Skip to content
This repository has been archived by the owner on Dec 4, 2019. It is now read-only.

Commit

Permalink
Rename to citadel: Update README
Browse files Browse the repository at this point in the history
This change updates the README to refer to the daemon as "citadel"
or "c5l" for short.  KMS now only refers to the Kubernetes interface.

Signed-off-by: Monis Khan <mkhan@redhat.com>
  • Loading branch information
enj committed Mar 29, 2018
1 parent e31361e commit 9b46f75
Showing 1 changed file with 8 additions and 8 deletions.
16 changes: 8 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,21 +1,21 @@
# Welcome to KMS!
# Welcome to Citadel!

KMS is a simple daemon that implements the Kubernetes Key Management Service
Citadel (c5l) is a simple daemon that implements the Kubernetes Key Management Service (KMS)
interface by acquiring a key encryption key (KEK) from an arbitrary command.
This makes it easy to plug in your own key management solution as a simple unix
command that returns the KEK.

## How does it work?

When KMS starts, it runs the command you provide it. This command returns the
KEK on standard output. If this command fails during startup, the KMS will exit.
When c5l starts, it runs the command you provide it. This command returns the
KEK on standard output. If this command fails during startup, c5l will exit.
Otherwise, it will use the KEK from the command to encrypt and decrypt input
from Kubernetes.

KMS caches the KEK, and thus does not call the command on every incoming
c5l caches the KEK, and thus does not call the command on every incoming
request. The time limit of this cache is specified by the `timeout` argument.
If the KMS is not able to refresh the cache after trying several times, it will
purge the KEK and report errors to Kubernetes. If the KMS eventually succeeds
If c5l is not able to refresh the cache after trying several times, it will
purge the KEK and report errors to Kubernetes. If c5l eventually succeeds
in acquiring the KEK, normal operation will resume.

To specify the socket to create, use the `endpoint` argument. Otherwise,
Expand All @@ -29,7 +29,7 @@ socket activation is assumed.

### Optional

* `--endpoint string`: the listen address (ex. `unix:///tmp/kms.sock`)
* `--endpoint string`: the listen address (ex. `unix:///tmp/socket`)

* `--timeout duration`: maximum time to cache KEK locally (default 1h)

Expand Down

0 comments on commit 9b46f75

Please sign in to comment.