https://openbao.org/assets/js/23750d59.ced54945.js

1"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([["10341"],{62227(e,n,i){i.r(n),i.d(n,{metadata:()=>l,default:()=>h,frontMatter:()=>t,contentTitle:()=>c,toc:()=>a,assets:()=>r});var l=JSON.parse('{"id":"configuration/seal/tcloudpublic","title":"tcloudpublic seal","description":"The T Cloud Public KMS seal configures OpenBao to use T Cloud Public KMS as\\nthe seal wrapping mechanism.","source":"@site/versioned_docs/version-2.6.x/configuration/seal/tcloudpublic.mdx","sourceDirName":"configuration/seal","slug":"/configuration/seal/tcloudpublic","permalink":"/docs/2.6.x/configuration/seal/tcloudpublic","draft":false,"unlisted":false,"editUrl":"https://github.com/openbao/openbao/blob/release/2.6.x/website/content/docs/configuration/seal/tcloudpublic.mdx","tags":[],"version":"2.6.x","frontMatter":{"sidebar_label":"T Cloud Public KMS","description":"The T Cloud Public KMS seal configures OpenBao to use T Cloud Public KMS as\\nthe seal wrapping mechanism."},"sidebar":"docs","previous":{"title":"Static Key","permalink":"/docs/2.6.x/configuration/seal/static"},"next":{"title":"OpenBao Transit","permalink":"/docs/2.6.x/configuration/seal/transit"}}'),s=i(94686),o=i(44812);let t={sidebar_label:"T Cloud Public KMS",description:"The T Cloud Public KMS seal configures OpenBao to use T Cloud Public KMS as\nthe seal wrapping mechanism."},c="tcloudpublic seal",r={},a=[{value:"<code>tcloudpublic</code> example",id:"tcloudpublic-example",level:2},{value:"<code>tcloudpublic</code> parameters",id:"tcloudpublic-parameters",level:2},{value:"Authentication",id:"authentication",level:2},{value:"<code>tcloudpublic</code> environment variables",id:"tcloudpublic-environment-variables",level:2},{value:"Key rotation",id:"key-rotation",level:2}];function d(e){let n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.header,{children:(0,s.jsxs)(n.h1,{id:"tcloudpublic-seal",children:[(0,s.jsx)(n.code,{children:"tcloudpublic"})," seal"]})}),"\n",(0,s.jsx)(n.admonition,{type:"info",children:(0,s.jsxs)(n.p,{children:["This seal is available as an external KMS provider plugin in the\n",(0,s.jsx)(n.a,{href:"https://github.com/openbao/openbao-plugins",children:"openbao-plugins"})," plugin\ncollection. For more information on Auto Unseal plugins, see the ",(0,s.jsx)(n.a,{href:"/docs/2.6.x/configuration/seal/#plugins",children:"overview\nsection"}),"."]})}),"\n",(0,s.jsx)(n.p,{children:"The T Cloud Public KMS seal configures OpenBao to use T Cloud Public KMS as the\nseal wrapping mechanism. The T Cloud Public KMS seal is activated by one of the\nfollowing:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["The presence of a ",(0,s.jsx)(n.code,{children:'seal "tcloudpublic"'})," block in OpenBao's configuration\nfile."]}),"\n",(0,s.jsxs)(n.li,{children:["The presence of the environment variable ",(0,s.jsx)(n.code,{children:"BAO_SEAL_TYPE"})," set to\n",(0,s.jsx)(n.code,{children:"tcloudpublic"}),". If enabling via environment variable, all other required\nvalues specific to T Cloud Public KMS (i.e. ",(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_KMS_KEY_ID"}),", etc.)\nmust also be supplied, as well as all other T Cloud Public-related\nenvironment variables required for successful authentication."]}),"\n"]}),"\n",(0,s.jsxs)(n.h2,{id:"tcloudpublic-example",children:[(0,s.jsx)(n.code,{children:"tcloudpublic"})," example"]}),"\n",(0,s.jsx)(n.p,{children:"This example shows how to configure the T Cloud Public KMS seal through the\nOpenBao configuration file:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-hcl",children:'seal "tcloudpublic" {\n  key_id            = "00000000-0000-0000-0000-000000000000"\n  access_key        = "access-key-example"\n  secret_key        = "secret-key-example"\n}\n'})}),"\n",(0,s.jsxs)(n.h2,{id:"tcloudpublic-parameters",children:[(0,s.jsx)(n.code,{children:"tcloudpublic"})," parameters"]}),"\n",(0,s.jsxs)(n.p,{children:["These parameters apply to the ",(0,s.jsx)(n.code,{children:"seal"})," stanza in the OpenBao configuration file.\nWhen a value is provided both in the configuration file and through an\nenvironment variable, the environment variable takes precedence."]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.code,{children:"key_id"})," ",(0,s.jsx)(n.code,{children:"(string: <required>)"}),": The T Cloud Public KMS key ID to use for\nencryption. May also be specified by the ",(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_KMS_KEY_ID"})," environment\nvariable."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.code,{children:"region"})," ",(0,s.jsx)(n.code,{children:'(string: "eu-de")'}),": The T Cloud Public region where the encryption\nkey lives. May also be specified by the ",(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_REGION"})," environment\nvariable."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.code,{children:"project"})," ",(0,s.jsx)(n.code,{children:'(string: "")'}),": The T Cloud Public project scope to use. May also be\nspecified by the ",(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_PROJECT"})," environment variable. If not set, the\nglobal KMS endpoint is used."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.code,{children:"access_key"})," ",(0,s.jsx)(n.code,{children:"(string: <required>)"}),": The T Cloud Public access key to use for\nauthentication. May also be specified by the ",(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_ACCESS_KEY"}),"\nenvironment variable."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.code,{children:"secret_key"})," ",(0,s.jsx)(n.code,{children:"(string: <required>)"}),": The T Cloud Public secret key to use for\nauthentication. May also be specified by the ",(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_SECRET_KEY"}),"\nenvironment variable."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.code,{children:"identity_endpoint"})," ",(0,s.jsx)(n.code,{children:'(string: "https://iam.eu-de.otc.t-systems.com:443/v3")'}),":\nThe T Cloud Public IAM identity endpoint to use for authentication. May also\nbe specified by the ",(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_IDENTITY_ENDPOINT"})," environment variable."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.code,{children:"disabled"})," ",(0,s.jsx)(n.code,{children:'(string: "")'}),": Set this to ",(0,s.jsx)(n.code,{children:"true"})," if OpenBao is migrating from an auto seal configuration. Otherwise, set to ",(0,s.jsx)(n.code,{children:"false"}),"."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["Refer to the ",(0,s.jsx)(n.a,{href:"/docs/2.6.x/concepts/seal#seal-migration",children:"Seal Migration"})," documentation for more information about the seal migration process."]}),"\n",(0,s.jsx)(n.h2,{id:"authentication",children:"Authentication"}),"\n",(0,s.jsx)(n.p,{children:"Authentication-related values must be provided, either as environment variables\nor as configuration parameters. The wrapper authenticates to T Cloud Public IAM\nusing access key and secret key credentials."}),"\n",(0,s.jsx)(n.admonition,{type:"warning",children:(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Note:"})," Although the configuration file allows you to pass in ",(0,s.jsx)(n.code,{children:"access_key"})," and\n",(0,s.jsx)(n.code,{children:"secret_key"})," as part of the seal's parameters, it is ",(0,s.jsx)(n.em,{children:"strongly"})," recommended to\nset these values via environment variables."]})}),"\n",(0,s.jsx)(n.p,{children:"T Cloud Public authentication values:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_ACCESS_KEY"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_SECRET_KEY"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_REGION"})}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"Optional T Cloud Public authentication values:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_PROJECT"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"TCLOUDPUBLIC_IDENTITY_ENDPOINT"})}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"OpenBao needs the following permission on the KMS key:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"kms:cmk:crypto"})}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"This can be granted via IAM permissions at the project level or with Enterprise\nProject Service on the principal that OpenBao uses for T Cloud Public KMS."}),"\n",(0,s.jsxs)(n.h2,{id:"tcloudpublic-environment-variables",children:[(0,s.jsx)(n.code,{children:"tcloudpublic"})," environment variables"]}),"\n",(0,s.jsx)(n.p,{children:"Alternatively, the T Cloud Public KMS seal can be activated by providing the\nfollowing environment variables."}),"\n",(0,s.jsx)(n.p,{children:"OpenBao Seal specific values:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"BAO_SEAL_TYPE"})}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"Provider-specific environment variables are documented with their corresponding\nconfiguration parameters above."}),"\n",(0,s.jsx)(n.h2,{id:"key-rotation",children:"Key rotation"}),"\n",(0,s.jsxs)(n.p,{children:["This seal supports key aliases and ke

1y rotation. Encryption uses the configured\n",(0,s.jsx)(n.code,{children:"key_id"}),", which allows T Cloud Public KMS to resolve an alias to the current key.\nThe resolved key ID returned by KMS is stored with the encrypted data, and\ndecryption uses the metadata stored with that encrypted data."]}),"\n",(0,s.jsx)(n.p,{children:"Old keys must not be disabled or deleted while they are still needed to decrypt\nolder data. Any new or updated data will be encrypted with the current key\ndefined in the seal configuration or resolved from the configured key alias."})]})}function h(e={}){let{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},44812(e,n,i){i.d(n,{R:()=>t,x:()=>c});var l=i(92990);let s={},o=l.createContext(s);function t(e){let n=l.useContext(o);return l.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:t(e.components),l.createElement(o.Provider,{value:n},e.children)}}}]);