Versions Compared

Old Version 2

changes.mady.by.user Unknown User (vishesh)

Saved on

compared with

New Version 3

changes.mady.by.user Unknown User (vishesh)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Stores HSM profile configurations. Scoped by account_id, domain_id, and zone_id.

Code Block
CREATE TABLE IF NOT EXISTS `cloud`.`kms_hsm_profiles` (
    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
    `uuid` VARCHAR(40) NOT NULL,
    `name` VARCHAR(255) NOT NULL,
    `protocol` VARCHAR(32) NOT NULL COMMENT 'PKCS11, KMIP, AWS_KMS, etc.',
    `account_id` BIGINT UNSIGNED COMMENT 'null = admin-provided',
    `domain_id` BIGINT UNSIGNED,
    `zone_id` BIGINT UNSIGNED COMMENT 'null = global scope',
    `vendor_name` VARCHAR(64),
    `enabled` BOOLEAN NOT NULL DEFAULT TRUE,

...

`system` BOOLEAN NOT NULL DEFAULT FALSE,
    `created` DATETIME NOT NULL,
    `removed` DATETIME,
    PRIMARY KEY (`id`),
    UNIQUE KEY `uk_uuid` (`uuid`),
    UNIQUE KEY `uk_account_name` (`account_id`, `name`, `removed`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

...

cloud.kms_hsm_profile_details
Key-value configuration details for HSM profiles. Sensitive values (PIN, password) are encrypted via DBEncryptionUtil.
 Code Block
languagesql
CREATE TABLE IF NOT EXISTS `cloud`.`kms_hsm_profile_details` (
    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
    `profile_id` BIGINT UNSIGNED NOT NULL,
    `name` VARCHAR(255) NOT NULL,
    
...
`value` TEXT NOT NULL COMMENT 'encrypted if sensitive',
    PRIMARY KEY (`id`),
    UNIQUE KEY `uk_profile_name` (`profile_id`, `name`),
    CONSTRAINT `fk_kms_hsm_profile_details__profile_id`
        FOREIGN KEY (`profile_id`) REFERENCES `kms_hsm_profiles`(`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
...

cloud.kms_keys
KMS key (KEK) metadata. Account-scoped, zone-bound.
 Code Block
languagesql
CREATE TABLE IF NOT EXISTS `cloud`.`kms_keys` (
    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
    `uuid` VARCHAR(40) NOT NULL,
    `name` VARCHAR(255) NOT NULL,
    `description` VARCHAR(1024),
    `kek_label` VARCHAR(255) NOT NULL,
    `purpose` VARCHAR(32) NOT NULL COMMENT 'VOLUME_ENCRYPTION, TLS_CERT, CONFIG_SECRET',
    `account_id` BIGINT UNSIGNED NOT NULL,
    `domain_id` BIGINT UNSIGNED NOT NULL,
    `zone_id` BIGINT UNSIGNED NOT NULL,
    `algorithm` VARCHAR(64) NOT NULL DEFAULT 'AES/GCM/NoPadding',
    `key_bits` INT NOT NULL DEFAULT 256,
    `enabled` TINYINT(1) NOT NULL DEFAULT 1,
    `hsm_profile_id` BIGINT UNSIGNED NOT NULL,
    `created` DATETIME NOT NULL,
    `removed` DATETIME,
    PRIMARY KEY (`id`),
    UNIQUE KEY `uk_uuid` (`uuid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
...

cloud.kms_kek_versions
KEK versions for gradual key rotation. Only one Active version per KMS key at a time.
 Code Block
languagesql
CREATE TABLE IF NOT EXISTS `cloud`.`kms_kek_versions` (
    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
    `uuid` VARCHAR(40) NOT NULL,
    `kms_key_id` BIGINT UNSIGNED NOT NULL,
    `version_number` INT NOT NULL,
    `kek_label` VARCHAR(255) NOT NULL,
    `status` VARCHAR(32) NOT NULL DEFAULT 'Active' COMMENT 'Active, Previous, Archived',
    `hsm_profile_id` BIGINT UNSIGNED,
    `hsm_key_label` VARCHAR(255),
    `created` DATETIME NOT NULL,
    `removed` DATETIME,
    PRIMARY KEY (`id`),
    UNIQUE KEY `uk_uuid` (`uuid`),
    UNIQUE KEY `uk_kms_key_version` (`kms_key_id`, `version_number`, `removed`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
...

cloud.kms_wrapped_key
Wrapped DEKs. Each volume references one wrapped key.
 Code Block
languagesql
CREATE TABLE IF NOT EXISTS `cloud`.`kms_wrapped_key` (
    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
    `uuid` VARCHAR(40) NOT NULL,
    `kms_key_id` BIGINT UNSIGNED,
    `kek_version_id` BIGINT UNSIGNED,
    `zone_id` BIGINT UNSIGNED NOT NULL,
    `wrapped_blob` VARBINARY(4096) NOT NULL,
    `created` DATETIME NOT NULL,
    `removed` DATETIME,
    PRIMARY KEY (`id`),
    UNIQUE KEY `uk_uuid` (`uuid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
...

cloud.kms_database_kek_objects
PKCS#11-compatible object storage for the database KMS provider. Key material is encrypted via DBEncryptionUtil (Base64-encoded KEK → DBEncryptionUtil.encrypt() → stored bytes).
 Code Block
languagesql
CREATE TABLE IF NOT EXISTS `cloud`.`kms_database_kek_objects` (
    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
    `uuid` VARCHAR(40) NOT NULL,
    `object_class` VARCHAR(32) NOT NULL DEFAULT 'CKO_SECRET_KEY',
    `label` VARCHAR(255) NOT NULL,
    `object_id` VARBINARY(64),
    `key_type` VARCHAR(32) NOT NULL DEFAULT 'CKK_AES',
    `key_material` VARBINARY(512) NOT NULL COMMENT 'encrypted KEK material',
    `is_sensitive` BOOLEAN NOT NULL DEFAULT TRUE,
    `is_extractable` BOOLEAN NOT NULL DEFAULT FALSE,
    `purpose` VARCHAR(32) NOT NULL,
    `key_bits` INT NOT NULL,
    `algorithm` VARCHAR(64) NOT NULL DEFAULT 'AES/GCM/NoPadding',
    `created` DATETIME NOT NULL,
    `removed` DATETIME,
    PRIMARY KEY (`id`),
    UNIQUE KEY `uk_uuid` (`uuid`),
    UNIQUE KEY `uk_label` (`label`, `removed`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
...

Modified Tables
cloud.volumes
Two new columns added via schema migration:
 Code Block
languagesql
-- KMS key reference
ALTER TABLE `cloud`.`volumes` ADD COLUMN `kms_key_id` BIGINT UNSIGNED;
ALTER TABLE `cloud`.`volumes` ADD CONSTRAINT `fk_volumes__kms_key_id`
    FOREIGN KEY (`kms_key_id`) REFERENCES `kms_keys`(`id`);

-- Wrapped DEK reference
ALTER TABLE `cloud`.`volumes` ADD COLUMN `kms_wrapped_key_id` BIGINT UNSIGNED;
ALTER TABLE `cloud`.`volumes` ADD CONSTRAINT `fk_volumes__kms_wrapped_key_id`
    FOREIGN KEY (`kms_wrapped_key_id`) REFERENCES `kms_wrapped_key`(`id`);
...
User Interface
A new KMS top-level menu section is added with two sub-sections:
...