CMK
CMK (Customer-Managed Keys) is the OpenKCM component for governing customer keys. Tenants use it to manage their keys in their own keystores, link the keys to the systems that use them, and control who may do what. CMK consists of six services, the optional Checker, plugins and shared libraries. For its cryptographic key operations, CMK requires Krypton, which it drives through the CMK-2-Krypton Bridge.
This section is for everyone who works with CMK: the customers who manage their keys in it, the teams who connect their cloud services to it, and the operators who run it.
Start here
| You want to… | Read |
|---|---|
| Manage keys, key configurations, systems or approvals in CMK | Manage your keys |
| Give users access to a tenant, or understand what each role may do | Sign-in, groups and roles |
| Automate CMK through its REST API | CMK API |
| Onboard a customer: register the tenant for its region, connect its identity provider, block or terminate it | Connect a regional tenant |
| Make your cloud service receive key changes from CMK | Connect a regional system |
| Plan and install a CMK deployment | Deployment planning, then Install the Registry and Install a regional deployment |
| Find the Helm charts and container images | Releases |
| Run, upgrade and troubleshoot CMK | Operations |
| Review how CMK protects access before going live | Security architecture and the hardening checklist |
CMK services
CMK runs as one central deployment with the Registry, and one regional deployment per CMK region with the other services. Every tenant is registered in the Registry with a region and is served by that region's deployment. See Deployment planning.
| Service | Deployment | Role | Repository |
|---|---|---|---|
| Registry | Central | Registers all tenants and their systems, and sends each tenant's jobs to the CMK of its region | registry |
| CMK service | Regional | Governance control plane for the customer keys of the region's tenants: REST API, workflows, propagation to systems | cmk |
| CMK UI | Regional | Web console for CMK | cmk-ui |
| ExtAuthZ | Regional | Authenticates every API request, evaluates Cedar policies, signs client data | extauthz |
| Session Manager | Regional | OIDC login, browser sessions and per-tenant identity provider trust | session-manager |
| CMK-2-Krypton Bridge | Regional | Turns CMK's key decisions into Krypton operations; CMK requires Krypton for its cryptographic keys | cmk-krypton-bridge |
| Checker | Optional, per cluster | Reports the health of the services, the cluster and the service mesh, and the versions of the services | checker |
How the services work together
- The CMK UI runs in the browser. Users sign in through Session Manager, which runs the OpenID Connect flow with the tenant's identity provider.
- Every API call passes Envoy Gateway, which asks ExtAuthZ for a decision. ExtAuthZ checks the session, token or client certificate and adds signed client data to the request.
- CMK verifies the client data, authorizes the call and performs it. Key operations run in the keystores through plugins.
- The Registry, in the central deployment, registers every tenant with its region, and the systems of the cloud services. It sends each tenant's jobs, such as provisioning, blocking or its identity provider, to the CMK of the tenant's region. See Connect a regional tenant.
- CMK propagates key and system changes to the systems of its tenants.
- The CMK-2-Krypton Bridge receives CMK's key tasks and creates and updates the corresponding keys in Krypton, which CMK requires for its cryptographic key operations.
Supporting building blocks
| Building block | Purpose | Repository |
|---|---|---|
| Plugins | Keystore and identity management integrations | plugin-sdk, keystore-plugins, identity-management-plugins |
| Orbital | Library for jobs and tasks between services | orbital |
| common-sdk | Configuration, logging, audit events, OIDC and client data helpers | common-sdk |
| api-sdk | gRPC API definitions shared between services | api-sdk |
Security
The security section explains how requests are authenticated and authorized across these services, how to configure them, and which settings to review before going live.