Global Data Orchestrator Package Encryption#

Before publishing or deploying packages through Global Data Orchestrator ↗, a system administrator must generate an encryption key pair and configure Secrets for the source and destination Customer Environments. The installer does not generate the keys.

Global Data Orchestrator uses elliptic-curve Diffie–Hellman (ECDH) key agreement to protect package encryption keys. The source Customer Environment uses the public key during package encryption. Each destination uses the corresponding private key during package decryption.

EC Key Requirements#

The elliptic curve (EC) key pair must meet the following requirements:

Table: Global Data Orchestrator EC Key Requirements

The public-key PEM must include these delimiters:

-----BEGIN PUBLIC KEY-----
...Base64-encoded public key...
-----END PUBLIC KEY-----

Generate a Key Pair with OpenSSL#

Before starting, make sure OpenSSL is available.

1. Generate an EC private key using the required curve and named-curve encoding:

   openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -pkeyopt ec_param_enc:named_curve -out private-key.pem
   

   This command produces an unencrypted PKCS#8 PEM private key, delimited by -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----.

2. Extract the corresponding public key in SPKI PEM format:

   openssl pkey -in private-key.pem -pubout -out public-key.pem
   

3. Validate the key pair and public key:

   openssl pkey -in private-key.pem -check -noout
   openssl pkey -pubin -in public-key.pem -pubcheck -noout
   

4. Inspect the public key to confirm the curve:

   openssl pkey -pubin -in public-key.pem -text -noout
   

   The output should include:

   ASN1 OID: prime256v1
   NIST CURVE: P-256
   

For command details, see the OpenSSL documentation for openssl genpkey and openssl pkey ↗.

Configure the Secrets#

1. Open the source Customer Environment page and locate its Definition Id.
2. Use the key pair generated in Generate a Key Pair with OpenSSL.
3. Create a Kubernetes Secret named {CoE.DefinitionId}-globaldataorchestrator in the namespace of the source Customer Environment and each destination Customer Environment. Use the source Customer Environment's Definition Id when naming every Secret. For instructions, see Kubernetes Sensitive Data ↗ in Customer Portal.

4. Populate the Secret entries with the complete PEM contents, including the delimiters. Use public-key.pem for public-key and private-key.pem for private-key. By convention, each Secret contains both public-key and private-key. The entry used by each environment is shown in the table below.

   Environment	Entry Used	Value
   Source Customer Environment	public-key	The public key used during package encryption.
   Destination Customer Environment	private-key	The corresponding private key used during package decryption.

5. Confirm that each destination's private key belongs to the same key pair as the source's public key.

Automatic Key References#

Critical Manufacturing MES setup calculates the source public-key reference automatically. The destination deployment process derives the private-key reference from the source Customer Environment's Definition Id. Administrators must still provide the key material in the required Secrets.