Skip to main content

DuoKey on Google Cloud

This is the pattern the DuoKey SaaS platform runs on: a private GKE cluster with Workload Identity, Traefik behind a passthrough load balancer, Cloud SQL for PostgreSQL on a private IP, and boot secrets in Secret Manager, read by External Secrets without any service-account key.

Reference landscape

DuoKey on Google Cloud, every component

DuoKey on Google CloudClients reach a passthrough load balancer in front of Traefik; the Cockpit runs on a private GKE cluster with Cloud SQL for PostgreSQL, Secret Manager and Cloud Storage backups; keys stay with MPC nodes in separate trust domains.GOOGLE CLOUD · YOUR PROJECT · ONE REGIONVPC EDGEGKE PRIVATE CLUSTER · WORKLOAD IDENTITYPRIVATE IP ONLYKEY CUSTODYUsers, Microsoft 365DKE, KMS and API clientsKMIP clientsStorage arrays, databasesYour operatorsSSO and MFADuoKey releasesImages by digestYour Git repositoryHelm values, TerraformCloud IAMWorkload IdentityMonitoringMetrics and logsCloud KMSAt-rest keys onlyLoad BalancingTo Traefik ingressKMIP serviceTCP 5696Cloud NATEgress, static IPInterconnector Cloud VPNHarboror Artifact Registry›kCockpit frontendSingle-page app›kCockpit APIDKE, KMS, KMIP, PKIArgo CDGitOps, one appExternal SecretsWorkload IdentityMemorystore (Redis)Optional shared cacheCloud SQL PostgreSQLPrivate IP, PITRCloud StorageVelero backupsSecret ManagerBoot secrets›kMPC node AKey share, in this cloud›kMPC node BYour data centre›kMPC node CThird trust domainSecurosys HSMOptional hardware rootThe Software Vault is built in.MPC and HSM are optional backends.11223456789HOW TO READ THIS FIGUREDuoKey componentCloud or partner serviceOptional1Clients reach the load balancer, the only public entry2HTTPS goes to the frontend and API, KMIP TCP to the API3The API uses PostgreSQL over a private endpoint4The API reaches its key custody backend over mutual TLS5External Secrets reads Secret Manager with workload identity6Argo CD applies the Helm values from your Git repository7DuoKey images are imported by digest into your registry8Operators come in over Interconnect or VPN, with SSO and MFA9MPC nodes in separate trust domains use mutual TLS

The cluster nodes and Cloud SQL have private addresses only; outbound traffic leaves through Cloud NAT. Velero backs the cluster up to Cloud Storage, and Cloud SQL keeps point-in-time recovery. Customer root keys stay with the Software Vault, the MPC nodes or the HSM.

Choices to make​

  • Registry. Run Harbor on the cluster, as the DuoKey SaaS does, or use Artifact Registry.
  • Platform secrets. Secret Manager with External Secrets and Workload Identity, or OpenBao on GKE.
  • Key custody per customer segment. The DuoKey MPC KMS with nodes in separate trust domains, a Securosys HSM, or both.
  • Availability. A zonal cluster with a node pool spread over three zones, or a regional cluster.