Secure credential storage and encryption

Automation orchestrator encrypts all credential field values at rest, protecting stored authentication data from unauthorized access.

All credential data is encrypted in the database using AES-256-GCM encryption, including non-sensitive fields such as usernames and hostnames. Values are decrypted only when needed for API responses or workflow execution, and are never exposed in logs, workflow definitions, or execution output.

The encryption key is a 256-bit value that you configure at deployment time. If the key is compromised or your security policy requires periodic rotation, you can re-encrypt all stored credentials with a new key. Key rotation is an offline operation that requires stopping the automation orchestrator backend.

Encryption at rest

Automation orchestrator uses AES-256-GCM encryption to protect all credential field values stored in the database, including both secret and non-secret fields.

Encrypting credential data at rest means that even if someone gains access to the underlying database, stored credential values are not readable without the encryption key. Automation orchestrator uses AES-256-GCM, an authenticated encryption algorithm that protects data confidentiality and detects unauthorized modification. If stored ciphertext is tampered with, decryption fails rather than returning corrupted values.

Encryption parameters

Table 1. Encryption parameters
Parameter	Value	Notes
Algorithm	AES-256-GCM	Authenticated encryption with associated data (AEAD)
Key size	256-bit (32 bytes)	Provided as a 64-character hexadecimal string
Nonce	96-bit	Randomly generated per field per encryption operation
Authentication	GCM authentication tag	Detects tampering. Decryption fails if ciphertext is modified.

What is encrypted

Both secret fields (passwords, tokens, keys) and non-secret fields (usernames, hostnames) are encrypted in the database. This approach simplifies data classification and reduces the risk of accidentally storing sensitive values unencrypted.

Values are decrypted only when needed for API responses or workflow execution, and are not held in memory longer than required.

Configure the credential encryption key

Automation orchestrator requires a 256-bit encryption key to protect stored credential values. You configure the key before deploying, and it persists as a Kubernetes Secret that the operator mounts into the backend pod.

Before you begin

You have cluster administrator access to the OpenShift cluster where automation orchestrator is deployed.

About this task

You configure the key before deploying, and it persists as a Kubernetes Secret that the operator mounts into the backend pod.

Warning:

If secretEncryptionKeySecretRef is not set in the custom resource, the operator auto-generates an encryption key. The auto-generated key is not backed up and cannot be recovered if lost. Configure a custom key before creating any credentials in a production deployment.

Procedure

Generate a 256-bit encryption key:
```
$ openssl rand -hex 32
```
The output is a 64-character hexadecimal string. Save this value. You need it in the next step.
Create a Kubernetes Secret containing the encryption key:
```
$ oc create secret generic secret-name \
    --from-literal=secret-encryption-key=64-char-hex-key \
    -n namespace
```
Where:
- secret-name is a name for the Secret, such as ao-encryption-key.
- 64-char-hex-key is the value generated in the previous step.
- namespace is the namespace where automation orchestrator is deployed.
The Secret key must be named secret-encryption-key. The operator mounts it as a file and sets the path as APP_SECRET_ENCRYPTION_KEY_PATH in the backend pod.
Edit the AutomationOrchestrator custom resource to reference the Secret:
```
$ oc edit automationorchestrator cr-name -n namespace
```
Add the secretEncryptionKeySecretRef field under spec.secrets:
```
spec:
  secrets:
    secretEncryptionKeySecretRef:
      name: secret-name
```
Save and close the editor.

The operator reconciles the change and restarts the backend pod to apply the new key.

Results

Confirm that the encryption key is active by checking that the environment variable is present in the backend pod:

$ oc exec -n namespace deployment/cr-name-backend -c backend -- env | grep APP_SECRET_ENCRYPTION_KEY

The command returns the variable name if the key is configured. The value is not displayed for security reasons.