Skip to content

Implement Raft for fernet keys synchronization #501

@gtema

Description

@gtema

Raft can be used to implement fernet storage outside of the fs and eliminate the key synchronization problem allowing frequent key rotation.

The raft master node would generate new fernet key, put it into the raft log. All other nodes "immediately" see it and start supporting it.

Logically the fernet should be stored encrypted inside the raft. For that an envelope concept should be applied with a master encryption key (kek) being either available through hsm (long term) or through the vault (short term)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions