Azure Key Vault

Portworx can integrate with Azure Key Vault Secrets to store your encryption secrets, credentials or passwords. This guide will get a Portworx cluster connected to a Azure Key Vault. The Azure Key Vault could be used to store secrets that will be used for encrypting volumes.

Setting up Azure Key Vault

Peruse Create a key vault using the Azure portal offical docs for help on setting up Azure Key Vault in your setup.

Once, the Azure Key Vault is setup you will also require to register and authenticate the application which will allow application to perform operations and permission on Azure Key Vault.

Register Azure application in Azure AD

Follow Registering an application with Microsoft Entra ID doc for help on registering application with azure active directory. There are multiple ways to do it, azure cli to directlly from the portal.

For example, you can register application using following command.

note

Make you have az cli installed and have access to Azure.

az ad sp create-for-rbac -n "<you_application_name>" --role Contributor --scopes /subscriptions/<subscription id>
# If you don't specify a password, one will be created for you.

Creating 'Contributor' role assignment under scope '/subscriptions/<subscription id>'
The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli
{
  "appId": "xxxxxxxx-63xx-4axx-86xx-xxxd9ad33xxx",
  "displayName": "<you_application_name>",
  "password": "_5j8Q~-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxdhY",
  "tenant": "xxxxxxxx-f4b7-xxxx-bexx-773895b9xxxx"
}

Granting permission to the Azure application

Portworx will need application that has Azure Key Vault set/get/list/delete secrets permissions.

Please follow Authorizing an application to use a key or secret doc for help on granting Azure Key Vault permission to your registered app.

For example

az keyvault set-policy --name "<policy_name>" --spn <registered app ID> --key-permissions set get list delete

Authentication details for Portworx

Following are the authentication details required by Portworx to connect Azure Key Vault -

• AZURE_VAULT_URL: Azure Key Vault URL
• AZURE_TENANT_ID: Azure Active Directory ID
• AZURE_CLIENT_ID: Azure application ID which is registered with Azure active directory and has access to azure key vault mentioned in AZURE_VAULT_URL
• AZURE_CLIENT_SECRET: Azure application secret id, you may need to generate one if not created already. Follow doc to generate new secret key for your application
• AZURE_ENVIRONMENT(optional): Azure environment or az cloud list. Default cloud name is AzurePublicCloud.

note

You can retrieve the value of the AZURE_ENVIRONMENT variable by entering the following command:

az account show | jq '.environmentName'

Kubernetes users

If you are installing Portworx on Kubernetes, when generating the Portworx Kubernetes spec file from the Portworx spec generator page in Portworx Central:

1. Pass in all the above variables as is in the Environment Variables section.
2. Select Azure Key Vault from the Secrets Store Type list under Advanced Settings

To generate Portworx spec for Kubernetes, refer instructions, click here.

Other users

New installation

During installation,

1. Use argument -secret_type azure-kv -cluster_secret_key <secret-id> when starting Portworx to specify the secret type as vault and the cluster-wide secret key.
2. Use -e docker option to expose the Azure Key Vault environment variables.

Existing installation

Based on your installation method provide the -secret_type azure-kv input argument and environment variable and restart Portworx on all the nodes.

note

• Portworx supports only the Azure KeyVault Secrets

• Portworx does not support Azure KeyVault Keys soft/hard.

Setting cluster wide secret key

A cluster wide secret key is a common key that can be used to encrypt all your volumes. You can set the cluster secret key using the following command.

/opt/pwx/bin/pxctl secrets set-cluster-key --secret <cluster-wide-secret-key>

This command needs to be run just once for the cluster. If you have added the cluster secret key through the config.json, the above command will overwrite it. Even on subsequent Portworx restarts, the cluster secret key in config.json will be ignored for the one set through the CLI.

important

Make sure that the secret key has been created in Azure Key Vault Secrets.