Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add documentation for amazon_web_services.eks_kms_arn config option #537

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add documentation for amazon_web_services.eks_kms_arn config option #537

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions docs/docs/explanations/advanced-provider-configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,26 @@ amazon_web_services:
permissions_boundary: arn:aws:iam::01234567890:policy/<permissions-boundary-policy-name>
```

### EKS KMS ARN (Optional)

AWS Key Management Service (KMS) keys can provide envelope encryption of Kubernetes secrets stored in
Amazon Elastic Kubernetes Service (EKS). Kubernetes secrets store sensitive information (e.g. passwords,
credentials, TLS keys, etc.). Kubernetes stores all secret object data within etcd and all etcd volumes
used by Amazon EKS are encrypted at the disk-level using AWS-managed encryption keys. The benefit of
specifying a user-managed KMS key for EKS is adding a level of envelope encryption to apply a security
best practice of [defense-in-depth strategy](https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/) by encrypting the Kubernetes secrets store with a KMS key
that the user manages.

Nebari supports setting an existing KMS key while deploying Nebari to implement encryption of secrets
created in Nebari's EKS cluster. The KMS key must be a `Symmetric` key set to `encrypt and decrypt` data.
Here is an example of how you would set KMS key ARN in `nebari-config.yaml`.

```yaml
amazon_web_services:
# the arn for the AWS Key Management Service key
eks_kms_arn: 'arn:aws:kms:us-west-2:01234567890:key/<aws-kms-key-id>'
```

</TabItem>

<TabItem value="azure" label="Azure">
Expand Down
Loading