Re: Key Rotation Strategies

Mike Youngstrom <youngm@...>

On Thu, Jun 11, 2015 at 12:33 PM, CF Runtime <cfruntime(a)> wrote:

as well as info on other keys that need attention.
That is a good question. Looking through a manifest it is difficult to
pick out which keys/passwords should be rotated. A quick perusal found
these candidates:

* UAA/CC DB passwords can probably be rotated without issue.
* Might initially think Nats should be rotated. However, since etcd isn't
even password protected we're probably ok relying on network firewall for
nats and etcd.
* cc.bulk_api_password should probably be rotated and could cause downtime
if the components that rely upon it don't have their config changed the
exact same time the CC is changed
* doppler_endpoint.shared_secret will probably cause the loss of messages
if rotated
* would probably cause everyone to get logged out
right? Probably not optimal.
* might cause connectivity issues between UAA and CC
while rotating could cause some downtime

Any others?


Join to automatically receive all group messages.