Skip to content
Kānuka

Registration and Removal

When a new user joins the project for the first time, they will not have access to the system — it would be a bit concerning if they did! The diagram below demonstrates the missing piece for a new user, assuming they have already ran kanuka secrets create and committed their changes to version control.

A diagram showing the process of how a symmetric key is encrypted and decrypted, with one missing component A diagram showing the process of how a symmetric key is encrypted and decrypted, with one missing component

When a user with access runs:

Terminal window
# Using the example's username
kanuka secrets register --user user_2

Kānuka does the following two steps:

  1. Kānuka will decrypt user_1’s encrypted AES key.
  2. Kānuka will then use the symmetric key and combine it with user_2’s public key.
A diagram version of the two steps described above A diagram version of the two steps described above

How does Kānuka handle both OpenSSH and PEM format?

Section titled “How does Kānuka handle both OpenSSH and PEM format?”

If the RSA encryption standard is like a destination, OpenSSH and PEM are the different ways to get there. At the end of the day, they are both representations of the same thing. Under the hood, Kānuka converts everything to PEM format before using or storing it.

How does Kānuka remove other users?

Section titled “How does Kānuka remove other users?”

By simply deleting a user’s encrypted AES key and their public key, that user will no longer have access to the secrets, and no other user can accidentally give them access again.

Continue reading to see how purging works with Kānuka.