Te hurihuri i ngā kī matua me ngā kī tā, me te wātea ohotata

Ngā tautuhinga whakahaere i te 21-compliance.md wāhanga 14 e tonoa ana e tētahi arotake ma tana ingoa. Ko tēnei whārangi te tukanga; ko ā rātou tuhinga ngā taonga whakamārama.

Ngā kī

Ka kāingia ia tohu whakamanatanga kua kohia hei tētahi kī whakawhiti raraunga hou (DEK). Ka whakakapi te DEK e te kī matua (te KEK), ā, ka tā te tohunga o te kī matua i tōna taha (key_ref, rānei te tohunga i roto i tētahi uara kua whakakotahi). Ka hurihuri i te kī matua, ka whakakapihia anō ngā DEK. Kāore e wehenga ia i tētahi tohu whakamanatanga rānei te tā anō i a ia.

Ka pānui te wāhanga ipurangi, te kai mahi me te whakahau bun run kek:rotate ē tautuhinga e toru kotahi. Me ōrite ō rātou uara, mēnā kāore, ka kore tētahi o rātou e tuwhera i te mea kua kāingia e tētahi atu.

Me te kore te QUIRE_MASTER_KEY, ka pupuri ia wāhanga pūnaha te kī e hanga ana ia mai i te QUIRE_SECRET_KEY. Ka mahi tēnei, ka whakaatuhia ia e te whārangi Hauora Pūnaha hei mea kua heke tana hauora, ā, ka noho tonu e taea ana te pānui i muri i te wā tautuhia ana koe i tētahi kī matua, ko ia te āhua e nekehia ai te tuatahi hurihuri i ngā mea katoa i waho i a ia. Ka āea e te tāngata e pānui ana te taiao o te pū te wehenga i ia tohu whakamanatanga kua kohia, nō reira me tētahi kī matua tō tētahi whakaturanga whakaputanga, e pupuria ana i tētahi kohinga kupu tūmataiti, ehara i te tahi pupuniBackup me te pūtaka.

Te hurihuri

Ka whakaaturia te tau o te kī i te Papa whakahaere Pū, Haumarutanga, Kī matua, ā, hei tētahi ōrongotau te quire.secrets.master_key.age (ngā rā). Ka tuhi te whakarite rā platform.key_age (03:41 UTC) tētahi tuhipoka whakamaumahara ki te hono arotake o te pū i te wā e tae te kī ki te 365 rā, ā, anō ia 30 rā tae noa ki te wā hurihuri. Hurihuria i te wā whakamaumahara, ā, i ia wā ka pā te kī ki te tūmatanui.

1. Hangaia te kī hou: openssl rand -base64 32.
2. Tautuhia te QUIRE_MASTER_KEY ki a ia, ā, te QUIRE_MASTER_KEY_VERSION ki te tohu nō muri (v2). Nekehia te kī tawhito ki te QUIRE_MASTER_KEY_RETIRED ma te v1=<old base64>. Pupuritia tētahi tārua o ērua i tētahi wāhi kē i tēnei pūrere.
3. Whakaturia te wāhanga ipurangi me te kai mahi me ngā tautuhinga hou. Ka whakakapihia ngā kupu tūmataiti hou i tēnei wā i raro i te env:QUIRE_MASTER_KEY:v2; ka noho tonu e tuwhera ana ngā tawhito ma te kī o mua.
4. Tonoa te hurihuri, me te take e noho ana i te ara arotake:
   • i te papa whakahaere: Haumarutanga, Kī matua, Hurihuria te kī matua; rānei
   • i tētahi papa kōrero me te tahi taiao: bun run kek:rotate request --reason "Annual rotation, ticket SEC-114".
5. Ka whakakapi te kai mahi i tētahi wāhanga ia meneti (te whakarite platform.key_rotation o te kaiwhakarite), ā, ka tīmata te mahi anō i muri i te tīmata anō. Kia oti i te wā kotahi: bun run kek:rotate run. Aroturukia ia ma te bun run kek:rotate status.
6. I te wā ka whakaatuhia e te tuhinga kua oti te hurihuri me te kore mea kua whakataunga me te kore kua rahua, tangohia te kī o mua mai i te QUIRE_MASTER_KEY_RETIRED, ā, whakaturia anō. Tae noa ki tērā, pupuritia ia: tētahi uara kāore e taea te neke ka noho tonu whakakapia i raro i te kī tawhito.

He aha e tātaritia ai te mahi

Ia kohinga e pupuri ana i tētahi DEK kua whakakapia: ē kei te SEALED_STORES (apps/worker/src/key-rotation.ts). Ka tātaritia ngā kohinga pūtaka whakahaere i te pūtaka whakahaere; ka tātaritia ngā kohinga rōpū i te kōtahi rōpū ā-wāhanga i raro i te haumarutanga ā-rārangi, i te pūtaka e pupuri ana i te rōpū, nō reira ka hurihurihia tētahi wāhanga e pūmau ana ki tētahi pūtaka motuhake i tērā pūtaka. Ka rahua tētahi whakamātau inā ka tāpiritia e te kupunga tētahi pou kī kua whakakapia kāore e kīia ana e te rārangi, ā, tētahi atu inā ka tohungia e te arotake tohu tētahi pou kua kāingia kāore e kitea ana e te rārangi.

Te tuhinga

• ops.key_rotation: tētahi rārangi ia hurihuri, me tana take, ko wai i tono, tana tūmaurunga me ōna tau (kua whakakapia anō, kua tū kē, kāore kua whakataunga, kua rahua).
• ops.key_rotation_progress: tētahi rārangi ia kohinga me ia rohe i te wā kua tātaritia, me ngā tohunga kī kāore e taea te pānui me te tau o ngā uara e noho ana i raro i ia. Ka wehea e tētahi hurihuri kua tīmata anō ēnei.
• Te hono arotake o te pū: platform/key_rotation_request (me te take), tētahi platform/key_rotation_store ia kohinga me ōna tau, ā, te platform/key_rotation_complete rānei te platform/key_rotation_fail; te platform/key_age_reminder mō te whakamaumahara.
• Ngā ōrongotau: te quire.secrets.master_key.age me te quire.secrets.rewrap.outstanding (ngā uara kāore e taea te neke e te hurihuri o mua).

I te wā kāore whakataunga ngā uara

He uara kāore kua whakataunga tētahi ka whakakapia i raro i tētahi tohunga kī kāore e pupuria ana e tēnei whakaturanga, rānei kāore ia i te āhua e kīia ana e tana. Ka kīia e te tuhinga whakapae te tohunga (hei tauira te env:QUIRE_MASTER_KEY:v0 (unreadable)). Whakahokia tērā kī ki te QUIRE_MASTER_KEY_RETIRED, ā, whakatematema anō tētahi atu hurihuri, rānei, mēnā kua ngaro te kī tonu, kia tāpiritia e te kaiwhakahaere o te rōpū tonu te tohu whakamanatanga: ka kāingia ia i muri i tēnei i raro i te kī o tēnei wā. Ka whakaatuhia ngā hurihuri kua rahua ē hapa i te tuhinga: whakatikaina te take, ā, tonoa anō.

Ngā kī tā

Kei waho o te kī matua: ka tā ia rōpū ō rātou tohu OpenID Connect me ō rātou karere LTI me tō rātou ake kī RSA, e whakaputanga ana i te /.well-known/jwks.json. Kāore e hiahiatia tētahi kaiwhakahaere i konei. Ka whakaputanga te whakarite ia wākahora platform.signing_keys tētahi kī hou i mua i te 7 rā i te mutunga o ngā 90 rā o te kī o tēnei wā, i te wiki i muri ka tīmata te kī hou te tā anō, ā, ka noho te kī tawhito hei kī e wehea ana, ā, i te 90 rā i muri i tērā ka mukua te kī tawhito, ā, ka wehea ia i te kōpui kī. He tuhipoka platform/signing_key_advance ia mahi i te hono arotake o te pū.

Kia whakakapia te kī o tētahi rōpū i mua i te wā, hei tauira i muri i tētahi whakatū i te tūmatanui:

• i te papa whakahaere: Haumarutanga, Kī matua, Whakaputia tētahi kī tā hou (hiahiatia te platform/keys_manage); rānei
• i tētahi papa kōrero me te taiao o te kai mahi: bun run kek:rotate signing-keys rotate --tenant <slug or id> --reason "Key exposed, INC-3310". Ka tuhia te bun run kek:rotate signing-keys status ngā kī o ia rōpū ma te wāhanga.

Ka whakaputanga te kī hou i te wā kotahi, ā, ka tīmata te tā anō i muri i te 7 rā, i te wā wehea ai te kī o tēnei wā. He whakaaro tika te wiki: ka kohina ngā pā whakamahi te kōpui kī, ā, ka rahua tētahi tukunga iti ia ratonga i te wā kotahi. Ka noho te kī e wehea ana i te kōpui kī mō ē 90 rā atu, kia tautara tonu ē tohu kua tā kē e ia; mēnā ka hiahiatia te whakakore i te whakawhirinaki i a ia i mua i te wā, ko te mukunga i tōna rārangi tētahi huringa e mahia ana e te kaiwhakahaere me ōna ake urunga pūtaka i raro i tētahi tuhinga huringa (ko te wātea ohotata pānui-anake); ā, ka rahua te tautara i ē tohu kua tā ia. Ko te hurihuri whakatā te platform/signing_key_rotate i te hono arotake, me te take. Ka hiahiatia e te kai mahi ngā tautuhinga QUIRE_MASTER_KEY kotahi me te wāhanga ipurangi te whakakapi i te kī hou; ka whakakapi te bun run kek:rotate mō te kī matua ngā kī tā me ngā mea atu (oauth_signing_key kei te SEALED_STORES).

Te wātea ohotata whakaputanga

Kāore e pupuri tētahi i te wātea tūturu ki te whakaputanga. I te wā kāore e taea te tatari, ka tukua e tētahi kai pupuri tētahi tono wātea ohotata: Papa whakahaere Pū, Haumarutanga, Wāhea ohotata.

• He rohe tētahi tono (tētahi rōpū, rānei te rārangi whakahaere o te pū), he take iti rawa 20 pātuhi e tohu ana i te ohere rānei te tāketu, me tētahi wā mai i te 5 ki te 240 meneti. Ka mutu i tōna ake: ka tātaritia ia ki te tā i ia tuku.
• Ka taea te tuku ki te kai pupuri e tuku ana, rānei ki tētahi atu kai pupuri (te āhua e rua tāngata). Ko te tāngata tētahi anake e taea ana te whakamahi. Ka hiahiatia te tono te platform/break_glass_issue, ā, te whakamahi te platform/break_glass_use; ērua kai pupuri anake i te tūtohu.
• Ka mahia ngā kōrero ma te āhurei, ehara i te takiuru pūtaka: pānui-anake, tētahi ā-wāhanga, e ārahihia ana ki te rōpū rānei ki te rārangi whakahaere, me tētahi tono 5 hēkona me te iti rawa 500 rārangi. Ka whakaaturia ngā uara binara ma te rahinga.
• Ka tuhia e te hono arotake o te pū te tono (me te take), te whakakore, ia kōrero i mua i te mahi (platform/break_glass_statement, me ē kua āraihia me te hua denied) me ia hua (platform/break_glass_result). Ka pupuri te ops.break_glass_statement i ngā tohu tuhipoka arotake, nō reira ka honona te tuhinga tono ki ōna tuhipoka arotake.
• Kāore e āea te tuhi. Tētahi huringa kāore e taea te tatari mō tētahi whakaputanga ka whakamahia te urunga pūtaka ōna ake o te kaiwhakahaere i raro i tōna ake tuhinga huringa, i waho o tēnei produk, ā, me tohu te tuhinga i te tohunga ohere e whakamahia ana i konei.

He aha kāore e tuku i ngā tohu whakamanatanga pūtaka: ka roa ake te ora o te takiuru PostgreSQL i te hono i tono i a ia, ka wehea te haumarutanga ā-rārangi e whino ana te taupānga, ā, kāore e taea te tuhi ki te hono arotake o tēnei produk, nō reira ka tātaritia ā rātou kōrero i te tataunga o te tāngata i tukua te rārangi pūrongo o te tūmau anake. Ka mahi te āhurei i te ara arotake hei āhuatanga o te urunga ehara i tētahi tikanga kōtahi i a ia.

Kia whakautu i tētahi tono arotake: tuhia ngā tono i tērā wā (Wāhea ohotata), tuwheria te whakapapa o tētahi tono mō ā rātou kōrero me ngā tohu tuhipoka arotake, ā, pānuitia ēnā tuhipoka i te hono arotake o te pū (bun run audit:verify --platform e whakaatu ana, ko te hono tūturu).