Key management cache synchronization
Encryption key management for containerized applications is provided. An application container receives a request, directed to a wrapped data encryption key (WDEK), and it is determined whether a local cache associated with the application container stores a mapping of the WDEK to an unwrapped data encryption key (DEK). In response to a cache miss, a shared list, that stores entries corresponding to WDEKs to be synchronized among a plurality of local encryption key caches of a set of application containers, is accessed to determine a set of WDEKs that are missing from the local cache. A key management service provides the WDEKs and corresponding DEKs for the set of WDEKs. The shared list data structure and the local encryption key cache are updated based on the WDEKs and DEKs obtained from the key management service, to thereby synchronize the local encryption key cache with the shared list data structure.
1. A method, in a data processing system, of encryption key management for containerized applications, the method comprising:
receiving, by an application container, a request directed to a first wrapped data encryption key (WDEK);
determining whether a local encryption key cache associated with the application container stores an entry having a mapping of the first WDEK to a first unwrapped data encryption key (DEK);
in response to the local encryption key cache not storing the entry, accessing a shared list data structure that stores entries corresponding to WDEKs to be synchronized among a plurality of local encryption key caches of a set of application containers, to determine a set of WDEKs that are missing from the local encryption key cache;
obtaining, from a key management service, the WDEKs and corresponding DEKs for the set of WDEKs that are missing from the local encryption key; and
updating the shared list data structure and the local encryption key cache based on the WDEKs and DEKs obtained from the key management service, to thereby synchronize the local encryption key cache with the shared list data structure.
2. The method of claim 1 , wherein the set of WDEKS comprises the first WDEK and at least one second WDEK that is missing from the local encryption key cache.
3. The method of claim 2 , wherein the at least one second WDEK comprises all other WDEKs in the shared list data structure that do not have an entry in the local encryption key cache.
4. The method of claim 1 , wherein the shared list data structure is associated with a replica set of an application container image, and wherein the application container is an instance of the replica set.
5. The method of claim 4 , wherein a plurality of shared list data structures are maintained by the data processing system, each shared list data structure being associated with a different replica set of a different application container image.
6. The method of claim 1 , wherein updating the local encryption key cache comprises caching an entry in the local encryption key cache that maps the WDEK to the unwrapped DEK, and wherein updating the shared list data structure comprises updating a current cache time for an existing entry in the shared list data structure to represent a current time when the entry mapping the WDEK to the unwrapped DEK is cached in the local encryption key cache, or adding a new entry in the shared list data structure for the WDEK if an existing entry in the shared list data structure does not exist.
7. The method of claim 1 , wherein the shared list data structure does not store the unwrapped DEK.
8. The method of claim 1 , wherein the request is received from an Application Programming Interface (API) server, and wherein the application container is a key management service container of the key management service.
9. The method of claim 1 , further comprising:
checking, on a periodic basis, entries of the local encryption key cache against the shared list data structure to determine WDEKs present in the shared list data structure that do not have an entry in the local encryption key cache to thereby identify a set of missing WDEKs; and
retrieving the set of missing WDEKs and their corresponding unwrapped DEKs from the key management service.
10. The method of claim 1 , wherein an entry in the shared list data structure stores a corresponding WDEK, a last cached timestamp, a master container instances that last cached the WDEK, and a request identifier of a request that caused the last caching of the WDEK in the local encryption key cache.
11. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a data processing system, causes the data processing system to:
receive, by an application container, a request directed to a first wrapped data encryption key (WDEK);
determine whether a local encryption key cache associated with the application container stores an entry having a mapping of the first WDEK to a first unwrapped data encryption key (DEK);
in response to the local encryption key cache not storing the entry, access a shared list data structure that stores entries corresponding to WDEKs to be synchronized among a plurality of local encryption key caches of a set of application containers, to determine a set of WDEKs that are missing from the local encryption key cache;
obtain, from a key management service, the WDEKs and corresponding DEKs for the set of WDEKs that are missing from the local encryption key; and
update the shared list data structure and the local encryption key cache based on the WDEKs and DEKs obtained from the key management service, to thereby synchronize the local encryption key cache with the shared list data structure.
12. The computer program product of claim 11 , wherein the set of WDEKS comprises the first WDEK and at least one second WDEK that is missing from the local encryption key cache.
13. The computer program product of claim 12 , wherein the at least one second WDEK comprises all other WDEKs in the shared list data structure that do not have an entry in the local encryption key cache.
14. The computer program product of claim 11 , wherein the shared list data structure is associated with a replica set of an application container image, and wherein the application container is an instance of the replica set.
15. The computer program product of claim 14 , wherein a plurality of shared list data structures are maintained by the data processing system, each shared list data structure being associated with a different replica set of a different application container image.
16. The computer program product of claim 11 , wherein updating the local encryption key cache comprises caching an entry in the local encryption key cache that maps the WDEK to the unwrapped DEK, and wherein updating the shared list data structure comprises updating a current cache time for an existing entry in the shared list data structure to represent a current time when the entry mapping the WDEK to the unwrapped DEK is cached in the local encryption key cache, or adding a new entry in the shared list data structure for the WDEK if an existing entry in the shared list data structure does not exist.
17. The computer program product of claim 11 , wherein the shared list data structure does not store the unwrapped DEK.
18. The computer program product of claim 11 , wherein the request is received from an Application Programming Interface (API) server, and wherein the application container is a key management service container of the key management service.
19. The computer program product of claim 11 , wherein the computer readable program further causes the data processing system to:
check, on a periodic basis, entries of the local encryption key cache against the shared list data structure to determine WDEKs present in the shared list data structure that do not have an entry in the local encryption key cache to thereby identify a set of missing WDEKs; and
retrieve the set of missing WDEKs and their corresponding unwrapped DEKs from the key management service.
20. An apparatus comprising:
at least one processor; and
at least one memory coupled to the at least one processor, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the at least one processor to:
receive, by an application container, a request directed to a first wrapped data encryption key (WDEK);
determine whether a local encryption key cache associated with the application container stores an entry having a mapping of the first WDEK to a first unwrapped data encryption key (DEK);
in response to the local encryption key cache not storing the entry, access a shared list data structure that stores entries corresponding to WDEKs to be synchronized among a plurality of local encryption key caches of a set of application containers, to determine a set of WDEKs that are missing from the local encryption key cache;
obtain, from a key management service, the WDEKs and corresponding DEKs for the set of WDEKs that are missing from the local encryption key; and
update the shared list data structure and the local encryption key cache based on the WDEKs and DEKs obtained from the key management service, to thereby synchronize the local encryption key cache with the shared list data structure.