Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
En esta página, se incluyen instrucciones para que el operador de aplicaciones (AO) realice operaciones clave de importación desde claves de sistemas de administración de claves (KMS) exportadas. El AO realiza las operaciones de importación y exportación con la interfaz de línea de comandos (CLI) de kubectl desde los siguientes recursos:
Consulta la sección Claves compatibles en la página Sistemas de administración de claves (KMS) para ver la lista completa y los detalles de las claves compatibles con KMS.
Antes de comenzar
Antes de continuar, asegúrate de tener lo siguiente:
Las funciones de administrador de importación de claves de KMS y administrador de exportación de claves de KMS Para obtener los permisos que necesitas para importar una clave exportada, pídele a tu administrador de la plataforma (PA) que te otorgue los roles de administrador de importación de claves de KMS (kms-keyimport-admin) y administrador de exportación de claves de KMS (kms-keyexport-admin).
Importa una clave exportada
Para importar una clave exportada, completa los siguientes pasos:
Crea un archivo YAML y agrega el recurso KeyImport como el valor del objeto kind:
KEY_IMPORT_NAME: El nombre del recurso KeyImport
por ejemplo: key-import-test.
PROJECT: Es el nombre del espacio de nombres del proyecto, por ejemplo, kms-test1.
MECHANISM: Es el mecanismo de uso compartido de la clave. Por ejemplo, `EDCH_P521_AES256` .
Aplica el contenido del archivo YAML al KMS y crea el recurso KeyImport:
kubectlapply-fFILENAME.yaml
Reemplaza FILENAME por el nombre del archivo YAML.
Con la clave pública de un par de claves generado de forma interna, el KMS actualiza el estado del recurso KeyImport a AwaitingKeyToImport. Para continuar, debes ver el estado del recurso y obtener la clave pública generada por KMS.
Para ver el estado del recurso KeyImport y obtener la clave pública generada por KMS, ejecuta el siguiente comando:
KEY_EXPORT_NAME: El nombre del recurso KeyExport
por ejemplo: key-export-test.
PROJECT: Es el nombre del espacio de nombres del proyecto, por ejemplo, kms-test1.
MECHANISM: Es el mecanismo de uso compartido de la clave. Por ejemplo, `EDCH_P521_AES256` .
PUBLIC_KEY: Es la clave pública de keyImport.Status.PeerContext.PublicKey.
KEY_PRIMITIVE: Es el CRD de la clave, por ejemplo, aeadkey y signingkey.
KEY_NAME: Es el nombre de la clave, por ejemplo, key-1.
Aplica el contenido del archivo YAML al KMS y crea el recurso KeyExport:
kubectlapply-fFILENAME.yaml
Reemplaza FILENAME por el nombre del archivo YAML.
Después de ejecutar el comando, el KMS actualiza el estado del recurso KeyExport y genera una clave exportada. Para obtener la clave exportada, consulta el estado del recurso.
Para ver el estado del recurso, ejecuta el siguiente comando:
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-05 (UTC)"],[[["\u003cp\u003eThis page outlines how Application Operators (AOs) can import keys from exported key management systems (KMS) using the \u003ccode\u003ekubectl\u003c/code\u003e command-line interface (CLI).\u003c/p\u003e\n"],["\u003cp\u003eKey import and export operations are managed through the \u003ccode\u003eKeyImport\u003c/code\u003e and \u003ccode\u003eKeyExport\u003c/code\u003e resources, respectively, detailed in the KMS API overview.\u003c/p\u003e\n"],["\u003cp\u003eBefore starting, AOs must have \u003ccode\u003ekubectl\u003c/code\u003e configured for Management API server access and possess the KMS Key Import Admin and KMS Key Export Admin roles.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves creating YAML files for \u003ccode\u003eKeyImport\u003c/code\u003e and \u003ccode\u003eKeyExport\u003c/code\u003e resources, applying them via \u003ccode\u003ekubectl\u003c/code\u003e, and managing key status and metadata.\u003c/p\u003e\n"],["\u003cp\u003eThe steps include generating a public key, using it in a \u003ccode\u003eKeyExport\u003c/code\u003e resource, obtaining an exported key, and finally using that key to complete a \u003ccode\u003eKeyImport\u003c/code\u003e resource.\u003c/p\u003e\n"]]],[],null,["# Import and export keys\n\nThis page covers instructions for the Application Operator (AO) to perform key\nimport operations from exported key management systems (KMS) keys. The AO\nperforms the import and export operations using the `kubectl` command\nline interface (CLI) from the following resources:\n\n- [`KeyImport`](/distributed-cloud/hosted/docs/latest/gdch/apis/service/kms/kms-api-overview#keyimport)\n- [`KeyExport`](/distributed-cloud/hosted/docs/latest/gdch/apis/service/kms/kms-api-overview#keyexport)\n\nTo view more details on these resources, see the\n[KMS API overview](/distributed-cloud/hosted/docs/latest/gdch/apis/kms-api-overview).\n\nRefer to the [Supported keys](./kms#supported-keys) section in the\n*Key management systems (KMS)* page to view the full list and details of KMS\nsupported keys.\n\nBefore you begin\n----------------\n\nBefore continuing, ensure you have the following:\n\n- The `kubectl` command configured to access the Management API server. To do this,\n follow the sections [Get a kubeconfig file](/distributed-cloud/hosted/docs/latest/gdch/resources/gdcloud-auth#get-kubeconfig)\n and [gdcloud command-line interface (CLI)](/distributed-cloud/hosted/docs/latest/gdch/resources/gdcloud-overview).\n\n- The KMS Key Import Admin and KMS Key Export Admin roles. To get the\n permissions that you need to import an exported key, ask your\n Platform Administrator (PA) to grant you the KMS Key Import Admin\n (`kms-keyimport-admin`) and the KMS Key Export Admin (`kms-keyexport-admin`)\n roles.\n\nImport an exported key\n----------------------\n\nTo import an exported key, complete the following steps:\n\n1. Create a YAML file, and add in the `KeyImport` resource as the value of the\n `kind` object:\n\n apiVersion: \"kms.gdc.goog/v1\"\n kind: KeyImport\n metadata:\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eKEY_IMPORT_NAME\u003c/span\u003e\u003c/var\u003e\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003ePROJECT\u003c/span\u003e\u003c/var\u003e\n spec:\n context:\n mechanism: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eMECHANISM\u003c/span\u003e\u003c/var\u003e\n\n Replace the following variables:\n - \u003cvar translate=\"no\"\u003eKEY_IMPORT_NAME\u003c/var\u003e: the name of the `KeyImport` resource --- for example: `key-import-test`.\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the name of the project namespace --- for example: `kms-test1`.\n - \u003cvar translate=\"no\"\u003eMECHANISM\u003c/var\u003e: the key sharing mechanism of the key --- for example: \\`EDCH_P521_AES256\\` .\n2. Apply the contents of the YAML file to the KMS and create the `KeyImport`\n resource:\n\n kubectl apply -f \u003cvar translate=\"no\"\u003eFILENAME\u003c/var\u003e.yaml\n\n Replace \u003cvar translate=\"no\"\u003eFILENAME\u003c/var\u003e with the name of the YAML file.\n\n With the public key of an internally generated key pair, the KMS updates\n the status of the `KeyImport` resource to `AwaitingKeyToImport`. To\n continue, you need to view the status of the resource and obtain the KMS\n generated public key.\n3. To view the status of `KeyImport` resource and obtain the KMS generated\n public key, run the following:\n\n kubectl describe keyimport \u003cvar translate=\"no\"\u003eKEY_IMPORT_NAME\u003c/var\u003e --namespace \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n Replace the following variables:\n - \u003cvar translate=\"no\"\u003eKEY_IMPORT_NAME\u003c/var\u003e: the `KeyImport` resource name --- for example, `key-import-test`.\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the name of the project namespace --- for example: `kms-test1`.\n\n After running the command, you see output similar to the following: \n\n ...\n Status:\n Conditions:\n Last Transition Time: 2022-12-14T20:43:50Z\n Message: waiting for user to provide KeyToImport\n Observed Generation: 1\n Reason: AwaitingKeyToImport\n Status: False\n Type: Ready\n Imported Key Ref:\n Kind: KeyImport\n Name: key-import-test\n Peer Context:\n Private Key:\n Public Key: \u003cvar translate=\"no\"\u003ePUBLIC_KEY\u003c/var\u003e\n Events: \u003cnone\u003e\n\n The value \u003cvar translate=\"no\"\u003ePUBLIC_KEY\u003c/var\u003e represents the KMS generated public\n key. Copy the public key, and add it to the `KeyExport` resource in the\n following step.\n4. Create another YAML file, add in the `KeyExport` resource as the value of\n the `kind` object, and the following contents:\n\n apiVersion: \"kms.gdc.goog/v1\"\n kind: KeyExport\n metadata:\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eKEY_EXPORT_NAME\u003c/span\u003e\u003c/var\u003e\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003ePROJECT\u003c/span\u003e\u003c/var\u003e\n spec:\n context:\n mechanism: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eMECHANISM\u003c/span\u003e\u003c/var\u003e\n publicKey: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003ePUBLIC_KEY\u003c/span\u003e\u003c/var\u003e\n keyToExport:\n kind: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eKEY_PRIMITIVE\u003c/span\u003e\u003c/var\u003e\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eKEY_NAME\u003c/span\u003e\u003c/var\u003e\n\n Replace the following variables:\n - \u003cvar translate=\"no\"\u003eKEY_EXPORT_NAME\u003c/var\u003e: the name of the `KeyExport` resource --- for example: `key-export-test`.\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the name of the project namespace --- for\n example: `kms-test1`.\n\n | **Important:** The `KeyExport` custom resource definition (CRD) must reside in the same project namespace of the imported key. If the imported key resides in the project namespace `kms-test1`, the `KeyExport` CRD must also reside in the same project namespace.\n - \u003cvar translate=\"no\"\u003eMECHANISM\u003c/var\u003e: the key sharing mechanism of the key ---\n for example: \\`EDCH_P521_AES256\\` .\n\n - \u003cvar translate=\"no\"\u003ePUBLIC_KEY\u003c/var\u003e: the public key from\n `keyImport.Status.PeerContext.PublicKey`.\n\n - \u003cvar translate=\"no\"\u003eKEY_PRIMITIVE\u003c/var\u003e: the CRD of the key---for example,\n aeadkey and signingkey.\n\n - \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e: the name of the key---for example, `key-1`.\n\n5. Apply the contents of the YAML file to the KMS and create the `KeyExport`\n resource:\n\n kubectl apply -f \u003cvar translate=\"no\"\u003eFILENAME\u003c/var\u003e.yaml\n\n Replace \u003cvar translate=\"no\"\u003eFILENAME\u003c/var\u003e with the name of the YAML file.\n\n After running the command, the KMS updates the status of the `KeyExport`\n resource and generates an exported key. To obtain the exported key, view\n the resource's status.\n6. To view the resource's status, run the following:\n\n kubectl describe keyexport \u003cvar translate=\"no\"\u003eKEY_EXPORT_NAME\u003c/var\u003e --namespace \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n Replace the following variables:\n - \u003cvar translate=\"no\"\u003eKEY_EXPORT_NAME\u003c/var\u003e: the name of the `KeyExport` resource --- for example, `key-export-test`.\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the name of the project namespace---for example: `kms-test1`.\n\n After running the command, you see an output similar to the following: \n\n ...\n Status:\n Conditions:\n Last Transition Time: 2022-12-14T20:45:57Z\n Message: key successfully exported\n Observed Generation: 1\n Reason: KeyExportCompleted\n Status: True\n Type: Ready\n Exported Key: \u003cvar translate=\"no\"\u003eEXPORTED_KEY\u003c/var\u003e\n\n \u003cvar translate=\"no\"\u003eEXPORTED_KEY\u003c/var\u003e represents the metadata of the exported key.\n Copy the contents in \u003cvar translate=\"no\"\u003eEXPORTED_KEY\u003c/var\u003e to continue to the\n following step.\n7. Edit the YAML file that contains the `KeyImport` resource, and add in the\n contents you copied from the output in `keyexport.status.exportedkey`.\n\n apiVersion: \"kms.gdc.goog/v1\"\n kind: KeyImport\n metadata:\n name: key-import-test\n namespace: kms-test1\n spec:\n context:\n mechanism: EDCH_P521_AES256\n keyToImport: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eEXPORTED_KEY\u003c/span\u003e\u003c/var\u003e\n\n8. After editing the YAML file, apply the contents to the KMS:\n\n kubectl apply -f \u003cvar translate=\"no\"\u003eFILENAME\u003c/var\u003e.yaml\n\n After running the command, the KMS imports the exported key you provided.\n9. To view details on the imported key, run the following:\n\n kubectl get keyimport \u003cvar translate=\"no\"\u003eKEY_IMPORT_NAME\u003c/var\u003e\n\n You see output similar to the following: \n\n NAMESPACE NAME AGE READY REASON KEY KIND\n kms-test1 \u003cvar translate=\"no\"\u003eKEY_IMPORT_NAME\u003c/var\u003e 60s True KeyImportCompleted \u003cvar translate=\"no\"\u003eKEY_PRIMITIVE\u003c/var\u003e\n\n \u003cvar translate=\"no\"\u003eKEY_PRIMITIVE\u003c/var\u003e represents the kind of key you\n imported, between the AEAD and Signing keys."]]
