Skip to content

Commit e3720c7

Browse files
author
Tim Bannister
committed
Switch to HTML table
Replace the existing Markdown table with a more complex table that is not easy to express in Markdown - and for that reason, use HTML. This relies on custom style support to render well, but can work OK even with default Docsy styling.
1 parent 1d4ea15 commit e3720c7

File tree

1 file changed

+98
-10
lines changed

1 file changed

+98
-10
lines changed

‎content/en/docs/tasks/administer-cluster/encrypt-data.md

Lines changed: 98 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -138,16 +138,104 @@ read that resource will fail until it is deleted or a valid decryption key is pr
138138

139139
### Providers
140140

141-
{{< table caption="Providers for Kubernetes encryption at rest" >}}
142-
Name | Encryption | Strength | Speed | Key Length | Other Considerations
143-
-----|------------|----------|-------|------------|---------------------
144-
`identity` | None | N/A | N/A | N/A | Resources written as-is without encryption. When set as the first provider, the resource will be decrypted as new values are written.
145-
`secretbox` | XSalsa20 and Poly1305 | Strong | Faster | 32-byte | A newer standard and may not be considered acceptable in environments that require high levels of review.
146-
`aesgcm` | AES-GCM with random nonce | Must be rotated every 200k writes | Fastest | 16, 24, or 32-byte | Is not recommended for use except when an automated key rotation scheme is implemented.
147-
`aescbc` | AES-CBC with [PKCS#7](https://datatracker.ietf.org/doc/html/rfc2315) padding | Weak | Fast | 32-byte | Not recommended due to CBC's vulnerability to padding oracle attacks.
148-
`kms v1` | Uses envelope encryption scheme: Data is encrypted by data encryption keys (DEKs) using AES-CBC with [PKCS#7](https://datatracker.ietf.org/doc/html/rfc2315) padding (prior to v1.25), using AES-GCM starting from v1.25, DEKs are encrypted by key encryption keys (KEKs) according to configuration in Key Management Service (KMS) | Strongest | Slow (_compared to `kms v2`_) | 32-bytes | Simplifies key rotation, with a new DEK generated for each encryption, and KEK rotation controlled by the user. [Configure the KMS V1 provider](/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v1).
149-
`kms v2` | Uses envelope encryption scheme: Data is encrypted by data encryption keys (DEKs) using AES-GCM, DEKs are encrypted by key encryption keys (KEKs) according to configuration in Key Management Service (KMS) | Strongest | Fast | 32-bytes | The recommended choice for using a third party tool for key management. Available in beta from `v1.27`. A new DEK is generated at startup and reused for encryption. The DEK is rotated when the KEK is rotated. [Configure the KMS V2 provider](/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v2).
150-
{{< /table >}}
141+
The following table describes each available provider:
142+
143+
<!-- localization note: if it makes sense to adapt this table to work for your localization,
144+
please do that. Each sentence in the English original should have a direct equivalent in the adapted
145+
layout, although this may not always be possible -->
146+
<table class="complex-layout">
147+
<caption style="display: none;">Providers for Kubernetes encryption at rest</caption>
148+
<thead>
149+
<tr>
150+
<th>Name</th>
151+
<th>Encryption</th>
152+
<th>Strength</th>
153+
<th>Speed</th>
154+
<th>Key length</th>
155+
</tr>
156+
</thead>
157+
<tbody>
158+
<tr>
159+
<th rowspan="2" scope="row"><tt>identity</tt></th>
160+
<td><strong>None</strong></td>
161+
<td>N/A</td>
162+
<td>N/A</td>
163+
<td>N/A</td>
164+
</tr>
165+
<tr>
166+
<td colspan="4">Resources written as-is without encryption. When set as the first provider, the resource will be decrypted as new values are written. Existing encrypted resources are <strong>not</strong> automatically overwritten with the plaintext data.
167+
The <tt>identity</tt> provider is the default if you do not specify otherwise.</td>
168+
</tr>
169+
<tr>
170+
<th rowspan="2" scope="row"><tt>aescbc</tt></th>
171+
<td>AES-CBC with <a href="https://datatracker.ietf.org/doc/html/rfc2315">PKCS#7</a> padding</td>
172+
<td>Weak</td>
173+
<td>Fast</td>
174+
<td>32-byte</td>
175+
</tr>
176+
<tr>
177+
<td colspan="4">Not recommended due to CBC's vulnerability to padding oracle attacks. Key material accessible from control plane host.</td>
178+
</tr>
179+
<tr>
180+
<th rowspan="2" scope="row"><tt>aesgcm</tt></th>
181+
<td>AES-GCM with random nonce</td>
182+
<td>Must be rotated every 200,000 writes</td>
183+
<td>Fastest</td>
184+
<td>16, 24, or 32-byte</td>
185+
</tr>
186+
<tr>
187+
<td colspan="4">Not recommended for use except when an automated key rotation scheme is implemented. Key material accessible from control plane host.</td>
188+
</tr>
189+
<tr>
190+
<th rowspan="2" scope="row"><tt>secretbox</tt></th>
191+
<td>XSalsa20 and Poly1305</td>
192+
<td>Strong</td>
193+
<td>Faster</td>
194+
<td>32-byte</td>
195+
</tr>
196+
<tr>
197+
<td colspan="4">Uses relatively new encryption technologies that may not be considered acceptable in environments that require high levels of review. Key material accessible from control plane host.</td>
198+
</tr>
199+
<tr>
200+
<th rowspan="2" scope="row"><tt>kms</tt> v1</th>
201+
<td>Uses envelope encryption scheme with DEK per resource.</td>
202+
<td>Strongest</td>
203+
<td>Slow (<em>compared to <tt>kms</tt> version 2</em>)</td>
204+
<td>32-bytes</td>
205+
</tr>
206+
<tr>
207+
<td colspan="4">
208+
Data is encrypted by data encryption keys (DEKs) using AES-GCM;
209+
DEKs are encrypted by key encryption keys (KEKs) according to
210+
configuration in Key Management Service (KMS).
211+
Simple key rotation, with a new DEK generated for each encryption, and
212+
KEK rotation controlled by the user.
213+
<br />
214+
Read how to <a href="/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v1">configure the KMS V1 provider</a>.
215+
</td>
216+
</tr>
217+
<tr>
218+
<th rowspan="2" scope="row"><tt>kms</tt> v2 <em>(beta)</em></th>
219+
<td>Uses envelope encryption scheme with DEK per API server.</td>
220+
<td>Strongest</td>
221+
<td>Fast</td>
222+
<td>32-bytes</td>
223+
</tr>
224+
<tr>
225+
<td colspan="4">
226+
Data is encrypted by data encryption keys (DEKs) using AES-GCM; DEKs
227+
are encrypted by key encryption keys (KEKs) according to configuration
228+
in Key Management Service (KMS).
229+
A new DEK is generated at API server startup, and is then reused for
230+
encryption. The DEK is rotated whenever the KEK is rotated.
231+
A good choice if using a third party tool for key management.
232+
Available in beta from Kubernetes v1.27.
233+
<br />
234+
Read how to <a href="/docs/tasks/administer-cluster/kms-provider#configuring-the-kms-provider-kms-v2">configure the KMS V2 provider</a>.
235+
</td>
236+
</tr>
237+
</tbody>
238+
</table>
151239

152240
Each provider supports multiple keys - the keys are tried in order for decryption, and if the provider
153241
is the first provider, the first key is used for encryption.

0 commit comments

Comments
 (0)