Protect memcached with encryption
Followup to #96 (closed).
Currently, the connections to and data stored in the memcached service are not protected by encryption, which means:
When using Memcached, tokens and authentication responses are stored in the cache as raw data. In the event the cache is compromised, all token and authentication responses will be readable.
(source)
#96 (closed) already states some possible solutions to this: TLS for memcached or encrypting cache entries with client-specific symmetric keys. Since the former seems to be of experimental nature and is not readily available on the image, we could go with just the symmetric key option for starters.
This means adding something like this to the configs of other components accessing the cache:
[keystone_authtoken]
...
memcache_security_strategy = ENCRYPT
memcache_secret_key = ...
memcached_servers = ...
The memcache_secret_key should be generated for each component individually. (K8s Secret resource?)
NOTE: this Mirantis documentation suggests that only a subset of OpenStack components seems to support the symmetric encryption functionality:
The OpenStack services that support the memcached protection include Aodh, Barbican, Cinder, Glance, Gnocchi, Heat, Ironic, Neutron, Nova, and Panko.
If this information is still valid, this might have an impact on how these options can be inserted. Currently, the injection of the memcached_servers entry is done in a generic fashion which does not differentiate between components.