Keyhouse: Production-ready Key Management Service in Rust
summary
Production Keyhouse is a Rust monolithic KMS that replaces a Go predecessor and uses etcd as authoritative storage, Spire for mTLS identity, and HSM-backed master keys with envelope encryption. It runs several pods serving tens of thousands of services, caches the full keyset (a few megabytes) so each pod is a read replica, and performs key ops with intermediate keys rotate every 24 hours to limit HSM usage. Authors open-source Keyhouse plus spire-workload-rs and spire-proxy; deployment shows large CPU/memory savings and stable production use.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:28Keyhouse
- 3:39Design considerations
- 8:32Cache infrastructure
- 10:11Spiffy
- 11:20How does Keyhouse useSpiffy
- 12:26Keyhouse key hierarchy
- 13:41Keyhouse master key
- 14:09Keyhouse intermediate key
- 15:42Customer keys
- 16:13Data keys
- 17:54Secrets
- 18:39Key Rings
- 19:18Keyhouse Authorization
- 20:19Next Steps
related talks
38mHow to Distribute Keys Securely for 20% of the Web
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
39mManaging and securing Kubernetes secrets - Simon Pearce
32mCare and Feeding of HSMs: Key Management in Hard Mode
51mUsing Key Management Service for data protection
38mHardware-based KMS Plug-in to Protect Secrets in Kubernetes
36mTaking Rust to Production: Lessons Learned From the Habitat Project
28mYour Secrets in Cloud-Based Key Management Services