Azure Key Vault


Portworx can integrate with Azure Key Vault Secrets to store your encryption secrets, credentials or passwords. This guide will get a Portworx cluster connected to a Azure Key Vault. The Azure Key Vault could be used to store secrets that will be used for encrypting volumes.

Setting up Azure Key Vault

Peruse this section for help on setting up Azure Key Vault in your setup. You will also require to register and authenticate application with Azure Key Vault.

  • Please follow doc to register application with azure active directory
  • Please follow doc to grant Azure Key Vault permission to your registered app.

Portworx will need application that has Azure Key Vault set/get/list/delete secrets permissions.

Following are the authentication details required by Portworx to connect Azure Key Vault -

  • AZURE_VAULT_URL: Azure Key Vault URL
  • AZURE_TENANT_ID: Azure Active Directory ID
  • AZURE_CLIENT_ID: Azure application ID which is registered with Azure active directory and has access to azure key vault mentioned in AZURE_VAULT_URL
  • AZURE_CLIENT_SECRET: Azure application secret id, you may need to generate one if not created already. Follow doc to generate new secret key for your application
  • AZURE_ENVIRONMENT(optional): Azure environment or cloudname. Default cloud name is AzurePublicCloud

Kubernetes users

If you are installing Portworx on Kubernetes, when generating the Portworx Kubernetes spec file:

  1. Pass in all the above variables as is in the Environment Variables section.
  2. Select Azure Key Vault from the Secrets Store Type list under Advanced Settings

To generate Portworx spec for Kubernetes, refer instructions, click here.

Other users

New installation

During installation,

  1. Use argument -secret_type azure-kv -cluster_secret_key <secret-id> when starting Portworx to specify the secret type as vault and the cluster-wide secret key.
  2. Use -e docker option to expose the Azure Key Vault enviornment variables.

Existing installation

Based on your installation method provide the -secret_type azure-kv input argument and environment variable and restart PX on all the nodes.

Note:
Portworx supports only the Azure KeyVault Secrets
Portworx does not support Azure KeyVault Keys soft/hard

Setting cluster wide secret key

A cluster wide secret key is a common key that can be used to encrypt all your volumes. You can set the cluster secret key using the following command.

/opt/pwx/bin/pxctl secrets set-cluster-key --secret <cluster-wide-secret-key>

This command needs to be run just once for the cluster. If you have added the cluster secret key through the config.json, the above command will overwrite it. Even on subsequent Portworx restarts, the cluster secret key in config.json will be ignored for the one set through the CLI.

Important: Make sure that the secret key has been created in Azure Key Vault Secrets.

Last edited: Tuesday, Mar 12, 2019