 +30,8 @@ data:
"vaultCAVerify": "true"
},
"an-other-app": {
"tenantTokenName": "storage-encryption-token"
"tenantTokenName": "storage-encryption-token",
"vaultDestroyKeys": "false"
}
}
},