Goal:
There are some features (one example) that could make use of a secure setting that is consistent across nodes.
Problem with existing secure settings:
Existing secure settings stored in the keystore have the problem that they are not enforced to be consistent across nodes. The key-store settings are primarily used for node start-up secure settings.
Features that would enable such a setting:
In order to have an arbitrary set of settings stored securely out in the open in the cluster-state, there must be a way to encrypt and decrypt these values. One solution would be to introduce a sort-of system key that will be stored in the secure keystore, and all these new cluster-state-secure-settings would use this key to encrypt and decrypt their values when needed. These settings probably won't change, and it may make sense to enforce that by disallowing updates to these settings.
rotated system key:
Although these secure settings may not need key-rotation, the master system key used to cypher these settings should have a way to rotate itself. This means having a hand-off mechanism where old key decrypts and new key encrypts and re-inserts into the cluster-state
I've left further implementation details out of this description, since those may be hashed out upon investigation
cc @elastic/es-distributed @elastic/es-security
Goal:
There are some features (one example) that could make use of a secure setting that is consistent across nodes.
Problem with existing secure settings:
Existing secure settings stored in the keystore have the problem that they are not enforced to be consistent across nodes. The key-store settings are primarily used for node start-up secure settings.
Features that would enable such a setting:
In order to have an arbitrary set of settings stored securely out in the open in the cluster-state, there must be a way to encrypt and decrypt these values. One solution would be to introduce a sort-of system key that will be stored in the secure keystore, and all these new cluster-state-secure-settings would use this key to encrypt and decrypt their values when needed. These settings probably won't change, and it may make sense to enforce that by disallowing updates to these settings.
rotated system key:
Although these secure settings may not need key-rotation, the master system key used to cypher these settings should have a way to rotate itself. This means having a hand-off mechanism where old key decrypts and new key encrypts and re-inserts into the cluster-state
I've left further implementation details out of this description, since those may be hashed out upon investigation
cc @elastic/es-distributed @elastic/es-security