OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history bug_report picture_as_pdf
×

Configuring and managing Tang servers using the NBDE Tang Server Operator

With the NBDE Tang Server Operator, you can deploy and quickly configure Tang servers. On the deployed Tang servers, you can list existing keys and rotate them.

Deploying a Tang server using the NBDE Tang Server Operator

You can deploy and quickly configure one or more Tang servers using the NBDE Tang Server Operator in the web console.

Prerequisites

  • You must have cluster-admin privileges on an OpenShift Container Platform cluster.

  • You have installed the NBDE Tang Server Operator on your OCP cluster.

Procedure

  1. In the OpenShift Container Platform web console, navigate to Operators → OperatorHub.

  2. Select Project, and click Create Project:

    Create Project in the web console

  3. On the Create Project page, fill in the required information, for example:

    Example values on the Create Project page

  4. Click Create.

  5. NBDE Tang Server replicas require a Persistent Volume Claim (PVC) for storing encryption keys. In the web console, navigate to Storage → PersistentVolumeClaims:

    PersistentVolumeClaims in the Storage menu

  6. On the following PersistentVolumeClaims screen, click Create PersistentVolumeClaim.

  7. On the Create PersistentVolumeClaim page, select a storage that fits your deployment scenario. Consider how often you want to rotate the encryption keys. Name your PVC and choose the claimed storage capacity, for example:

    Create PersistentVolumeClaims page

  8. Navigate to Operators → Installed Operators, and click NBDE Tang Server.

  9. Click Create instance.

    Create NBDE Tang Server instance

  10. On the Create TangServer page, choose the name of the Tang Server instance, amount of replicas, and specify the name of the previously created Persistent Volume Claim, for example:

    Create TangServer page

  11. After you enter the required values a change settings that differ from the default values in your scenario, click Create.

Rotating keys using the NBDE Tang Server Operator

With the NBDE Tang Server Operator, you also can rotate your Tang server keys. The precise interval at which you should rotate them depends on your application, key sizes, and institutional policy.

Prerequisites

  • You must have cluster-admin privileges on an OpenShift Container Platform cluster.

  • You deployed a Tang server using the NBDE Tang Server Operator on your OpenShift cluster.

  • You have installed the OpenShift CLI (oc).

Procedure

  1. List the existing keys on your Tang server, for example:

    $ oc -n nbde describe tangserver
    Example output
    …
Status:
  Active Keys:
	File Name:  	QS82aXnPKA4XpfHr3umbA0r2iTbRcpWQ0VI2Qdhi6xg
	Generated:  	2022-02-08 15:44:17.030090484 +0000
	sha1:       	PvYQKtrTuYsMV2AomUeHrUWkCGg
	sha256:     	QS82aXnPKA4XpfHr3umbA0r2iTbRcpWQ0VI2Qdhi6xg
…

  2. Create a YAML file for moving your active keys to hidden keys, for example, minimal-keyretrieve-rotate-tangserver.yaml:

    Example key-rotation YAML for tang-operator
    apiVersion: daemons.redhat.com/v1alpha1
kind: TangServer
metadata:
  name: tangserver
  namespace: nbde
  finalizers:
    - finalizer.daemons.tangserver.redhat.com
spec:
  replicas: 1
  hiddenKeys:
    - sha1: "PvYQKtrTuYsMV2AomUeHrUWkCGg" (1)
    1 Specify the SHA-1 thumbprint of your active key to rotate it.

  3. Apply the YAML file:

    $ oc apply -f minimal-keyretrieve-rotate-tangserver.yaml
Verification

  1. After a certain amount of time depending on your configuration, check that the previous activeKey value is the new hiddenKey value and the activeKey key file is newly generated, for example:

    $ oc -n nbde describe tangserver
    Example output
    …
Spec:
  Hidden Keys:
    sha1:    PvYQKtrTuYsMV2AomUeHrUWkCGg
  Replicas:  1
Status:
  Active Keys:
    File Name:  T-0wx1HusMeWx4WMOk4eK97Q5u4dY5tamdDs7_ughnY.jwk
    Generated:  2023-10-25 15:38:18.134939752 +0000
    sha1:       vVxkNCNq7gygeeA9zrHrbc3_NZ4
    sha256:     T-0wx1HusMeWx4WMOk4eK97Q5u4dY5tamdDs7_ughnY
  Hidden Keys:
    File Name:           .QS82aXnPKA4XpfHr3umbA0r2iTbRcpWQ0VI2Qdhi6xg.jwk
    Generated:           2023-10-25 15:37:29.126928965 +0000
    Hidden:              2023-10-25 15:38:13.515467436 +0000
    sha1:                PvYQKtrTuYsMV2AomUeHrUWkCGg
    sha256:              QS82aXnPKA4XpfHr3umbA0r2iTbRcpWQ0VI2Qdhi6xg
…

Deleting hidden keys with the NBDE Tang Server Operator

After you rotate your Tang server keys, the previously active keys become hidden and are no longer advertised by the Tang instance. You can use the NBDE Tang Server Operator to remove encryption keys no longer used.

WARNING

Do not remove any hidden keys unless you are sure that all bound Clevis clients already use new keys.

Prerequisites

  • You must have cluster-admin privileges on an OpenShift Container Platform cluster.

  • You deployed a Tang server using the NBDE Tang Server Operator on your OpenShift cluster.

  • You have installed the OpenShift CLI (oc).

Procedure

  1. List the existing keys on your Tang server, for example:

    $ oc -n nbde describe tangserver
    Example output
    …
Status:
  Active Keys:
	File Name:  	PvYQKtrTuYsMV2AomUeHrUWkCGg.jwk
	Generated:  	2022-02-08 15:44:17.030090484 +0000
	sha1:	    	PvYQKtrTuYsMV2AomUeHrUWkCGg
	sha256:	    	QS82aXnPKA4XpfHr3umbA0r2iTbRcpWQ0VI2Qdhi6xg
…

  2. Create a YAML file for removing all hidden keys, for example, hidden-keys-deletion-tangserver.yaml:

    Example hidden-keys-deletion YAML for tang-operator
    apiVersion: daemons.redhat.com/v1alpha1
kind: TangServer
metadata:
  name: tangserver
  namespace: nbde
  finalizers:
    - finalizer.daemons.tangserver.redhat.com
spec:
  replicas: 1
  hiddenKeys: [] (1)
    1 The empty array as the value of the hiddenKeys entry indicates you want to preserve no hidden keys on your Tang server.

  3. Apply the YAML file:

    $ oc apply -f hidden-keys-deletion-tangserver.yaml
Verification

  1. After a certain amount of time depending on your configuration, check that the previous active key still exists, but no hidden key is available, for example:

    $ oc -n nbde describe tangserver
    Example output
    …
Spec:
  Hidden Keys:
    sha1:    PvYQKtrTuYsMV2AomUeHrUWkCGg
  Replicas:  1
Status:
  Active Keys:
    File Name:  T-0wx1HusMeWx4WMOk4eK97Q5u4dY5tamdDs7_ughnY.jwk
    Generated:  2023-10-25 15:38:18.134939752 +0000
    sha1:       vVxkNCNq7gygeeA9zrHrbc3_NZ4
    sha256:     T-0wx1HusMeWx4WMOk4eK97Q5u4dY5tamdDs7_ughnY
Status:
  Ready:                 1
  Running:               1
  Service External URL:  http://35.222.247.84:7500/adv
  Tang Server Error:     No
Events:
…