Cloud Key Management Service (Cloud KMS)

5.3 Cloud Key Management Service (Cloud KMS)

5.3.1 Ensure Kubernetes Secrets are encrypted using keys managed in Cloud KMS (Manual)

Recommended Action

Using Command Line: To create a key

Create a key ring:

gcloud kms keyrings create [RING_NAME] \
  --location [LOCATION] \
  --project [KEY_PROJECT_ID]

Create a key:

gcloud kms keys create [KEY_NAME] \
  --location [LOCATION] \
  --keyring [RING_NAME] \
  --purpose encryption \
  --project [KEY_PROJECT_ID]

Grant the Kubernetes Engine Service Agent service account the Cloud KMS CryptoKey Encrypter/Decrypter role:

gcloud kms keys add-iam-policy-binding [KEY_NAME] \
  --location [LOCATION] \
  --keyring [RING_NAME] \
  --member serviceAccount:[SERVICE_ACCOUNT_NAME] \
  --role roles/cloudkms.cryptoKeyEncrypterDecrypter \
  --project [KEY_PROJECT_ID]

To create a new cluster with Application-layer Secrets Encryption:

gcloud container clusters create [CLUSTER_NAME] \
  --cluster-version=latest \
  --zone [ZONE] \
  --database-encryption-key projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKey s/[KEY_NAME] \
  --project [CLUSTER_PROJECT_ID]

To enable on an existing cluster:

gcloud container clusters update [CLUSTER_NAME] \
  --zone [ZONE] \
  --database-encryption-key projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKey s/[KEY_NAME] \
  --project [CLUSTER_PROJECT_ID]