---
title: "Ntụgharị igodo ukwu na igodo mbinye aka, na ịnweta mberede"
description: "Tụgharịa igodo ukwu na-echebe nzere echekwara, ma jiri ịnweta mberede."
image: "https://docs.quirelms.com/og.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.quirelms.com/ig/llms.txt
> Use this file to discover all available pages before exploring further.

# Ntụgharị igodo ukwu na igodo mbinye aka, na ịnweta mberede

<span id="master-key-and-signing-key-rotation-and-break-glass-access"></span>

Njikwa dị na 21-compliance.md ngalaba 14 nke onye nyocha na-ajụ aha ya.
Ibe a bụ usoro; ndekọ ọ na-emepụta bụ ihe akaebe.

## Igodo ndị ahụ <!--quire:the-keys-->

A na-eji igodo nzuzo data ọhụrụ (DEK) mechie nzere ọ bụla echekwara. A na-ekekọta
DEK ahụ na igodo ukwu (KEK), a na-echekwa nrụtụ aka igodo ukwu ahụ n'akụkụ ya
(`key_ref`, ma ọ bụ nrụtụ aka dị n'ime uru akwakọbara). Ịtụgharị
igodo ukwu na-ekekọtaghachi DEK ndị ahụ. Ọ dịghị mgbe ọ na-ewepu nzuzo na nzere
ma ọ bụ tinyeghachi nzere na nzuzo ọzọ.

| Ntọala | Ihe ọ pụtara |
| --- | --- |
| `QUIRE_MASTER_KEY` | Igodo ukwu dị ugbu a: 32 bytes, base64. A na-ekekọta nzuzo ọhụrụ ọ bụla n'okpuru ya |
| `QUIRE_MASTER_KEY_VERSION` | Akara ụdị ya. `v1` mgbe edobeghị ya. Bulie ya mgbe ọ bụla ị gbanwere igodo ahụ |
| `QUIRE_MASTER_KEY_RETIRED` | Igodo ndị mbụ nke nzuzo echekwara ka nwere ike ịdị n'okpuru ha, dịka `v1=<base64>,v0=<base64>`. A na-agụ, a naghị ede |

Ọkwa weebụ, worker na iwu `bun run kek:rotate` na-agụ otu ntọala atọ ahụ.
Ha niile ga-enwerịrị otu ụkpụrụ, ma ọ bụghị ya, otu n'ime ha enweghị ike imepe ihe
ọzọ mechiri.

Na-enweghị `QUIRE_MASTER_KEY` akụkụ ọ bụla na-edobe igodo ọ na-enweta site na
`QUIRE_SECRET_KEY`. Nke ahụ na-arụ ọrụ, ibe ahụike Sistemụ na-egosi ya dịka adịghị mma,
ọ na-anọgide na-agụ mgbe ị tọchara igodo ukwu, nke bụ otu ntụgharị mbụ si ebuga
ihe niile pụọ na ya. Onye ọ bụla nwere ike ịgụ gburugburu usoro nwere ike iwepu nzuzo na
nzere ọ bụla echekwara, ya mere nrụnye mmepụta kwesịrị inwe igodo ukwu,
echekwara na ụlọ ahịa nzuzo ọ bụghị n'otu ndabere dịka nchekwa data.

## Ịtụgharị <!--quire:rotating-->

Afọ igodo na-egosi na console Platform, Nche, Igodo ukwu, na dịka metric
`quire.secrets.master_key.age` (ụbọchị). Nhazi `platform.key_age` kwa ụbọchị (03:41 UTC)
na-ede ndenye ncheta na agbụ nyocha platform mgbe igodo ruru ụbọchị 365,
na ọzọ kwa ụbọchị 30 ruo mgbe a tụgharịrị ya. Tụgharịa na ncheta, na mgbe ọ bụla igodo nwere ike
ekpugharịrị.

1. Mepụta igodo ọhụrụ: `openssl rand -base64 32`.
2. Tọọ `QUIRE_MASTER_KEY` na ya na `QUIRE_MASTER_KEY_VERSION` na akara na-esote
   (`v2`). Bugharịa igodo ochie na `QUIRE_MASTER_KEY_RETIRED` dịka `v1=<old base64>`.
   Debe otu nke abụọ n'ebe ọzọ na-abụghị họst a.
3. Bunye ọkwa weebụ na worker na ntọala ọhụrụ. A na-ekekọta nzuzo ọhụrụ ugbu a
   n'okpuru `env:QUIRE_MASTER_KEY:v2`; ndị ochie ka na-emeghe site na
   igodo lara ezumike nká.
4. Rịọ ntụgharị ahụ, na ihe kpatara ya ga-anọdụ na ụzọ nyocha:
   - na console: Nche, Igodo ukwu, Tụgharịa igodo ukwu; ma ọ bụ
   - na sheel nwere otu gburugburu: `bun run kek:rotate request --reason "Annual rotation, ticket SEC-114"`.
5. Worker na-ekekọtaghachi iberi n'otu nkeji (nhazi `platform.key_rotation` nke onye nhazi oge) wee gaa n'ihu mgbe ịmalitegharị. Imecha ya
   n'otu oche: `bun run kek:rotate run`. Lelee ya na `bun run kek:rotate status`.
6. Mgbe ndekọ gosiri ntụgharị mechara na **efu a na-edozibeghị na efu
   dara**, wepụ igodo lara ezumike nká na `QUIRE_MASTER_KEY_RETIRED` wee bunyekwa ọzọ.
   Ruo mgbe ahụ debe ya: uru ọ na-enweghị ike ibugharị ka nọ n'okpuru igodo ochie.

### Ihe ọrụ ahụ na-agagharị <!--quire:what-the-job-walks-->

Ụlọ ahịa ọ bụla na-ejide DEK ekekọtara: ndị dị na `SEALED_STORES`
(`apps/worker/src/key-rotation.ts`). A na-agagharị ụlọ ahịa nchekwa data njikwa na
nchekwa data njikwa; a na-agagharị ụlọ ahịa otu n'otu otu n'okpuru
nchebe ọkwa ahịrị, na nchekwa data ọ bụla na-ejide otu ahụ, ya mere tenant
a tụkwasịrị na nchekwa data raara onwe ya ka a na-atụgharị na nchekwa data ahụ. Ule dara mgbe
schema nwetara kọlụm igodo ekekọtara nke ndepụta akpọghị aha, na nke ọzọ mgbe
nyocha nzere kewara kọlụm mechiri emechi nke ndepụta ahụ agbagharala.

### Ndekọ ahụ <!--quire:the-record-->

- `ops.key_rotation`: otu ahịrị kwa ntụgharị, na ihe kpatara ya, onye rịọrọ ya,
  ọnọdụ ya na ngụkọta ya (ekekọtaghachiri, dị ugbu a, a na-edozibeghị, dara).
- `ops.key_rotation_progress`: otu ahịrị kwa ụlọ ahịa na oke ozugbo agagharịrị, na
  nrụtụ aka igodo ọ na-enweghị ike ịgụ na ọnụọgụ ụkpụrụ nọ n'okpuru nke ọ bụla. Ntụgharị
  amalitegharịrị na-awụli ndị a.
- Agbụ nyocha platform: `platform/key_rotation_request` (na ihe kpatara ya), otu
  `platform/key_rotation_store` kwa ụlọ ahịa na ngụkọta ya, na
  `platform/key_rotation_complete` ma ọ bụ `platform/key_rotation_fail`;
  `platform/key_age_reminder` maka ncheta.
- Metrics: `quire.secrets.master_key.age` na `quire.secrets.rewrap.outstanding`
  (ụkpụrụ ntụgharị ikpeazụ na-enweghị ike ibugharị).

### Mgbe ụkpụrụ na-edozibeghị <!--quire:when-values-are-unresolved-->

Uru a na-edozibeghị nọ n'okpuru nrụtụ aka igodo nke nrụnye a enweghị,
ma ọ bụ na-anọghị n'ụdị kọlụm ya kwere nkwa. Ndekọ ọganihu na-akpọ
nrụtụ aka ahụ (dịka ọmụmaatụ `env:QUIRE_MASTER_KEY:v0 (unreadable)`). Weghachite igodo ahụ
na `QUIRE_MASTER_KEY_RETIRED` wee gbaa ntụgharị ọzọ, ma ọ bụ, ọ bụrụ na igodo ahụ apụọla
kpamkpam, mee ka onye nchịkwa otu ahụ tinyegharịa nzere ahụ:
a na-emechi ya n'okpuru igodo dị ugbu a. Ntụgharị dara na-egosi njehie ya na
ndekọ; dozie ihe kpatara ya wee rịọ ọzọ.

## Igodo mbinye aka <!--quire:signing-keys-->

Dị iche na igodo ukwu: otu ọ bụla na-ebinye aka na token OpenID Connect ya
na ozi LTI na igodo RSA nke ya, ebipụtara na `/.well-known/jwks.json`.
Ọ dịghị ihe ebe a chọrọ onye na-arụ ọrụ. Nhazi `platform.signing_keys` kwa elekere
na-ebipụta onye nọchiri ụbọchị asaa tupu ụbọchị iri itoolu nke igodo dị ugbu a agwụ, otu izu
emesịa onye nọchiri amalite ibinye aka na igodo ochie aghọọ nke na-ala ezumike nká, na ụbọchị iri
itoolu mgbe ahụ a na-ehichapụ igodo ochie wee pụọ na nhazi igodo. Nzọụkwụ ọ bụla bụ
ndenye `platform/signing_key_advance` na agbụ nyocha platform.

Iji dochie igodo otu n'oge, dịka ọmụmaatụ mgbe ekpughere ya:

- na console: Nche, Igodo ukwu, Bipụta igodo mbinye aka ọhụrụ (chọrọ
  `platform/keys_manage`); ma ọ bụ
- na sheel nwere gburugburu worker: `bun run kek:rotate signing-keys rotate
  --tenant <slug or id> --reason "Key exposed, INC-3310"`. `bun run kek:rotate
  signing-keys status` na-edepụta igodo otu ọ bụla site na ọkwa.

Igodo ọhụrụ na-ebipụta ozugbo wee malite ibinye aka mgbe ụbọchị asaa gachara, mgbe
igodo dị ugbu a lara ezumike nká. Izu ahụ bụ ebumnuche: ndị na-adabere na ya na-echekwa nhazi igodo,
na nkwekọrịta dị mkpụmkpụ na-ada ngwaọrụ ọ bụla n'otu oge. Igodo na-ala ezumike nká na-anọ na nhazi igodo
maka ụbọchị iri itoolu ọzọ ka token ọ binyelarị aka na-aga n'ihu na-enyocha; ọ bụrụ na
ekpughere pụtara na ọ ga-akwụsị ịtụkwasị obi ngwa ngwa, ihichapụ ahịrị ya bụ mgbanwe
ejiri nweta nchekwa data nke onye na-arụ ọrụ n'onwe ya mee n'okpuru ndekọ mgbanwe (ịnweta mberede
bụ naanị ọgụgụ), token ejiri ya binye aka na-ada nkwenye. Ntụgharị
amanye bụ `platform/signing_key_rotate` na agbụ nyocha, na
ihe kpatara ya. Worker chọrọ otu ntọala `QUIRE_MASTER_KEY` dịka ọkwa weebụ iji
kechie igodo ọhụrụ; `bun run kek:rotate` maka igodo ukwu na-ekekọtaghachi igodo mbinye aka
na ihe niile ọzọ (`oauth_signing_key` dị na `SEALED_STORES`).

## Ịnweta mmepụta mberede <!--quire:break-glass-production-access-->

Ọ dịghị onye na-ejide ohere guzoro na mmepụta. Mgbe ihe enweghị ike ichere, onye nwe
na-enye onyinye mberede: console Platform, Nche, Ịnweta mberede.

- Onyinye nwere oke (otu otu, ma ọ bụ ndekọ platform), ihe kpatara ya nke dịkarịa ala
  mkpụrụedemede 20 na-akpọ ihe merenụ ma ọ bụ tiketi, na windo nkeji 5 ruo 240.
  Ọ na-agwụ n'onwe ya: a na-enyocha ya megide elekere na
  nkwupụta ọ bụla.
- Enwere ike inye ya onye nwe nyere ya, ma ọ bụ onye nwe ọzọ (ụdị mmadụ abụọ).
  Naanị onye e nyere ya nwere ike iji ya. Inye chọrọ
  `platform/break_glass_issue` iji chọrọ `platform/break_glass_use`; ha abụọ bụ
  naanị onye nwe na ndabara.
- Nkwupụta na-aga site na ọnụ ụzọ, ọ bụghị na nbanye nchekwa data: naanị ọgụgụ, otu n'otu
  oge, amachibidoro na otu ma ọ bụ na ndekọ njikwa, na timeout sekọnd ise
  na karịa ahịrị 500. A na-egosi ụkpụrụ binary site na nha.
- Agbụ nyocha platform na-edekọ inye (na ihe kpatara ya), kagbuo,
  nkwupụta ọ bụla tupu ọ gbaa (`platform/break_glass_statement`, ndị jụrụ na
  nsonaazụ `denied`) na nsonaazụ ọ bụla (`platform/break_glass_result`).
  `ops.break_glass_statement` na-ejide id ndenye nyocha, ya mere ndekọ inye
  na-ejikọta na ndenye nyocha ya.
- Anaghị enye ederede. Mgbanwe na-enweghị ike ichere mwepụta na-eji
  nweta nchekwa data nke onye na-arụ ọrụ n'onwe ya n'okpuru ndekọ mgbanwe nke ya, n'èzí ngwaahịa a,
  ndekọ ahụ kwesịrị ịkpọ nrụtụ aka ihe merenụ ejiri ebe a.

Ihe mere na anaghị enye nzere nchekwa data: nbanye Postgres na-adị ndụ karịa oge
jụrụ ya, na-agafe nchebe ọkwa ahịrị nke ngwa dabere na ya, na
enweghị ike ide na agbụ nyocha ngwaahịa a, ya mere a ga-enyocha nkwupụta ya
naanị ka mmadụ bugara log sava. Ọnụ ụzọ na-eme ụzọ nyocha ka ọ bụrụ ihe onwunwe
nke ịnweta kama omume gbara ya gburugburu.

Iji zaa arịrịọ nyocha: depụta onyinye dị n'oge ahụ (Ịnweta mberede),
mepee akụkọ onyinye maka nkwupụta ya na id ndenye nyocha, ma gụọ ndị ahụ
ndenye na agbụ nyocha platform (`bun run audit:verify --platform` gosipụtara na
agbụ ahụ adịghị emebi).

Source: https://docs.quirelms.com/ig/ops/key-rotation/index.mdx