Key Algorithms for User Clusters

Overview

KKP generates a set of private keys for every user cluster it creates: the keys behind the cluster’s certificate authorities and the certificates issued from them, and the key used to sign service account tokens. The algorithm and size of these keys can be configured. By default they are RSA with a 2048 bit modulus. Operators can select larger RSA keys or ECDSA to meet security or compliance requirements without changing how the rest of the cluster is set up.

The configuration has two independent parts:

• Certificates covers the user cluster’s internal PKI: the cluster CA and the front-proxy CA, the serving certificates of etcd and the Kubernetes API server, the client certificates of the control plane components, and the certificates of the KKP-managed webhooks and internal kubeconfigs.
• Service Account Key covers the key that signs service account tokens issued by the cluster. This key is visible outside of the cluster wherever service account tokens are validated, so it is configured separately from the certificates.

Each part accepts the same options:

Leaving a part unconfigured uses RSA 2048 for that part.

Both parts share the same structure. The full specification is available in the CRD documentation as KeyConfiguration and KeySpec.

Configuring a Global Default

The default for all newly created user clusters is set in the KubermaticConfiguration under spec.userCluster.keyConfiguration (see KubermaticUserClusterConfiguration):

apiVersion: kubermatic.k8c.io/v1
kind: KubermaticConfiguration
metadata:
  name: kubermatic
  namespace: kubermatic
spec:
  userCluster:
    keyConfiguration:
      certificates:
        algorithm: ECDSA
        ecdsaCurve: P384
      serviceAccountKey:
        algorithm: RSA
        rsaKeySize: 4096

The setting is copied into every user cluster at the moment the cluster is created. Changing the global default later only affects clusters created after the change; clusters that already exist keep the key material they were created with.

Configuring a Single Cluster

A cluster can deviate from the global default by setting spec.keyConfiguration in its own Cluster object (see ClusterSpec) when it is created:

apiVersion: kubermatic.k8c.io/v1
kind: Cluster
metadata:
  name: my-cluster
spec:
  # ...
  keyConfiguration:
    certificates:
      algorithm: RSA
      rsaKeySize: 4096

The same field is available in cluster templates and in the defaulting template of a Seed, which makes it possible to roll out a key configuration to a group of clusters. When a template and the cluster both configure the same part, the cluster’s own setting wins as a whole; settings are never mixed between the two.

Verifying the Configuration

The effective configuration of a cluster is stored on the Cluster object and can be read from there:

kubectl get cluster my-cluster -o jsonpath='{.spec.keyConfiguration}'

To confirm that the generated key material matches, inspect the cluster CA in the cluster’s namespace on the seed cluster:

kubectl --namespace cluster-my-cluster get secret ca -o jsonpath='{.data.ca\.crt}' | base64 -d | openssl x509 -noout -text | grep 'Public Key Algorithm' -A 1

Important Notes