Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

With recreated nodes, existing keys are not updated #286

Closed
krzkowalczyk opened this issue Jul 13, 2017 · 1 comment
Closed

With recreated nodes, existing keys are not updated #286

krzkowalczyk opened this issue Jul 13, 2017 · 1 comment
Labels
Priority: Medium

Comments

@krzkowalczyk
Copy link

With a new chef-vault version 3.1.0 a new feature was introduced:

  • Avoid re-encrypting key for all existing clients #269

This change is undesirable in environments where nodes are recreated. In such situations re-encrypting keys was fixing obsolete keys and allowing access to vault's items. Now it does not update client keys, and requires to delete, and re-add client to vault, for all vault items.

Keys should be re-encrypted if node client key has changed, or there should be an opt-in flag to force re-encryption.
@kamaradclimber
Copy link
Contributor

Looking at how the code is written, a short term workaround would be to rotate the symetrical key with knife vault rotate all keys.
I'll have a quick look at how adding an option to force re-encryption on a normal refresh.

kamaradclimber added a commit that referenced this issue Jul 19, 2017
@kamaradclimber
Allow to force reencryption of keys during refresh
389382f 
During a refresh operation, speed optimization lead to avoid
re-encrypting symetrical key for each existing clients.

This lead to issues when clients change their chef key.

This patch adds an option --force-reencryption to workaround that for
users having such behavior.

Fix #286

Change-Id: I0ffa71934d29198fa71aa6e1a9630ad302e21f6a
Signed-off-by: Grégoire Seux <g.seux@criteo.com>
@kamaradclimber kamaradclimber mentioned this issue Jul 19, 2017
Merged
kamaradclimber added a commit that referenced this issue Jul 26, 2017
@kamaradclimber
Allow to force reencryption of keys during refresh
410998d 
During a refresh operation, speed optimization lead to avoid
re-encrypting symetrical key for each existing clients.

This lead to issues when clients change their chef key.

This patch adds an option --force-reencryption to workaround that for
users having such behavior.

Fix #286

Change-Id: I0ffa71934d29198fa71aa6e1a9630ad302e21f6a
Signed-off-by: Grégoire Seux <g.seux@criteo.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Priority: Medium
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@kamaradclimber @krzkowalczyk