Encryption: Avoid frequent calls to CCR to get master key. about noobaa-core

[guymguym]

Note that with IAM api this will not be an issue - as it will be possible to submit many accounts create calls without forking many cli processes, and master keys will be cached in endpoint memory. Just saying 😉

[romayalon]

@madhuthorat @nimrod-becker @guymguym As mentioned on Slack, the suggested solution was adding a cache in the fget/fput scripts that should be handled on GPFS side. For more details please check the slack thread.

[guymguym]

@madhuthorat we support calling a script - that script can use keyctl inside as needed. closing as this will not be included in noobaa for now.

[madhuthorat]

@madhuthorat we support calling a script - that script can use keyctl inside as needed. closing as this will not be included in noobaa for now.

@guymguym we will check the keyctl option. Caching in GPFS file systems won't help as key will be readable in plain text, hence that option is not being considered. I am considering 2 options:

1. Use keyctl
2. Cache key with mms3 binary if not already cached, and refresh it periodically. And use a mms3 (hide) interface inside the executable script to get the key.

[guymguym]

@madhuthorat we might want to consider integrating with external KMS such as Vault. We designed the master keys scripts interface to be suitable for that as well, but the question is if local caching is needed also for external kms cases...

[madhuthorat]

@madhuthorat we might want to consider integrating with external KMS such as Vault. We designed the master keys scripts interface to be suitable for that as well, but the question is if local caching is needed also for external kms cases...

@guymguym In our documentation, we are going to describe that customers would be able to rewrite our scripts or have their own scripts where they can decide how to use keys with external KMS. But if they don't have support for external KMS then they can rely on what we provide.