Skip to content

Commit a4dfccc

Browse files
Vikash-8090-Yadavmandre
authored andcommitted
fixed Grammatical mistakes in barbican-kms-plugin (kubernetes#2289)
* fixed Grammatical mistakes in barbican-kms-plugin * Fixed the Grammatical mistakes in barbican-kms-plugin * Fixed the Grammatical mistakes in barbican-kms-plugin * Fixed the Grammatical mistakes in barbican-kms-plugin * Fixed the Grammatical mistakes in barbican-kms-plugin
1 parent f231bd6 commit a4dfccc

File tree

1 file changed

+10
-10
lines changed

1 file changed

+10
-10
lines changed

docs/barbican-kms-plugin/using-barbican-kms-plugin.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@
99
<!-- END doctoc generated TOC please keep comment here to allow auto update -->
1010

1111
# OpenStack Barbican KMS Plugin
12-
Kubernetes supports to encrypt etcd data with various providers listed [here](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers), one of which is *kms*. The Kubernetes *kms provider* uses envelope encryption scheme. The data is encrypted using *DEK's* by kubernetes *kms provider*, *DEK's* are encrypted by *kms plugin* (e.g. barbican) using *KEK*. *Barbican-kms-plugin* uses *key* from barbican to encrypt/decrypt the *DEK's* as requested by kubernetes api server.
12+
Kubernetes supports encrypting etcd data with various providers listed [here](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers), one of which is *kms*. The Kubernetes *kms provider* uses an envelope encryption scheme. The data is encrypted using *DEK's* by kubernetes *kms provider*, *DEK's* are encrypted by *kms plugin* (e.g. barbican) using *KEK*. *Barbican-kms-plugin* uses *key* from barbican to encrypt/decrypt the *DEK's* as requested by kubernetes api server.
1313
The *KMS provider* uses gRPC to communicate with a specific *KMS plugin*.
1414

15-
It is recommended to read following kubernetes documents
15+
It is recommended to read the following kubernetes documents
1616

1717
* [Encrypting Secret Data at Rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#verifying-that-data-is-encrypted)
1818
* [Using a KMS provider for data encryption](https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/)
@@ -23,7 +23,7 @@ It is recommended to read following kubernetes documents
2323
The following installation steps assumes that you have a Kubernetes cluster(v1.10+) running on OpenStack Cloud.
2424

2525

26-
### Create 256bit(32 byte) cbc key and store in barbican
26+
### Create 256-bit (32 bytes) CBC key and store in barbican
2727

2828
```
2929
$ openstack secret order create --name k8s_key --algorithm aes --mode cbc --bit-length 256 --payload-content-type=application/octet-stream key
@@ -41,7 +41,7 @@ $ openstack secret order create --name k8s_key --algorithm aes --mode cbc --bit-
4141
+----------------+----------------------------------------------------------------------+
4242
```
4343

44-
### Get the Key ID, It is the **uuid** in *Secret href*
44+
### Get the key ID, it is the **uuid** in *Secret href*
4545

4646
```
4747
$ openstack secret order get http://hostname:9311/v1/orders/e477a578-4a46-4c3f-b071-79e220207b0e
@@ -60,7 +60,7 @@ $ openstack secret order get http://hostname:9311/v1/orders/e477a578-4a46-4c3f-b
6060
```
6161

6262

63-
### Add the Key ID in your cloud-config file
63+
### Add the key ID in your cloud-config file
6464

6565
```toml
6666
[Global]
@@ -79,18 +79,18 @@ key-id = "<key-id>"
7979
### Run the KMS Plugin in your cluster
8080

8181
This will provide a socket at `/var/lib/kms/kms.sock` on each of the control
82-
plane node
82+
plane nodes.
8383
```
8484
kubectl apply -f https://raw.githubusercontent.com/kubernetes/cloud-provider-openstack/master/manifests/barbican-kms/ds.yaml
8585
```
8686
*recommendation:* Use the tag corresponding to your Kubernetes release, for
8787
example `release-1.25` for kubernetes version 1.25.
8888

8989

90-
### Create encrytion configuration
90+
### Create encryption configuration
9191

9292
Create `/etc/kubernetes/encryption-config.yaml` on each of your control plane
93-
nodes
93+
nodes.
9494
```yaml
9595
kind: EncryptionConfig
9696
apiVersion: v1
@@ -108,7 +108,7 @@ resources:
108108
109109
### Update the API server
110110
111-
On each of your control plane nodes you need to edit the kube-apiserver, the
111+
On each of your control plane nodes, you need to edit the kube-apiserver, the
112112
configuration is usually found at
113113
`/etc/kubernetes/manifests/kube-apiserver.yaml`. You can just edit it and
114114
kubernetes will eventually restart the pod with the new configuration.
@@ -142,5 +142,5 @@ spec:
142142

143143

144144
### Verify
145-
[Verify the secret data is encrypted](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#verifying-that-data-is-encrypted
145+
[Verify that the secret data is encrypted](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#verifying-that-data-is-encrypted
146146
)

0 commit comments

Comments
 (0)