Requirements¶
The set of requirements defined for this project are outlined below.
Encryption¶
- Secrets not stored in plain text on disk (client or server)
- Secrets always encrypted in transit across network
Reliability¶
- Fault tolerant enough to have the server go down and the application keeps functioning
- Server uptime equivalent to the most critical server or component in the data center
Scalability¶
- Can support thousands of concurrent servers
- Can support storage of thousands of secrets
Secret types¶
- Support standard secret types (PKI key pairs, hashes, etc)
- Custom secrets with custom key/value meta data
- Support for automated changing of passwords on schedules and on demand
Administration¶
- Searching across all fields
- APIs for administration of secrets from the command line
- Bulk edit of secrets
- SDKs for integrating with code and cli
- CLI utility
Access Control¶
- Secrets can be permissioned to individual servers
- Read, write, and delete as separate permissions
- Group permissioning for both secrets and applications/clients
Required Packages¶
In order to build this secret storage solution you’ll need:
- Salt Master
- Salt Minion(s)
- Public and private GPG keys
- GPG Agent (optional)
Required Configuration¶
In order for Salt master to parse the GPG cipher data it needs the GPG
renderer enabled. This is done by updating the /etc/salt/master
config file
and applying the below change.
- #renderer: yaml_jinja
+ renderer: jinja | yaml | gpg