Secara default, data berikut disimpan terenkripsi di platform runtime
campuran:
Data sistem pengelolaan kunci (KMS)
Data peta nilai kunci (KVM)
Menyimpan data ke dalam cache
Enkripsi data tidak memerlukan konfigurasi khusus dari Anda. Namun, jika
karena alasan tertentu Anda ingin menggunakan kunci enkripsi Anda sendiri (mengganti kunci default), Anda dapat
melakukannya, seperti yang dijelaskan dalam topik ini.
Cakupan kunci enkripsi
Kunci enkripsi untuk KMS, KVM, dan cache memiliki cakupan. Misalnya, kunci KMS memiliki cakupan organisasi. Artinya, kunci tersebut digunakan untuk mengenkripsi data KMS bagi seluruh organisasi.
Tabel berikut mencantumkan cakupan untuk setiap jenis kunci:
Kunci enkripsi
Cakupan
KMS
Khusus organisasi
KVM
Organisasi atau lingkungan
Jika kebijakan KVM
menentukan cakupan apiproxy atau policy
(revisi proxy API), kunci tingkat organisasi
akan digunakan untuk mengenkripsi data. Untuk ringkasan umum tentang cara KVM digunakan di Apigee
Edge, lihat Menggunakan peta nilai kunci.
Cache
Khusus lingkungan
Tentang kunci enkripsi default
Secara default, Apigee hybrid menyediakan kumpulan kunci yang dienkode Base64 yang digunakan untuk
mengenkripsi data KVM, KMS, dan cache. Penginstal campuran Apigee menyimpan kunci di
platform runtime sebagai
Kubernetes
Secrets, dan menggunakannya untuk mengenkripsi data Anda dengan enkripsi standar AES-128.
Kunci berada di bawah kontrol Anda;
platform pengelolaan campuran tidak pernah mengetahuinya kapan saja.
Mengubah kunci enkripsi default
Meskipun tidak diperlukan, Anda dapat mengubah kunci enkripsi default jika mau.
Untuk mengganti satu atau beberapa kunci default, ikuti langkah-langkah berikut:
Salin stanza berikut ke dalam file penggantian Anda.
Konfigurasi ini memungkinkan Anda mengubah kunci enkripsi KMS dan KVM untuk tingkat organisasi serta kunci enkripsi KVM dan cache untuk tingkat lingkungan:
Buat kunci baru untuk setiap kunci yang ingin Anda ganti. Setiap
kunci harus berupa string yang dienkode Base64 dengan panjang tepat 16, 24, atau 32 byte.
Lihat juga Cara membuat kunci
encode.
Ganti kunci default dengan kunci baru. Dalam contoh ini, semua kunci default diganti dengan kunci:
Jika Anda menghapus kunci enkripsi dalam file penggantian saat pertama kali menginstal Apigee hybrid, Anda akan menonaktifkan enkripsi secara efektif dan nilai akan disimpan tanpa dienkripsi.
Jika pada waktu
berikutnya Anda mengaktifkan enkripsi dengan memberikan kunci,
data yang ada akan tetap tidak dienkripsi; namun, data mendatang yang ditambahkan akan
dienkripsi. Sistem
akan terus berfungsi seperti biasa dengan data yang tidak dienkripsi dan data
baru yang dienkripsi.
Selain itu, perhatikan bahwa
Anda tidak dapat mengubah kunci enkripsi
setelah data runtime dienkripsi.
Cara membuat kunci yang dienkode
Kunci yang dienkode Base-64 dan diformat dengan benar diperlukan untuk enkripsi KVM, KMS, dan cache.
Kunci yang digunakan untuk tujuan ini harus dienkode Base-64 dari string yang panjangnya 16, 24, atau
32 byte, seperti yang dijelaskan di bawah:
Contoh perintah berikut menghasilkan string yang sesuai, yang dihasilkan secara acak, berenkode Base64, dan terdiri dari 32 karakter:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[[["\u003cp\u003eApigee hybrid encrypts KMS, KVM, and cache data by default, using AES-128 encryption with Base64-encoded keys.\u003c/p\u003e\n"],["\u003cp\u003eEncryption keys have different scopes: KMS keys have organization scope, KVM keys can have organization or environment scope, and cache keys have environment scope.\u003c/p\u003e\n"],["\u003cp\u003eYou can replace the default encryption keys with your own keys during the initial installation of Apigee hybrid, but changing keys after the runtime is created will render previously encrypted data unusable.\u003c/p\u003e\n"],["\u003cp\u003eTo change encryption keys, you need to generate Base64-encoded strings that are 16, 24, or 32 bytes long, and update your overrides file with the new keys, then apply them via either Helm or \u003ccode\u003eapigeectl\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eIf encryption is initially disabled and later enabled, existing data remains unencrypted, while new data will be encrypted, and the system can function normally with both encrypted and unencrypted data.\u003c/p\u003e\n"]]],[],null,["# Data encryption\n\n| You are currently viewing version 1.11 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nBy default, the following data is stored *encrypted* in the hybrid\nruntime plane:\n\n- Key management system (KMS) data\n- Key-value map (KVM) data\n- Cache data\n\n\nData encryption does not require any special configuration on your part. However, if\nfor some reason you want to use your own encryption keys (replacing the default ones) you can\ndo so, as explained in this topic.\n\nEncryption key scope\n--------------------\n\n\nEncryption keys for KMS, KVM, and cache have scope. For example, KMS keys have *organization*\nscope. This means that the key is used to encrypt KMS data for the entire organization.\nThe following table lists the scope for\neach type of key:\n\nAbout the default encryption keys\n---------------------------------\n\n\nBy default, Apigee hybrid provides a set of Base64-encoded keys that are used to\nencrypt KVM, KMS, and cache data. The Apigee hybrid installer stores the keys in the\nruntime plane as\n[Kubernetes\nSecrets](https://kubernetes.io/docs/concepts/configuration/secret/), and uses them to encrypt your data with AES-128 standard encryption.\nThe keys are under your control;\nthe hybrid management plane is never aware of them at any time.\n| The default keys will work for most use cases. If you want to change the default encryption keys, do so when you initially install Apigee hybrid into a new cluster. If you change the encryption keys after the runtime is created in your cluster, previously encrypted data can no longer work (it cannot be decrypted); only new data added after the change will be encrypted and function as expected.\n\nChanging the default encryption keys\n------------------------------------\n\n\nAlthough not required, you can change any of the default encryption keys if you wish.\nTo replace one or more default keys, follow these steps:\n| If you change the encryption keys after the runtime is created in your cluster, previously encrypted data can no longer work (it cannot be decrypted); only new data added after the change will be encrypted and function as expected.\n\n1. Copy the following stanzas into your overrides file. This configuration lets you change the KMS and KVM encryption keys for the organization level and the KVM and cache encryption keys for the environment level: \n\n ```actionscript-3\n defaults:\n org:\n kmsEncryptionKey: base64-encoded-key\n kvmEncryptionKey: base64-encoded-key\n env:\n kvmEncryptionKey: base64-encoded-key\n cacheEncryptionKey: base64-encoded-key\n ```\n2. Generate a new key for each key you wish to replace. Each key must be a Base64-encoded string that is exactly **16, 24, or 32 bytes long** . See also [How to create an encoded\n key](#how-to-create-an-encoded-key).\n3. Replace the default keys with new ones. In this example, all of the default keys are replaced with keys: \n\n ```actionscript-3\n defaults:\n org:\n kmsEncryptionKey: \"JVpTb1FwI0otUHo2RUdRN3pnVyQqVGlMSEFAJXYmb1c=\"\n kvmEncryptionKey: \"T3VkRGM1U3cpOFgtNk9fMnNZU2NaSVA3I1BtZWxkaUU=\"\n env:\n kvmEncryptionKey: \"Q3h6M3R6OWdBeipxTURfKjQwQVdtTng2dU5mODFHcyE=\"\n cacheEncryptionKey: \"b2NTVXdKKjBzN0NORF9XSm9tWFlYKGJ6NUhpNystJVI=\"\n ```\n4. Apply the overrides file to your cluster as follows:\n - If you change KVM or Cache keys, update only the environment:\n\n ### Helm\n\n ```\n helm upgrade ENV_NAME apigee-env/ \\\n --namespace apigee \\\n --atomic \\\n --set env=ENV_NAME \\\n -f OVERRIDES_FILE.yaml\n ```\n | **Note:** If you see an error saying `Error: UPGRADE FAILED: \"`*ENV_NAME*`\" has no deployed releases`, replace `upgrade` with `install` and try the command again.\n\n ### `apigeectl`\n\n ```\n $APIGEECTL_HOME/apigeectl apply -f OVERRIDES_FILE.yaml --env ENV_NAME\n ```\n - If you change KMS keys, update both the org and environment:\n\n ### Helm\n\n ```\n helm upgrade ORG_NAME apigee-org/ \\\n --namespace apigee \\\n --atomic \\\n -f OVERRIDES_FILE.yaml\n ``` \n\n ```\n helm upgrade ENV_NAME apigee-env/ \\\n --namespace apigee \\\n --set env=ENV_NAME \\\n --atomic \\\n -f OVERRIDES_FILE.yaml\n ```\n | **Note:** If you see an error saying `Error: UPGRADE FAILED: \"`*ORG_NAME*`\" has no deployed releases`, replace `upgrade` with `install` and try the command again.\n\n ### `apigeectl`\n\n ```\n $APIGEECTL_HOME/apigeectl apply -f OVERRIDES_FILE.yaml --env ENV_NAME --org \u003cvar translate=\"no\"\u003eORG_NAME\u003c/var\u003e\n ```\n\nA note about backward compatibility\n-----------------------------------\n\n\nIf you were to remove the encryption keys in your overrides file the first\ntime you install Apigee hybrid, you would\neffectively disable encryption and values would be stored unencrypted.\nIf at a later\ntime you enable encryption by providing keys,\nexiting data remains unencrypted; however, any future data that is added will\nbe encrypted. The system\nwill continue working normally with the unencrypted data and the new encrypted\ndata.\n\n\nAlso, note that\nyou cannot later change the encryption keys\nonce the runtime data is encrypted.\n\nHow to create an encoded key\n----------------------------\n\n\nA properly formatted Base-64-encoded key is required for KVM, KMS, and cache encryption.\nThe key used for any of these purposes must be Base-64 encoded from a string that is 16, 24, or\n32 bytes long, as explained below:\n| The key string length requirement exists because the [Advanced\n| Encryption Standard](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) (AES) cipher works on a block size of 128 bits, but can take three different key lengths: 128, 192, and 256 bits (16, 24, or 32 bytes).\n\n\nThe following example command generates a suitable, randomly generated, 32 character,\nBase64-encoded string: \n\n```\nhead -c 32 /dev/random | openssl base64\n```"]]
