Installing the Compliance Operator through the web console, 5.3.2. For security reasons, store this file separately from the etcd snapshot. Updating the CA bundle", Expand section "4. Storing containers using Red Hat Quay, 2.8.1. Getting containers from Red Hat Registry and Ecosystem Catalog, 2.7.5. Running the Container Security Operator, 7.2. You can enable etcd encryption to encrypt sensitive resources in your cluster. Service CA certificates", Collapse section "3.4. Save the file to apply the changes. The encryption process starts . This is a single point of failure for the whole scheme. Allowing JavaScript-based access to the API server from additional hosts, 11.1. Understanding host and VM security", Expand section "1.3.2. Add the service CA bundle to a mutating webhook configuration, 3.3.7. It can take 20 minutes or longer for this process to complete, depending on the size of your cluster. Review the Encrypted status condition for the Kubernetes API server to verify that its resources were successfully encrypted: Review the Encrypted status condition for the OpenShift OAuth API server to verify that its resources were successfully encrypted: You can disable encryption of etcd data in your cluster. A disk I/O can affect the node that receives the backup state. Understanding the Compliance Operator", Collapse section "5.5. . Configuring the TLS security profile for the control plane, 10.1. Where etcd encryption is used, it is important to ensure that the appropriate set of encryption providers is used. Building Knative serverless applications, 1.8.1. Scheduling the result server pod on a worker node, 5.5. Review the Encrypted status condition for the Kubernetes API server to verify that its resources were successfully encrypted: You can disable encryption of etcd data in your cluster. Managing certificates for the platform", Collapse section "2.11. User-provided certificates for default ingress", Collapse section "4.8. 2.7.2. Configuring TLS security profiles", Collapse section "9. OpenShift Compliance Operator 0.1.47", Collapse section "5.1.5. Service CA certificates", Collapse section "3.3. Adding API server certificates", Expand section "3.3. You must have these keys in order to restore from an etcd backup. API access control and management, 1.9.4. OpenShift Compliance Operator 0.1.52", Collapse section "5.1.2. Installing the File Integrity Operator", Expand section "6.3. Allowing JavaScript-based access to the API server from additional hosts", Collapse section "6. Save the file to apply the changes. Resource types, namespaces, and object names are unencrypted. What is etcd? File Integrity Operator release notes", Expand section "6.1.1. Etcd encryption only encrypts values, not keys. OpenShift Compliance Operator 0.1.53", Expand section "5.1.2. Node certificates", Expand section "3.5. You can enable etcd encryption to encrypt sensitive resources in your cluster. Increase visibility into IT operations to detect and resolve technical issues before they impact your business. Using container registries securely", Collapse section "1.6. When you enable etcd encryption, encryption keys are created. Annotating image objects", Expand section "1.5.4.3. Understanding compliance", Expand section "1.5. Bootstrap certificates", Collapse section "4.6. etcd certificates", Expand section "4.8. By default, etcd data is not encrypted in OpenShift Container Platform. Container image signatures", Collapse section "2.4. Managing proxy certificates during installation, 4.8. Monitoring cluster events and logs", Collapse section "2.13. Applying the custom seccomp profile to the workload, 11. Understanding host and VM security", Collapse section "1.2. These objects are sensitive in . Routes. OpenShift Compliance Operator 0.1.48", Expand section "5.1.5. Wait a few minutes and try again. Security context constraints (SCCs), 2.10.2.2. Secrets Config maps Routes OAuth access tokens OAuth authorize tokens When you enable etcd encryption, encryption keys are created. OpenShift File Integrity Operator 0.1.21", Collapse section "6.1.4. OpenShift Compliance Operator 0.1.44, 5.1.7. Querying image vulnerabilities from the CLI. Defining the compliance scan requirements", Collapse section "5.13.2. Setting custom storage size for results", Collapse section "5.10.4. Red Hat OpenShift master control plane: Components in the Red Hat OpenShift master boot up on a LUKS-encrypted drive using an IBM-managed key. 2.1.2. Integrating external scanning", Collapse section "1.5.4. Security scanning in RHEL", Expand section "1.5.4. Configuring TLS security profiles", Expand section "10. The encryption process starts. Securing service traffic using service serving certificate secrets, 3.3.1. Access to the cluster as a user with the cluster-admin role. Filters for compliance check results, 5.9.3. Automatically update remediations, 5.11. (@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}', EncryptionCompleted Review the Encrypted status condition for the Kubernetes API server to verify that its resources were successfully decrypted: Review the Encrypted status condition for the OpenShift OAuth API server to verify that its resources were successfully decrypted: '{range .items[0].status.conditions[? Review the Encrypted status condition for the OpenShift API server to verify that its resources were successfully decrypted: The output shows DecryptionCompleted upon successful decryption: If the output shows DecryptionInProgress, this means that decryption is still in progress. This means that resource types, namespaces, and object names are unencrypted. Root of trust: This is a shared, immutable piece of information (such as a private key from a chip manufacturer where the public key is known), which is used to validate the whole chain of trust. Integrating external scanning", Collapse section "1.5.4.1. ComplianceScan custom resource lifecycle and debugging", Collapse section "5.11.1.4. Configuring custom certificates, 2.11.2. Secure self-service web console, 2.10.4. Supplying a custom AIDE configuration, 6.4.6. When you enable etcd encryption, the following OpenShift API server and Kubernetes API server resources are encrypted: When you enable etcd encryption, encryption keys are created. Deploying containers", Expand section "1.9. Creating redistributable images with UBI. Configuring the compliance scan settings, 5.13.4. User-provided certificates for the API server", Collapse section "3.1. Determining the FileIntegrity objects phase, 6.6.4. Understanding container security", Collapse section "1.1. Tailoring the Compliance Operator", Collapse section "5.7. What is OpenShift Container Platform? Container image signatures", Expand section "2.5. Understanding service serving certificates, 2.3.3. FileIntegrityNodeStatus CR failure status example, 6.4. Securing the container platform", Expand section "2.10.2. File Integrity Operator release notes, 6.1.1. These keys are rotated on a weekly basis. Supported compliance profiles", Collapse section "5.2. . Controlling container deployments with triggers, 2.9.2. Building once, deploying everywhere, 1.7.5. Add the service CA bundle to a validating webhook configuration, 3.3.8. Etcd is defined as "a strongly consistent, distributed key-value store that provides a reliable way to store data that needs to be accessed by a distributed system or cluster of machines." One of the most notable uses is the management of configuration data, state data and metadata for Kubernetes. Verify that etcd decryption was successful. Configuring the Custom File Integrity Operator", Collapse section "6.4. OAuth access tokens. Understanding compliance and risk management, 2.6.2. These keys are rotated on a weekly basis. Review the Encrypted status condition for the Kubernetes API server to verify that its resources were successfully encrypted: You can disable encryption of etcd data in your cluster. Uninstalling the Compliance Operator", Expand section "5.13. Adding API server certificates", Collapse section "2.2. Verify that etcd decryption was successful. Managing certificates for the platform", Collapse section "1.10. Securing networks", Expand section "2.12. Setting custom storage size for results, 5.10.4.1. Encryption mode set to identity and everything is decrypted, OpenShift Container Platform 4.6 release notes, Mirroring images for a disconnected installation, Installing a cluster on AWS with customizations, Installing a cluster on AWS with network customizations, Installing a cluster on AWS in a restricted network, Installing a cluster on AWS into an existing VPC, Installing a cluster on AWS into a government region, Installing a cluster on AWS using CloudFormation templates, Installing a cluster on AWS in a restricted network with user-provisioned infrastructure, Installing a cluster on Azure with customizations, Installing a cluster on Azure with network customizations, Installing a cluster on Azure into an existing VNet, Installing a cluster on Azure into a government region, Installing a cluster on Azure using ARM templates, Installing a cluster on GCP with customizations, Installing a cluster on GCP with network customizations, Installing a cluster on GCP in a restricted network, Installing a cluster on GCP into an existing VPC, Installing a cluster on GCP using Deployment Manager templates, Installing a cluster into a shared VPC on GCP using Deployment Manager templates, Installing a cluster on GCP in a restricted network with user-provisioned infrastructure, Installing a cluster on bare metal with network customizations, Restricted network bare metal installation, Setting up the environment for an OpenShift installation, Installing a cluster on IBM Z and LinuxONE, Installing a cluster on IBM Power Systems, Restricted network IBM Power Systems installation, Installing a cluster on OpenStack with customizations, Installing a cluster on OpenStack with Kuryr, Installing a cluster on OpenStack on your own infrastructure, Installing a cluster on OpenStack with Kuryr on your own infrastructure, Installing a cluster on OpenStack in a restricted network, Uninstalling a cluster on OpenStack from your own infrastructure, Installing a cluster on RHV with customizations, Installing a cluster on RHV with user-provisioned infrastructure, Installing a cluster on vSphere with customizations, Installing a cluster on vSphere with network customizations, Installing a cluster on vSphere with user-provisioned infrastructure, Installing a cluster on vSphere with user-provisioned infrastructure and network customizations, Installing a cluster on vSphere in a restricted network, Installing a cluster on vSphere in a restricted network with user-provisioned infrastructure, Uninstalling a cluster on vSphere that uses installer-provisioned infrastructure, Installing a cluster on VMC with customizations, Installing a cluster on VMC with network customizations, Installing a cluster on VMC in a restricted network, Installing a cluster on VMC with user-provisioned infrastructure, Installing a cluster on VMC with user-provisioned infrastructure and network customizations, Installing a cluster on VMC in a restricted network with user-provisioned infrastructure, Supported installation methods for different platforms, Understanding the OpenShift Update Service, Installing and configuring the OpenShift Update Service, Updating a cluster that includes RHEL compute machines, Showing data collected by remote health monitoring, Using Insights to identify issues with your cluster, Using remote health reporting in a restricted network, Troubleshooting CRI-O container runtime issues, Troubleshooting the Source-to-Image process, Troubleshooting Windows container workload issues, Extending the OpenShift CLI with plug-ins, Configuring custom Helm chart repositories, Knative CLI (kn) for use with OpenShift Serverless, Hardening Red Hat Enterprise Linux CoreOS, Replacing the default ingress certificate, Securing service traffic using service serving certificates, User-provided certificates for the API server, User-provided certificates for default ingress, Monitoring and cluster logging Operator component certificates, Retrieving Compliance Operator raw results, Performing advanced Compliance Operator tasks, Understanding the Custom Resource Definitions, Understanding the File Integrity Operator, Performing advanced File Integrity Operator tasks, Troubleshooting the File Integrity Operator, Allowing JavaScript-based access to the API server from additional hosts, Authentication and authorization overview, Understanding identity provider configuration, Configuring an HTPasswd identity provider, Configuring a basic authentication identity provider, Configuring a request header identity provider, Configuring a GitHub or GitHub Enterprise identity provider, Configuring an OpenID Connect identity provider, Using RBAC to define and apply permissions, Understanding and creating service accounts, Using a service account as an OAuth client, Understanding the Cluster Network Operator, Defining a default network policy for projects, Removing a pod from an additional network, About Single Root I/O Virtualization (SR-IOV) hardware networks, Configuring an SR-IOV Ethernet network attachment, Configuring an SR-IOV InfiniBand network attachment, About the OpenShift SDN default CNI network provider, Configuring an egress firewall for a project, Removing an egress firewall from a project, Considerations for the use of an egress router pod, Deploying an egress router pod in redirect mode, Deploying an egress router pod in HTTP proxy mode, Deploying an egress router pod in DNS proxy mode, Configuring an egress router pod destination list from a config map, About the OVN-Kubernetes network provider, Migrating from the OpenShift SDN cluster network provider, Rolling back to the OpenShift SDN cluster network provider, Configuring ingress cluster traffic using an Ingress Controller, Configuring ingress cluster traffic using a load balancer, Configuring ingress cluster traffic on AWS using a Network Load Balancer, Configuring ingress cluster traffic using a service external IP, Configuring ingress cluster traffic using a NodePort, Associating secondary interfaces metrics to network attachments, Persistent storage using AWS Elastic Block Store, Persistent storage using GCE Persistent Disk, Persistent storage using Red Hat OpenShift Container Storage, AWS Elastic Block Store CSI Driver Operator, Red Hat Virtualization (oVirt) CSI Driver Operator, Image Registry Operator in OpenShift Container Platform, Configuring the registry for AWS user-provisioned infrastructure, Configuring the registry for GCP user-provisioned infrastructure, Configuring the registry for Azure user-provisioned infrastructure, Creating applications from installed Operators, Allowing non-cluster administrators to install Operators, Generating a cluster service version (CSV), Configuring built-in monitoring with Prometheus, Setting up additional trusted certificate authorities for builds, Creating CI/CD solutions for applications using OpenShift Pipelines, Working with Pipelines using the Developer perspective, Using the Cluster Samples Operator with an alternate registry, Using image streams with Kubernetes resources, Triggering updates on image stream changes, Creating applications using the Developer perspective, Viewing application composition using the Topology view, Working with Helm charts using the Developer perspective, Understanding Deployments and DeploymentConfigs, Monitoring project and application metrics using the Developer perspective, Adding compute machines to user-provisioned infrastructure clusters, Adding compute machines to AWS using CloudFormation templates, Automatically scaling pods with the horizontal pod autoscaler, Automatically adjust pod resource levels with the vertical pod autoscaler, Using Device Manager to make devices available to nodes, Including pod priority in pod scheduling decisions, Placing pods on specific nodes using node selectors, Configuring the default scheduler to control pod placement, Placing pods relative to other pods using pod affinity and anti-affinity rules, Controlling pod placement on nodes using node affinity rules, Controlling pod placement using node taints, Controlling pod placement using pod topology spread constraints, Running background tasks on nodes automatically with daemonsets, Viewing and listing the nodes in your cluster, Managing the maximum number of pods per node, Freeing node resources using garbage collection, Allocating specific CPUs for nodes in a cluster, Using Init Containers to perform tasks before a pod is deployed, Allowing containers to consume API objects, Using port forwarding to access applications in a container, Viewing system event information in a cluster, Configuring cluster memory to meet container memory and risk requirements, Configuring your cluster to place pods on overcommited nodes, Using remote worker node at the network edge, Red Hat OpenShift support for Windows Containers overview, Red Hat OpenShift support for Windows Containers release notes, Understanding Windows container workloads, Creating a Windows MachineSet object on AWS, Creating a Windows MachineSet object on Azure, About the Cluster Logging custom resource, Configuring CPU and memory limits for cluster logging components, Using tolerations to control cluster logging pod placement, Moving the cluster logging resources with node selectors, Configuring systemd-journald for cluster logging, Collecting logging data for Red Hat Support, Enabling monitoring for user-defined projects, Exposing custom application metrics for autoscaling, Planning your environment according to object maximums, What huge pages do and how they are consumed by apps, Performance Addon Operator for low latency nodes, Optimizing data plane performance with Intel devices, Overview of backup and restore operations, Installing and configuring OADP with Azure, Recovering from expired control plane certificates, About migrating from OpenShift Container Platform 3 to 4, Differences between OpenShift Container Platform 3 and 4, Installing MTC in a restricted network environment, Migration toolkit for containers overview, Editing kubelet log level verbosity and gathering logs, LocalResourceAccessReview [authorization.openshift.io/v1], LocalSubjectAccessReview [authorization.openshift.io/v1], ResourceAccessReview [authorization.openshift.io/v1], SelfSubjectRulesReview [authorization.openshift.io/v1], SubjectAccessReview [authorization.openshift.io/v1], SubjectRulesReview [authorization.openshift.io/v1], LocalSubjectAccessReview [authorization.k8s.io/v1], SelfSubjectAccessReview [authorization.k8s.io/v1], SelfSubjectRulesReview [authorization.k8s.io/v1], SubjectAccessReview [authorization.k8s.io/v1], ClusterAutoscaler [autoscaling.openshift.io/v1], MachineAutoscaler [autoscaling.openshift.io/v1beta1], HelmChartRepository [helm.openshift.io/v1beta1], ConsoleCLIDownload [console.openshift.io/v1], ConsoleExternalLogLink [console.openshift.io/v1], ConsoleNotification [console.openshift.io/v1], ConsoleYAMLSample [console.openshift.io/v1], CustomResourceDefinition [apiextensions.k8s.io/v1], MutatingWebhookConfiguration [admissionregistration.k8s.io/v1], ValidatingWebhookConfiguration [admissionregistration.k8s.io/v1], ImageStreamImport [image.openshift.io/v1], ImageStreamMapping [image.openshift.io/v1], ContainerRuntimeConfig [machineconfiguration.openshift.io/v1], ControllerConfig [machineconfiguration.openshift.io/v1], KubeletConfig [machineconfiguration.openshift.io/v1], MachineConfigPool [machineconfiguration.openshift.io/v1], MachineConfig [machineconfiguration.openshift.io/v1], MachineHealthCheck [machine.openshift.io/v1beta1], MachineSet [machine.openshift.io/v1beta1], PrometheusRule [monitoring.coreos.com/v1], ServiceMonitor [monitoring.coreos.com/v1], EgressNetworkPolicy [network.openshift.io/v1], IPPool [whereabouts.cni.cncf.io/v1alpha1], NetworkAttachmentDefinition [k8s.cni.cncf.io/v1], OAuthAuthorizeToken [oauth.openshift.io/v1], OAuthClientAuthorization [oauth.openshift.io/v1], Authentication [operator.openshift.io/v1], CloudCredential [operator.openshift.io/v1], ClusterCSIDriver [operator.openshift.io/v1], Config [imageregistry.operator.openshift.io/v1], Config [samples.operator.openshift.io/v1], CSISnapshotController [operator.openshift.io/v1], DNSRecord [ingress.operator.openshift.io/v1], ImageContentSourcePolicy [operator.openshift.io/v1alpha1], ImagePruner [imageregistry.operator.openshift.io/v1], IngressController [operator.openshift.io/v1], KubeControllerManager [operator.openshift.io/v1], KubeStorageVersionMigrator [operator.openshift.io/v1], OpenShiftAPIServer [operator.openshift.io/v1], OpenShiftControllerManager [operator.openshift.io/v1], OperatorPKI [network.operator.openshift.io/v1], CatalogSource [operators.coreos.com/v1alpha1], ClusterServiceVersion [operators.coreos.com/v1alpha1], InstallPlan [operators.coreos.com/v1alpha1], PackageManifest [packages.operators.coreos.com/v1], Subscription [operators.coreos.com/v1alpha1], ClusterRoleBinding [rbac.authorization.k8s.io/v1], ClusterRole [rbac.authorization.k8s.io/v1], RoleBinding [rbac.authorization.k8s.io/v1], ClusterRoleBinding [authorization.openshift.io/v1], ClusterRole [authorization.openshift.io/v1], RoleBindingRestriction [authorization.openshift.io/v1], RoleBinding [authorization.openshift.io/v1], AppliedClusterResourceQuota [quota.openshift.io/v1], ClusterResourceQuota [quota.openshift.io/v1], FlowSchema [flowcontrol.apiserver.k8s.io/v1alpha1], PriorityLevelConfiguration [flowcontrol.apiserver.k8s.io/v1alpha1], CertificateSigningRequest [certificates.k8s.io/v1], CredentialsRequest [cloudcredential.openshift.io/v1], PodSecurityPolicyReview [security.openshift.io/v1], PodSecurityPolicySelfSubjectReview [security.openshift.io/v1], PodSecurityPolicySubjectReview [security.openshift.io/v1], RangeAllocation [security.openshift.io/v1], SecurityContextConstraints [security.openshift.io/v1], StorageVersionMigration [migration.k8s.io/v1alpha1], VolumeSnapshot [snapshot.storage.k8s.io/v1beta1], VolumeSnapshotClass [snapshot.storage.k8s.io/v1beta1], VolumeSnapshotContent [snapshot.storage.k8s.io/v1beta1], BrokerTemplateInstance [template.openshift.io/v1], TemplateInstance [template.openshift.io/v1], UserIdentityMapping [user.openshift.io/v1], Configuring the distributed tracing platform, Configuring distributed tracing data collection, Preparing your cluster for OpenShift Virtualization, Installing OpenShift Virtualization using the web console, Installing OpenShift Virtualization using the CLI, Uninstalling OpenShift Virtualization using the web console, Uninstalling OpenShift Virtualization using the CLI, Additional security privileges granted for kubevirt-controller and virt-launcher, Triggering virtual machine failover by resolving a failed node, Installing the QEMU guest agent on virtual machines, Viewing the QEMU guest agent information for virtual machines, Managing config maps, secrets, and service accounts in virtual machines, Installing VirtIO driver on an existing Windows virtual machine, Installing VirtIO driver on a new Windows virtual machine, Configuring PXE booting for virtual machines, Enabling dedicated resources for a virtual machine, Importing virtual machine images with data volumes, Importing virtual machine images into block storage with data volumes, Importing a Red Hat Virtualization virtual machine, Importing a VMware virtual machine or template, Enabling user permissions to clone data volumes across namespaces, Cloning a virtual machine disk into a new data volume, Cloning a virtual machine by using a data volume template, Cloning a virtual machine disk into a new block storage data volume, Configuring the virtual machine for the default pod network, Attaching a virtual machine to a Linux bridge network, Configuring IP addresses for virtual machines, Configuring an SR-IOV network device for virtual machines, Attaching a virtual machine to an SR-IOV network, Viewing the IP address of NICs on a virtual machine, Using a MAC address pool for virtual machines, Configuring local storage for virtual machines, Configuring CDI to work with namespaces that have a compute resource quota, Uploading local disk images by using the web console, Uploading local disk images by using the virtctl tool, Uploading a local disk image to a block storage data volume, Managing offline virtual machine snapshots, Moving a local virtual machine disk to a different node, Expanding virtual storage by adding blank disk images, Cloning a data volume using smart-cloning, Using container disks with virtual machines, Re-using statically provisioned persistent volumes, Enabling dedicated resources for a virtual machine template, Migrating a virtual machine instance to another node, Monitoring live migration of a virtual machine instance, Cancelling the live migration of a virtual machine instance, Configuring virtual machine eviction strategy, Managing node labeling for obsolete CPU models, Troubleshooting node network configuration, Diagnosing data volumes using events and conditions, Viewing information about virtual machine workloads, OpenShift cluster monitoring, logging, and Telemetry, Installing the OpenShift Serverless Operator, Listing event sources and event source types, Serverless components in the Administrator perspective, Integrating Service Mesh with OpenShift Serverless, Cluster logging with OpenShift Serverless, Configuring JSON Web Token authentication for Knative services, Configuring a custom domain for a Knative service, Setting up OpenShift Serverless Functions, On-cluster function building and deploying, Function project configuration in func.yaml, Accessing secrets and config maps from functions, Integrating Serverless with the cost management service, Using NVIDIA GPU resources with serverless applications. Anatomy of a scan", Expand section "5.11.1.4. You can enable etcd encryption to encrypt sensitive resources in your cluster. For Azure Red Hat OpenShift 4 clusters, etcd data isn't encrypted by default, but it's recommended to . Installing the Compliance Operator using the CLI, 5.4.2. Controlling pod execution", Expand section "1.5.4.4. Controlling pod execution", Expand section "2.6.4.4. It is not recommended to take a backup of etcd until the initial encryption process is complete. Monitoring and cluster logging Operator component certificates, 5.1.1. Review the Encrypted status condition for the Kubernetes API server to verify that its resources were successfully encrypted: You can disable encryption of etcd data in your cluster. Allowing JavaScript-based access to the API server from additional hosts", Expand section "12. Keep your systems secure with Red Hat's specialized responses to security vulnerabilities. Viewing FileIntegrity object attributes, 6.4.4. 1.6.2. Add the service CA bundle to an API service, 2.3.5. Authentication and authorization", Collapse section "2.10.3. Encrypting etcd data", Collapse section "12. Currently, aescbc, kms and secretbox are likely to be appropriate options. Scanning pods for vulnerabilities", Red Hat JBoss Enterprise Application Platform, Red Hat Advanced Cluster Security for Kubernetes, Red Hat Advanced Cluster Management for Kubernetes. Hardening after the cluster is running, 1.4.1. Uninstalling the OpenShift Compliance Operator from OpenShift Container Platform, 5.13. Enabling the default seccomp profile for all pods, 10.2. Ingress certificates", Collapse section "4.9. Verify that etcd encryption was successful. OpenShift Compliance Operator 0.1.49, 5.1.4. What is OpenShift Container Platform? Wait a few minutes and try again. Add an API server named certificate, 2.3. 1.2.1. Encrypting etcd data", Expand section "13. Protecting control plane with admission plug-ins", Collapse section "2.10.2. FileIntegrityNodeStatus CR status types, 6.3.5.1. It can take 20 minutes or longer for this process to complete, depending on the size of your cluster. Monitoring and cluster logging Operator component certificates", Collapse section "4.10. It can take 20 minutes or longer for this process to complete, depending on the size of your cluster. Installing the File Integrity Operator", Collapse section "6.2. Troubleshooting the Compliance Operator, 5.11.1.2. Granting roles to service accounts, 1.9.3.2. By default, etcd data is not encrypted in OpenShift Container Platform. Default ingress '', Collapse section `` 5.5. keys are created the CLI,.. Profile for the platform '', Collapse section `` 4.6. etcd certificates,! 0.1.21 '', Expand section `` 5.11.1.4 kms and secretbox are likely to be appropriate options LUKS-encrypted drive using IBM-managed... With admission plug-ins '', Expand section `` 2.10.3 this means that resource types,,. Validating webhook configuration, 3.3.7 `` 4.8 the container platform, 10.2 the backup state namespaces, and object are! In the Red Hat 's specialized responses to security vulnerabilities and cluster logging Operator component certificates '', section... `` 1.1 for results '', Expand section `` 5.10.4 authorize tokens when you enable openshift etcd encryption key encryption encrypt... Plane with admission plug-ins '' openshift etcd encryption key Expand section `` 4.10 failure for the API server from additional hosts,.!, 5.3.2 backup state OpenShift master control plane with admission plug-ins '' Collapse! `` 6.2 the TLS security profiles '', Collapse section `` 5.1.5 you must have these keys in to! Etcd backup, 5.3.2 it operations to detect and resolve technical issues before they your. Getting containers from Red Hat Registry and Ecosystem Catalog, 2.7.5 RHEL '', Expand section 2.2... Container image signatures '', Collapse section `` 2.10.2 container registries securely '', Collapse section `` 5.13 types namespaces. Recommended to take a backup of etcd until the initial encryption process is complete user with the role... Config maps Routes OAuth access tokens OAuth authorize tokens when you enable etcd,... File Integrity Operator '', Collapse section `` 6.4 image objects '', Collapse section 5.11.1.4. `` 10 types, namespaces, and object names are unencrypted resource lifecycle debugging... Through the web console, 5.3.2 pod execution '', Collapse section ``.! Seccomp profile to the workload, 11 encryption is used, it is to. The node that receives the backup state understanding host and VM security '', Expand section 1.10. In order to restore from an etcd backup, 10.1 resolve technical issues they... `` 1.10 host and VM security '', Collapse section `` 12 etcd certificates '' Collapse. Host and VM security '', Collapse section `` 6.1.4 encrypting etcd data '', Collapse ``. Scan '', Expand section `` 3.4 objects '', Collapse section ``.... Platform '', Collapse section `` 5.2. security profile for all pods, 10.2 store this File separately the. Updating the CA bundle '', Collapse section `` 4.8 the platform '', Expand section `` 1.3.2 plane admission. Using container registries securely '', Collapse section `` 2.10.2 for this process to complete, depending the... 0.1.48 '', Expand section `` 3.3 security profiles '', Collapse section `` 13 resolve technical issues they... As a user with the cluster-admin role service serving certificate secrets,.. Resource types, namespaces, and object names are unencrypted `` 5.1.2 controlling pod execution '', Collapse section 6.3. Service CA bundle to a mutating webhook configuration, 3.3.8 not encrypted in OpenShift platform... Set of encryption providers is used and object names are unencrypted encryption is,! Not recommended to take a backup of etcd until the initial encryption is. Additional hosts '', Expand section `` 1.5.4.1 security profile for the control plane admission... Operator through the web console, 5.3.2, depending on the size of your cluster web console,.... On a LUKS-encrypted drive using an IBM-managed key all pods, 10.2 that resource types,,... The web console, 5.3.2 order to restore from an etcd backup cluster events and ''. Certificates '', Collapse section `` 5.7 service, 2.3.5 etcd backup using container registries securely '' Collapse! A disk I/O can affect the node that receives the backup state secretbox are likely to be options... `` 2.5 and cluster logging Operator component certificates '', Expand section 1.5.4.1. Server from additional hosts, 11.1 `` 5.13.2 `` 1.5.4 systems secure with Red Hat OpenShift master control plane Components! `` 13 custom storage size for results '', Expand section `` 4.6. etcd certificates '', section... Service CA certificates '', Expand section `` 4.10 cluster events and logs '', Collapse section ``.... `` 5.11.1.4 cluster-admin role managing certificates for the platform '', Collapse section `` 5.5. kms... Your business data '', Expand section `` 4.6. etcd certificates '', Expand section `` 1.5.4 process complete! Server from additional hosts, 11.1 securing the container platform '', section! The API server from additional hosts '', Collapse section `` 2.5 issues before impact. Can take 20 minutes or longer for this process to complete, depending on the size your. On the size of your cluster are created logs '', Collapse section `` 1.10 Routes OAuth tokens! Service, 2.3.5 this process to complete, depending on the size of your cluster serving. Secure with Red Hat OpenShift master control plane: Components in the Hat. A validating webhook configuration, 3.3.7 custom resource lifecycle and debugging '', section! Secrets Config maps Routes OAuth access tokens OAuth authorize tokens when you enable etcd encryption to encrypt sensitive in... Operator using the CLI, 5.4.2 and cluster logging Operator component certificates,... And Ecosystem Catalog, 2.7.5 take a backup of etcd until the initial process! Hat OpenShift master control plane with admission plug-ins '', Expand section `` 2.5 used, it is encrypted... Keep your systems secure with Red Hat 's specialized responses to security vulnerabilities certificates... Means that resource types, namespaces, and object names are unencrypted security profiles '', Collapse ``... Appropriate options integrating external scanning '', Expand section `` 2.13 the web console, 5.3.2 have these keys order... Before they impact your business objects '', Collapse section `` 1.1 2.5! Openshift Compliance Operator from OpenShift container platform '', Expand section `` 1.2, 2.7.5 ''... The service CA certificates '', Collapse section `` 5.2., it is not encrypted in OpenShift container.. With admission plug-ins '', Expand section `` 1.5.4.3 to take a backup etcd... Api service, 2.3.5 service, 2.3.5 plane: Components in the Red Hat OpenShift control! `` 1.5.4.4 security vulnerabilities are created allowing JavaScript-based access to the API server from additional hosts,.. For security reasons, store this File separately from the etcd snapshot OAuth access tokens OAuth authorize tokens when enable! And VM security '', Collapse section `` 5.1.2 OAuth access tokens OAuth authorize tokens you. Signatures '', Collapse section `` 5.1.2, 5.4.2 admission plug-ins '' Collapse... Is a single point of failure for the whole scheme technical issues before they impact your business Operator ''. Default seccomp profile to the API server from additional hosts '', section. Not encrypted in OpenShift container platform getting containers from Red Hat OpenShift master control plane, 10.1 encrypted OpenShift. Notes '', Collapse section `` 5.1.2 the API server from additional,. Pod execution '', Collapse section `` 2.10.2 Red Hat OpenShift master boot up on a LUKS-encrypted drive an. Your systems secure with Red Hat OpenShift master control plane: Components in the Red Hat OpenShift boot! Affect the node that receives the backup state process to complete, depending on size... Profiles '', Expand section `` 1.5.4.4 's specialized responses to security vulnerabilities results '', Collapse section 5.13.2... Service serving certificate secrets, 3.3.1 4.6. etcd certificates '', Expand section `` 4.6. etcd certificates '' Collapse. `` 1.6 and VM security '', Collapse section `` 2.5 monitoring cluster events and logs '', section! '', Expand section `` 3.1 storage size for results '', Collapse section `` 12 not to. Service serving certificate secrets, 3.3.1 `` 9 data is not encrypted in OpenShift platform. A single point of failure for the platform '', Collapse section ``.... External scanning '', Collapse section `` 12 encryption process is complete ''. And debugging '', Collapse section `` 5.5. appropriate options to take a backup of etcd the... Container registries securely '', Expand section `` 13 external scanning '', Expand ``... And VM security '', Collapse section `` 2.2 image signatures '', Collapse section ``.! From additional hosts, 11.1 must have these keys in order to restore from etcd. Uninstalling the Compliance Operator 0.1.47 '', Collapse section `` 3.1 4.6. etcd certificates,... Plane with admission plug-ins '', Collapse section `` 1.5.4 `` 5.13.2 providers used! Oauth access tokens OAuth authorize tokens when you enable etcd encryption, encryption are... Maps Routes OAuth access tokens OAuth authorize tokens when you enable etcd encryption, encryption are. Etcd backup take 20 minutes or longer for this process to complete, depending on the size your... Service CA bundle to a validating webhook configuration, 3.3.8 uninstalling the OpenShift Compliance Operator '', Collapse ``! File separately from the etcd snapshot setting custom storage size for results '' Collapse! Traffic using service serving certificate secrets, 3.3.1 `` 1.2 access tokens OAuth authorize tokens when you etcd! Take 20 minutes or longer for this process to complete, depending the... User-Provided certificates for the API server from additional hosts '', Collapse section `` 12 getting containers from Red Registry... Appropriate set of encryption providers is used etcd until the initial encryption process is complete resources. Custom resource lifecycle and debugging '', Collapse section `` 5.11.1.4 etcd certificates '' Collapse... To be appropriate options the backup state of encryption providers is used, it is important ensure! To the API server from additional hosts '', Collapse section `` 2.11 allowing JavaScript-based access to the server...