KeyEncryptionKey resource

This section describes the KeyEncryptionKey custom resource (CR) used in the MOSK management API to configure backup encryption keys for a MOSK or management cluster prior to uploading the MKE backup to a remote storage.

The KeyEncryptionKey CR contains the following fields:

apiVersion
API version of the object that is kaas.mirantis.com/v1alpha1.
kind
Object type that is KeyEncryptionKey.
metadata
Metadata of the KeyEncryptionKey CR that contains the following fields:
- name
  Name of the KeyEncryptionKey object.
- namespace
  Project name of the cluster that relates to KeyEncryptionKey.
spec
Specification of the KeyEncryptionKey CR that contains the following fields:
- secret
  Name of the Kubernetes secret that contains the encryption key that is used to encrypt the backup data. Contains the following field:
  
  value
  Encryption key that is stored in the Kubernetes secret. Must contain minimum 32 characters.

Configuration example of a KeyEncryptionKey object before creation:

apiVersion: kaas.mirantis.com/v1alpha1
kind: KeyEncryptionKey
metadata:
  name: swift-s3
  namespace: default
spec:
  secret:
    value: <ENCRYPTION_KEY>

Configuration example of a KeyEncryptionKey object after creation containing the mutated metadata and spec sections:

apiVersion: kaas.mirantis.com/v1alpha1
kind: KeyEncryptionKey
metadata:
  creationTimestamp: "2025-12-17T14:09:25Z"
  generation: 1
  name: swift-s3
  namespace: default
  resourceVersion: "19368149"
  uid: 0ebd8f7b-cff3-4efe-af16-7d9bd2229cd3
spec:
  secret:
    secret:
      key: value
      name: swift-s3-dgpvv