Skip to content

Commit 0770e2b

Browse files
ZhuzhenghaoZhuzhenghao
committed
[zh] resync page encrypt-data
1 parent 8326576 commit 0770e2b

File tree

1 file changed

+167
-27
lines changed

1 file changed

+167
-27
lines changed

‎content/zh-cn/docs/tasks/administer-cluster/encrypt-data.md

Lines changed: 167 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,29 @@ This page shows how to enable and configure encryption of secret data at rest.
2222

2323
## {{% heading "prerequisites" %}}
2424

25-
* {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
25+
* {{< include "task-tutorial-prereqs.md" >}}
2626

2727
<!--
28-
* etcd v3.0 or later is required
28+
* This task assumes that you are running the Kubernetes API server as a
29+
{{< glossary_tooltip text="static pod" term_id="static-pod" >}} on each control
30+
plane node.
2931
32+
* Your cluster's control plane **must** use etcd v3.x (major version 3, any minor version).
33+
-->
34+
* 此任务假设你将 Kubernetes API 服务器组件以{{< glossary_tooltip text="静态 Pod" term_id="static-pod" >}}
35+
方式运行在每个控制平面节点上。
36+
37+
* 集群的控制平面**必须**使用 etcd v3.x（主版本 3，任何次要版本）。
38+
<!--
3039
* To encrypt a custom resource, your cluster must be running Kubernetes v1.26 or newer.
3140
32-
* Use of wildcard for resource encryption is available from Kubernetes v1.27 or newer.
41+
* To use a wildcard to match resources, your cluster must be running Kubernetes v1.27 or newer.
3342
-->
34-
* 需要 etcd v3.0 或者更高版本
35-
3643
* 要加密自定义资源，你的集群必须运行 Kubernetes v1.26 或更高版本。
3744

38-
* 在 Kubernetes v1.27 或更高版本中可以使用通配符配置资源加密。
45+
* 在 Kubernetes v1.27 或更高版本中可以使用通配符匹配资源。
46+
47+
{{< version-check >}}
3948

4049
<!-- steps -->
4150

@@ -122,7 +131,7 @@ resources:
122131
123132
<!--
124133
Each `resources` array item is a separate config and contains a complete configuration. The
125-
`resources.resources` field is an array of Kubernetes resource names (`resource` or `resource.group`）
134+
`resources.resources` field is an array of Kubernetes resource names (`resource` or `resource.group`)
126135
that should be encrypted like Secrets, ConfigMaps, or other resources.
127136

128137
If custom resources are added to `EncryptionConfiguration` and the cluster version is 1.26 or newer,
@@ -222,26 +231,157 @@ read that resource will fail until it is deleted or a valid decryption key is pr
222231
### Providers
223232

224233
<!--
225-
{{< table caption="Providers for Kubernetes encryption at rest" >}}
226-
Name | Encryption | Strength | Speed | Key Length | Other Considerations
227-
-----|------------|----------|-------|------------|---------------------
228-
`identity` | None | N/A | N/A | N/A | Resources written as-is without encryption. When set as the first provider, the resource will be decrypted as new values are written.
229-
`secretbox` | XSalsa20 and Poly1305 | Strong | Faster | 32-byte | A newer standard and may not be considered acceptable in environments that require high levels of review.
230-
`aesgcm` | AES-GCM with random nonce | Must be rotated every 200k writes | Fastest | 16, 24, or 32-byte | Is not recommended for use except when an automated key rotation scheme is implemented.
231-
`aescbc` | AES-CBC with [PKCS#7](https://datatracker.ietf.org/doc/html/rfc2315) padding | Weak | Fast | 32-byte | Not recommended due to CBC's vulnerability to padding oracle attacks.
232-
`kms v1` | Uses envelope encryption scheme: Data is encrypted by data encryption keys (DEKs) using AES-CBC with [PKCS#7](https://datatracker.ietf.org/doc/html/rfc2315) padding (prior to v1.25), using AES-GCM starting from v1.25, DEKs are encrypted by key encryption keys (KEKs) according to configuration in Key Management Service (KMS) | Strongest | Slow (_compared to `kms v2`_) | 32-bytes | Simplifies key rotation, with a new DEK generated for each encryption, and KEK rotation controlled by the user. [Configure the KMS V1 provider](/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v1).
233-
`kms v2` | Uses envelope encryption scheme: Data is encrypted by data encryption keys (DEKs) using AES-GCM, DEKs are encrypted by key encryption keys (KEKs) according to configuration in Key Management Service (KMS) | Strongest | Fast | 32-bytes | The recommended choice for using a third party tool for key management. Available in beta from `v1.27`. A new DEK is generated at startup and reused for encryption. The DEK is rotated when the KEK is rotated. [Configure the KMS V2 provider](/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v2).
234-
{{< /table >}}
235-
-->
236-
{{< table caption="Kubernetes 静态数据加密的 Provider" >}}
237-
名称 | 加密类型 | 强度 | 速度 | 密钥长度 | 其它事项
238-
-----|------------|----------|-------|------------|---------------------
239-
`identity` | 无 | N/A | N/A | N/A | 不加密写入的资源。当设置为第一个 provider 时，资源将在新值写入时被解密。
240-
`secretbox` | XSalsa20 和 Poly1305 | 强 | 更快 | 32 字节 | 较新的标准，在需要高度评审的环境中可能不被接受。
241-
`aesgcm` | 带有随机数的 AES-GCM | 必须每 200k 写入一次 | 最快 | 16、24 或者 32字节 | 建议不要使用，除非实施了自动密钥循环方案。
242-
`aescbc` | 填充 [PKCS#7](https://datatracker.ietf.org/doc/html/rfc2315) 的 AES-CBC | 弱 | 快 | 32 字节 | 由于 CBC 容易受到密文填塞攻击（Padding Oracle Attack），不推荐使用。
243-
`kms v1` | 使用信封加密方案：数据使用带有 [PKCS#7](https://datatracker.ietf.org/doc/html/rfc2315) 填充的 AES-CBC（v1.25 之前），从 v1.25 开始使用 AES-GCM 通过数据加密密钥（DEK）加密，DEK 根据 Key Management Service（KMS）中的配置通过密钥加密密钥（Key Encryption Keys，KEK）加密 | 最强 | 快 | 32 字节 | 建议使用第三方工具进行密钥管理。为每个加密生成新的 DEK，并由用户控制 KEK 轮换来简化密钥轮换。从 `v1.27` 开始，该功能处于 Beta 阶段。系统在启动时生成一个新的 DEK 并重复使用它进行加密。当 KEK 被轮转时，DEK 也会被轮转。[配置 KMS V2 provider](/zh-cn/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v2)。
244-
{{< /table >}}
234+
The following table describes each available provider:
235+
-->
236+
下表描述了每个可用的 Provider：
237+
238+
<table class="complex-layout">
239+
<caption style="display: none;">
240+
<!-- Providers for Kubernetes encryption at rest -->
241+
Kubernetes 静态数据加密的 Provider
242+
</caption>
243+
<thead>
244+
<tr>
245+
<th><!-- Name -->名称</th>
246+
<th><!-- Encryption -->加密类型</th>
247+
<th><!-- Strength -->强度</th>
248+
<th><!-- Speed -->速度</th>
249+
<th><!-- Key length -->密钥长度</th>
250+
</tr>
251+
</thead>
252+
<tbody id="encryption-providers-identity">
253+
<!-- list identity first, even when the remaining rows are sorted alphabetically -->
254+
<tr>
255+
<th rowspan="2" scope="row"><tt>identity</tt></th>
256+
<td><strong><!-- None -->无</strong></td>
257+
<td>N/A</td>
258+
<td>N/A</td>
259+
<td>N/A</td>
260+
</tr>
261+
<tr>
262+
<td colspan="4">
263+
<!-- Resources written as-is without encryption. When set as the first provider, the resource will be decrypted as new values are written. Existing encrypted resources are <strong>not</strong> automatically overwritten with the plaintext data.
264+
The <tt>identity</tt> provider is the default if you do not specify otherwise. -->
265+
不加密写入的资源。当设置为第一个 provider 时，已加密的资源将在新值写入时被解密。
266+
</td>
267+
</tr>
268+
</tbody>
269+
<tbody id="encryption-providers-that-encrypt">
270+
<tr>
271+
<th rowspan="2" scope="row"><tt>aescbc</tt></th>
272+
<td>
273+
<!-- AES-CBC with <a href="https://datatracker.ietf.org/doc/html/rfc2315">PKCS#7</a> padding -->
274+
带有 <a href="https://datatracker.ietf.org/doc/html/rfc2315">PKCS#7</a> 填充的 AES-CBC
275+
</td>
276+
<td><!-- Weak -->弱</td>
277+
<td><!-- Fast -->快</td>
278+
<td><!-- 32-byte -->32 字节</td>
279+
</tr>
280+
<tr>
281+
<td colspan="4">
282+
<!-- Not recommended due to CBC's vulnerability to padding oracle attacks. Key material accessible from control plane host. -->
283+
由于 CBC 容易受到密文填塞攻击（Padding Oracle Attack），不推荐使用。密钥材料可从控制面主机访问。
284+
</td>
285+
</tr>
286+
<tr>
287+
<th rowspan="2" scope="row"><tt>aesgcm</tt></th>
288+
<td>
289+
<!-- AES-GCM with random nonce -->
290+
带有随机数的 AES-GCM
291+
</td>
292+
<td>
293+
<!-- Must be rotated every 200,000 writes -->
294+
每写入 200k 次后必须轮换
295+
</td>
296+
<td><!-- Fastest -->最快</td>
297+
<td><!-- 16, 24, or 32-byte -->16、24 或者 32 字节</td>
298+
</tr>
299+
<tr>
300+
<td colspan="4">
301+
<!-- Not recommended for use except when an automated key rotation scheme is implemented. Key material accessible from control plane host. -->
302+
不建议使用，除非实施了自动密钥轮换方案。密钥材料可从控制面主机访问。
303+
</td>
304+
</tr>
305+
<tr>
306+
<th rowspan="2" scope="row"><tt>kms</tt> v1</th>
307+
<td>
308+
<!-- Uses envelope encryption scheme with DEK per resource. -->
309+
针对每个资源使用不同的 DEK 来完成信封加密。
310+
</td>
311+
<td><!-- Strongest -->最强</td>
312+
<td><!-- Slow (<em>compared to <tt>kms</tt> version 2</em>) -->慢（<em>与 <tt>kms</tt> V2 相比</em>）</td>
313+
<td><!-- 32-bytes -->32 字节</td>
314+
</tr>
315+
<tr>
316+
<td colspan="4">
317+
<!--
318+
Data is encrypted by data encryption keys (DEKs) using AES-GCM;
319+
DEKs are encrypted by key encryption keys (KEKs) according to
320+
configuration in Key Management Service (KMS).
321+
Simple key rotation, with a new DEK generated for each encryption, and
322+
KEK rotation controlled by the user.
323+
-->
324+
通过数据加密密钥（DEK）使用 AES-GCM 加密数据；
325+
DEK 根据 Key Management Service（KMS）中的配置通过密钥加密密钥（Key Encryption Keys，KEK）加密。
326+
密钥轮换方式简单，每次加密都会生成一个新的 DEK，KEK 的轮换由用户控制。
327+
<br />
328+
<!--
329+
Read how to <a href="/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v1">configure the KMS V1 provider</a>.
330+
-->
331+
阅读如何<a href="/zh-cn/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v1">配置 KMS V1 Provider</a>
332+
</td>
333+
</tr>
334+
<tr>
335+
<th rowspan="2" scope="row"><tt>kms</tt> v2 <em>(beta)</em></th>
336+
<td>
337+
<!-- Uses envelope encryption scheme with DEK per API server. -->
338+
针对每个 API 服务器使用不同的 DEK 来完成信封加密。
339+
</td>
340+
<td><!-- Strongest -->最强</td>
341+
<td><!-- Fast -->快</td>
342+
<td><!-- 32-bytes -->32 字节</td>
343+
</tr>
344+
<tr>
345+
<td colspan="4">
346+
<!--
347+
Data is encrypted by data encryption keys (DEKs) using AES-GCM; DEKs
348+
are encrypted by key encryption keys (KEKs) according to configuration
349+
in Key Management Service (KMS).
350+
A new DEK is generated at API server startup, and is then reused for
351+
encryption. The DEK is rotated whenever the KEK is rotated.
352+
A good choice if using a third party tool for key management.
353+
Available in beta from Kubernetes v1.27.
354+
-->
355+
通过数据加密密钥（DEK）使用 AES-GCM 加密数据；
356+
DEK 根据 Key Management Service（KMS）中的配置通过密钥加密密钥（Key Encryption Keys，KEK）加密。
357+
API 服务器启动时会生成一个新的 DEK，并重复使用它进行加密。
358+
每当轮换 KEK 时，DEK 也会轮换。
359+
如果使用第三方工具进行密钥管理，会是一个不错的选择。
360+
从 `v1.27` 开始，该功能处于 Beta 阶段。
361+
<br />
362+
<!--
363+
Read how to <a href="/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v2">configure the KMS V2 provider</a>.
364+
-->
365+
阅读如何<a href="/zh-cn/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v2">配置 KMS V2 Provider</a>。
366+
</td>
367+
</tr>
368+
<tr>
369+
<th rowspan="2" scope="row"><tt>secretbox</tt></th>
370+
<td><!-- XSalsa20 and Poly1305 -->XSalsa20 和 Poly1305</td>
371+
<td><!-- Strong -->强</td>
372+
<td><!-- Faster -->更快</td>
373+
<td><!-- 32-byte -->32 字节</td>
374+
</tr>
375+
<tr>
376+
<td colspan="4">
377+
<!--
378+
Uses relatively new encryption technologies that may not be considered acceptable in environments that require high levels of review. Key material accessible from control plane host.
379+
-->
380+
使用相对较新的加密技术，在需要高度评审的环境中可能不被接受。密钥材料可从控制面主机访问。
381+
</td>
382+
</tr>
383+
</tbody>
384+
</table>
245385

246386
<!--
247387
Each provider supports multiple keys - the keys are tried in order for decryption, and if the provider

0 commit comments

Comments
 (0)