Provide a custom encryption key for a fresh installation

Supply your own encryption key before the initial Red Hat Edge Manager deployment on Red Hat OpenShift Container Platform. If a key already exists when Helm runs, Red Hat Edge Manager keeps it and does not generate a replacement key, so no rotation or migration is needed.

Before you begin

  • You have cluster-admin permissions on the Red Hat OpenShift Container Platform cluster.
  • The oc CLI is installed and authenticated.
  • You have generated a base64-encoded 32-byte random value for the encryption key.

Procedure

  1. Create the flightctl-encryption-key secret before you run helm install: 
    $ kubectl create secret generic flightctl-encryption-key \
  -n <project_name> \
  --from-file=key=<path_to_your_key_file>
  2. Proceed with the Red Hat Edge Manager Helm installation. The installer detects the existing key and does not generate a new one.

Results

  • Verify that the secret contains the expected key: 
    $ oc get secret flightctl-encryption-key -n <project_name> -o jsonpath='{.data.key}' | base64 -d | wc -c

    The output should show 32 bytes.