Skip to content

Persist crypto keys

Kristian Larsson requested to merge 229-fix-crypto-key-handling into master

The encryption keys for NSO are stored in a separate file, which we have, rather embarrassingly, failed to persist. This MR persists it by placing it on the shared /nso volume.

Just like for SSH keys and SSL certs, we check for its existence on startup and generate it, if it does not exist.

ncs.conf is mangled to refer to the ncs.crypto_keys on the persisted /nso volume rather than the local /etc/ncs/ncs.conf

We also remove /etc/ncs/ncs.conf from the base image since it could cause confusion.

There are some improvements to the test suite in order to test encrypted leaves.

Also some fixes/improvements to descriptions in config mangling scripts.

Closes #229 (closed).

Merge request reports