mirror of
https://github.com/kemko/nomad.git
synced 2026-01-01 16:05:42 +03:00
44f4970372
In Nomad 1.4, we implemented a root keyring to support encrypting Variables and signing Workload Identities. The keyring was originally stored with the AEAD-wrapped DEKs and the KEK together in a JSON keystore file on disk. We recently added support for using an external KMS for the KEK to improve the security model for the keyring. But we've encountered multiple instances of the keystore files not getting backed up separately from the Raft snapshot, resulting in failure to restore clusters from backup. Move Nomad's root keyring into Raft (encrypted with a KMS/Vault where available) in order to eliminate operational problems with the separate on-disk keystore. Fixes: https://github.com/hashicorp/nomad/issues/23665 Ref: https://hashicorp.atlassian.net/browse/NET-10523
4 lines
85 B
Plaintext
4 lines
85 B
Plaintext
```release-note:improvement
|
|
keyring: Stored wrapped data encryption keys in Raft
|
|
```
|