Skip to content

Commit 31a8b33

Browse files
JoeAldingerJoeAldinger
authored
Merge pull request #80336 from RichardHoch/ssec_encryption_backups
SSE-C encryption backups
2 parents 873276c + c04e744 commit 31a8b33

File tree

3 files changed

+198
-1
lines changed

3 files changed

+198
-1
lines changed

‎backup_and_restore/application_backup_and_restore/installing/installing-oadp-aws.adoc

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,14 @@ include::modules/migration-configuring-aws-s3.adoc[leveloffset=+1]
2525
include::modules/oadp-about-backup-snapshot-locations-secrets.adoc[leveloffset=+1]
2626
include::modules/oadp-creating-default-secret.adoc[leveloffset=+2]
2727
include::modules/oadp-secrets-for-different-credentials.adoc[leveloffset=+2]
28+
include::modules/oadp-ssec-encrypted-backups.adoc[leveloffset=+2]
29+
30+
[role="_additional-resources_1"]
31+
.Additional resources
32+
33+
You can also download the file with the additional encryption key backed up with Velcro by running a different command. See xref:../../../backup_and_restore/application_backup_and_restore/installing/installing-oadp-aws.adoc#oadp-ssec-encrypted-backups-velero_installing-oadp-aws[Downloading a file with an SSE-C encryption key for files backed up by Velero].
34+
35+
include::modules/oadp-ssec-encrypted-backups-velero.adoc[leveloffset=+3]
2836

2937
[id="configuring-dpa-aws"]
3038
== Configuring the Data Protection Application
@@ -47,7 +55,7 @@ include::modules/oadp-configuring-dpa-multiple-bsl.adoc[leveloffset=+1]
4755
include::modules/oadp-enabling-csi-dpa.adoc[leveloffset=+2]
4856
include::modules/oadp-about-disable-node-agent-dpa.adoc[leveloffset=+2]
4957

50-
[role="_additional-resources"]
58+
[role="_additional-resources_2"]
5159
.Additional resources
5260

5361
* xref:../../../backup_and_restore/application_backup_and_restore/installing/installing-oadp-kubevirt.adoc#oadp-installing-dpa-1-3_installing-oadp-kubevirt[Installing the Data Protection Application with the `kubevirt` and `openshift` plugins]

‎modules/oadp-ssec-encrypted-backups-velero.adoc

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-aws.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="oadp-ssec-encrypted-backups-velero_{context}"]
7+
= Downloading a file with an SSE-C encryption key for files backed up by Velero
8+
9+
When you are verifying an SSE-C encryption key, you can also download the file with the additional encryption key for files that were backed up with Velcro.
10+
11+
.Procedure
12+
13+
* Download the file with the additional encryption key for files backed up by Velero by running the following command:
14+
15+
[source,terminal]
16+
----
17+
$ aws s3api get-object \
18+
--bucket <bucket> \
19+
--key velero/backups/mysql-persistent-customerkeyencryptionfile4/mysql-persistent-customerkeyencryptionfile4.tar.gz \
20+
--sse-customer-key fileb://sse.key \
21+
--sse-customer-algorithm AES256 \
22+
--debug \
23+
velero_download.tar.gz
24+
----

‎modules/oadp-ssec-encrypted-backups.adoc

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-aws.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="oadp-ssec-encrypted-backups_{context}"]
7+
= Creating an OADP SSE-C encryption key for additional data security
8+
9+
{aws-first} S3 applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in Amazon S3.
10+
11+
{oadp-first} encrypts data by using SSL/TLS, HTTPS, and the `velero-repo-credentials` secret when transferring the data from a cluster to storage. To protect backup data in case of lost or stolen AWS credentials, apply an additional layer of encryption.
12+
13+
The velero-plugin-for-aws plugin provides several additional encryption methods. You should review its configuration options and consider implementing additional encryption.
14+
15+
You can store your own encryption keys by using server-side encryption with customer-provided keys (SSE-C). This feature provides additional security if your AWS credentials become exposed.
16+
17+
[WARNING]
18+
====
19+
Be sure to store cryptographic keys in a secure and safe manner. Encrypted data and backups cannot be recovered if you do not have the encryption key.
20+
====
21+
22+
.Prerequisites
23+
24+
* To make {oadp-short} mount a secret that contains your SSE-C key to the Velero pod at `/credentials`, use the following default secret name for AWS: `cloud-credentials`, and leave at least one of the following labels empty:
25+
26+
** `dpa.spec.backupLocations[].velero.credential`
27+
** `dpa.spec.snapshotLocations[].velero.credential`
28+
+
29+
This is a workaround for a known issue: https://issues.redhat.com/browse/OADP-3971.
30+
31+
[NOTE]
32+
====
33+
The following procedure contains an example of a `spec:backupLocations` block that does not specify credentials. This example would trigger an OADP secret mounting.
34+
====
35+
36+
* If you need the backup location to have credentials with a different name than `cloud-credentials`, you must add a snapshot location, such as the one in the following example, that does not contain a credential name. Because the example does not contain a credential name, the snapshot location will use `cloud-credentials` as its secret for taking snapshots.
37+
38+
.Example snapshot location in a DPA without credentials specified
39+
[source,yaml]
40+
----
41+
snapshotLocations:
42+
- velero:
43+
config:
44+
profile: default
45+
region: <region>
46+
provider: aws
47+
# ...
48+
----
49+
50+
.Procedure
51+
. Create an SSE-C encryption key:
52+
53+
.. Generate a random number and save it as a file named `sse.key` by running the following command:
54+
+
55+
[source,terminal]
56+
----
57+
$ dd if=/dev/urandom bs=1 count=32 > sse.key
58+
----
59+
60+
.. Encode the `sse.key` by using Base64 and save the result as a file named `sse_encoded.key` by running the following command:
61+
+
62+
[source,terminal]
63+
----
64+
$ cat sse.key | base64 > sse_encoded.key
65+
----
66+
67+
.. Link the file named `sse_encoded.key` to a new file named `customer-key` by running the following command:
68+
+
69+
[source,terminal]
70+
----
71+
$ ln -s sse_encoded.key customer-key
72+
----
73+
74+
. Create an {product-title} secret:
75+
** If you are initially installing and configuring {oadp-short}, create the AWS credential and encryption key secret at the same time by running the following command:
76+
+
77+
[source,terminal]
78+
----
79+
$ oc create secret generic cloud-credentials --namespace openshift-adp --from-file cloud=<path>/openshift_aws_credentials,customer-key=<path>/sse_encoded.key
80+
----
81+
** If you are updating an existing installation, edit the values of the `cloud-credential` `secret` block of the `DataProtectionApplication` CR manifest, as in the following example:
82+
+
83+
[source,yaml]
84+
----
85+
apiVersion: v1
86+
data:
87+
cloud: W2Rfa2V5X2lkPSJBS0lBVkJRWUIyRkQ0TlFHRFFPQiIKYXdzX3NlY3JldF9hY2Nlc3Nfa2V5P<snip>rUE1mNWVSbTN5K2FpeWhUTUQyQk1WZHBOIgo=
88+
customer-key: v+<snip>TFIiq6aaXPbj8dhos=
89+
kind: Secret
90+
# ...
91+
----
92+
. Edit the value of the `customerKeyEncryptionFile` attribute in the `backupLocations` block of the `DataProtectionApplication` CR manifest, as in the following example:
93+
+
94+
[source,yaml]
95+
----
96+
spec:
97+
backupLocations:
98+
- velero:
99+
config:
100+
customerKeyEncryptionFile: /credentials/customer-key
101+
profile: default
102+
# ...
103+
----
104+
+
105+
[WARNING]
106+
====
107+
You must restart the Velero pod to remount the secret credentials properly on an existing installation.
108+
====
109+
+
110+
The installation is complete, and you can back up and restore {product-title} resources. The data saved in AWS S3 storage is encrypted with the new key, and you cannot download it from the AWS S3 console or API without the additional encryption key.
111+
112+
.Verification
113+
114+
To verify that you cannot download the encrypted files without the inclusion of an additional key, create a test file, upload it, and then try to download it.
115+
116+
. Create a test file by running the following command:
117+
+
118+
[source,terminal]
119+
----
120+
$ echo "encrypt me please" > test.txt
121+
----
122+
. Upload the test file by running the following command:
123+
+
124+
[source,terminal]
125+
----
126+
$ aws s3api put-object \
127+
--bucket <bucket> \
128+
--key test.txt \
129+
--body test.txt \
130+
--sse-customer-key fileb://sse.key \
131+
--sse-customer-algorithm AES256
132+
----
133+
. Try to download the file. In either the Amazon web console or the terminal, run the following command:
134+
+
135+
[source,terminal]
136+
----
137+
$ s3cmd get s3://<bucket>/test.txt test.txt
138+
----
139+
+
140+
The download fails because the file is encrypted with an additional key.
141+
142+
. Download the file with the additional encryption key by running the following command:
143+
+
144+
[source,terminal]
145+
----
146+
$ aws s3api get-object \
147+
--bucket <bucket> \
148+
--key test.txt \
149+
--sse-customer-key fileb://sse.key \
150+
--sse-customer-algorithm AES256 \
151+
downloaded.txt
152+
----
153+
154+
. Read the file contents by running the following command:
155+
+
156+
[source,terminal]
157+
----
158+
$ cat downloaded.txt
159+
----
160+
.Example output
161+
+
162+
[source,terminal]
163+
----
164+
encrypt me please
165+
----

0 commit comments

Comments
 (0)