Skip to content
DataQI Documentation

Data protection certificate

Overview

Section titled “Overview”

The dataqi-api workload uses Data Protection keys. To securely persist and encrypt these keys, DataQI uses an X.509 certificate (provided as a PFX file) provisioned via a Kubernetes Secret in the Helm deployment.

Important: This certificate is used exclusively by the dataqi-api workload for encrypting connection credentials that are stored at rest in the API database. No other workloads require or mount this secret. It is not used for TLS, ingress routing, or any other external communication.

This guide provides instructions on how to generate the required PFX certificate and inject it into your cluster as a secret.

1. Generate the PFX certificate

Section titled “1. Generate the PFX certificate”

You can use openssl to generate a self-signed certificate. Since this certificate is only used internally for symmetric key encryption at rest, a self-signed certificate with a long expiry is perfectly sufficient. There is no trust relationship required with any external systems.

  1. Generate a self-signed certificate and private key (valid for 10 years):

    Terminal window
    openssl req -x509 -newkey rsa:4096 -keyout dp-key.pem -out dp-cert.pem -sha256 -days 3650 -nodes -subj "/CN=DataQI Data Protection"

  2. Package them into a PFX file (you will be prompted to enter an export password):

    Terminal window
    openssl pkcs12 -export -out dataprotection.pfx -inkey dp-key.pem -in dp-cert.pem

    Note: Remember the password you provide here, as it will be required when creating the Kubernetes secret.

2. Create the Kubernetes secret

Section titled “2. Create the Kubernetes secret”

DataQI strictly follows a “Day 2” secret model. You must inject the certificate directly into the cluster as a binary Kubernetes secret before running helm install.

Do not attempt to Base64 encode this file manually or embed it in your values.yaml file, as doing so can cause double-encoding corruption.

Create the secret directly from the binary dataprotection.pfx file you generated above:

Terminal window
kubectl create secret generic dataqi-api-data-protection \
  --from-file=dataprotection.pfx=./dataprotection.pfx \
  --from-literal=certificate-password="<password>" \
  -n <namespace>

For more information about secret configuration for DataQI, see Secrets management.