Aller au contenu principal

DuoKey on a public cloud

The reference architecture runs on OpenShift and virtual machines. Every part of it has a managed equivalent on the major clouds, so the same DuoKey images and Helm charts run on managed Kubernetes, next to a managed PostgreSQL database and the cloud's secret store. Key custody stays out of the cloud provider's hands: the Software Vault is built in, and the DuoKey MPC KMS or a Securosys HSM can hold customer keys in separate trust domains.

  • Azure: AKS, Application Gateway WAF, PostgreSQL Flexible Server, Key Vault.
  • AWS: EKS, ALB with AWS WAF, RDS for PostgreSQL, Secrets Manager.
  • Google Cloud: GKE, Cloud Load Balancing, Cloud SQL for PostgreSQL, Secret Manager.

Component mapping​

ComponentOn-premise referenceAzureAWSGoogle Cloud
Cockpit frontend and APIOpenShift podsAKS private cluster, 3 zonesEKS private cluster, 3 AZGKE private cluster
HTTPS ingressOpenShift Ingress RouterApplication Gateway WAF v2ALB with AWS WAFCloud Load Balancing to Traefik
KMIP, TCP 5696TCP routeLoad BalancerNetwork Load BalancerTCP load balancer service
Database (required)PostgreSQL clusterPostgreSQL Flexible Server, zone-redundant HARDS for PostgreSQL, Multi-AZCloud SQL for PostgreSQL, private IP
Shared cache (optional)RedisAzure Managed RedisElastiCache (Redis)Memorystore (Redis)
Platform secretsOpenBao, read by External SecretsKey Vault Premium, or OpenBao on AKSSecrets Manager, or OpenBao on EKSSecret Manager, or OpenBao on GKE
Container imagesHarborContainer Registry PremiumAmazon ECRHarbor or Artifact Registry
GitOpsOpenShift GitOps (Argo CD)Argo CDArgo CDArgo CD
ObservabilityVictoriaMetrics, VictoriaLogsAzure Monitor, Log Analytics, Microsoft SentinelCloudWatchCloud Monitoring, or VictoriaMetrics
BackupVelero, object storageAzure Backup, PostgreSQL point-in-time restore, immutable BlobAWS Backup, RDS point-in-time restore, S3Velero to Cloud Storage, Cloud SQL point-in-time restore
Customer key custodySoftware Vault, DuoKey MPC KMS, Securosys HSMSame options, never the cloud KMSSame options, never the cloud KMSSame options, never the cloud KMS

PostgreSQL is the only dependency the Cockpit cannot run without. Without Redis, each replica keeps its own cache and rate-limit counters; add the managed Redis when you run several replicas. The cloud KMS encrypts the platform's disks, database and backups at rest; it does not hold customer root keys.

Deploy and configure as code​

DuoKey provides Terraform scripts and Helm charts for the infrastructure and the Cockpit, and a Terraform provider, duokey/duokey, for what lives inside the Cockpit: editions, tenants and their administrators, tenant settings, vaults, keys, certificate authorities, issuers, identity providers, access policies, webhooks and SIEM destinations.

Pipeline

Deploy and configure DuoKey as code

Deploy and configure DuoKey as codeA pipeline applies Terraform to create the cloud infrastructure, Argo CD deploys the Cockpit charts, and the DuoKey Terraform provider configures editions, tenants and their resources through the host API, with credentials read at run time.YOUR GIT AND CIYOUR CLOUDYour Git repositoryTerraform and Helm valuesCI/CD pipelineAzure DevOps or GitLabSecret storesPassword, TOTP apartCloud infrastructureCluster, database, secretsArgo CDGitOps, Helm charts›kDuoKey CockpitAPI and frontend›kDuoKey providerduokey/duokeyTenant adminsOwn password and 2FATerraform never seestheir password or TOTP.12345678HOW TO READ THIS FIGURE1A merge in your Git repository starts the pipeline2Terraform creates the cluster, database and secret store3Argo CD pulls the Helm values from Git4Argo CD deploys the Cockpit charts, images by digest5The pipeline reads password and TOTP from separate stores6terraform apply runs the DuoKey provider on the CI agent7The provider signs in with 2FA and drives the host API8Each new tenant admin gets a set-your-password email

The pipeline holds no secret of its own: it reads the automation account's password and TOTP secret at run time from two separate stores, so compromising one store does not give the account. New tenant administrators choose their own password and enrol their own authenticator.

The provider signs in with a dedicated automation account protected by two-factor authentication. Tenant-level resources can also use a tenant's machine API key. Ask DuoKey for the provider build and the scripts for your cloud.