Multitenancy (KMS)

CyberVault KMS supports multitenancy, meaning that one installation can serve multiple HSM Partitions.

Base Partition

The Base Partition is the first Partition that operators add during the KMS installation flow. The KMS stores its own state in the Base Partition as HSM data objects. For more details, see the state documentation.

Additional Partitions

Operators can add additional Partitions. Once added, they can be managed through the Key Manager UI with the same set of features.

To add a Partition, you need the Admin role on the Key Manager UI. For on-premise Primus HSM you also need operator access to the KMS installation.

Step 1: Additional TSB

Recall that the Key Manager UI connects to the HSM through the TSB. Therefore, you need to set up an additional TSB connection for each additional Partition.

• Option 1: CloudHSM TSBaaS
  • If you are using CloudHSM with TSBaaS, Securosys provides you with a JWT token to access the Partition.
• Option 2: Deploy an additional TSB
  • You can deploy multiple single-tenant TSB instances. Each TSB is connected to exactly one HSM Partition.
  • As an operator, run keymanager add-tsb to deploy an additional TSB. You will be asked to provide the HSM details (host, port, Partition name, Setup Password).
• Option 3: Configure an existing TSB with multitenancy
  • If you already have a TSB deployed, you can reconfigure it from single- to multi-tenancy mode. For example, you can reuse the TSB that the initial KMS install created.
  • For step-by-step instructions, follow the TSB multitenancy guide.
    • This requires manually editing the environment variables, since the TSB install in KMS doesn't use application.yml files. A future keymanager version will automate this.
    • After defining the accessToken settings, restart the TSB: keymanager restart tsb-rest-api

Step 2: Add the Partition to the Key Manager UI

Once you have the credentials for a TSB connected to the new Partition, you can add the Partition the Key Manager UI:

• As an administrator, go to Settings > HSM Partitions > Register HSM Partition.
• Follow the wizard.
• You will be asked for the TSB details (URL, JWT or mTLS client certificate).
• You will be asked whether to configure KMIP for this Partition and to assign users to the Partition. Both of these can also be done later.

Your Partition should now show up under Settings > HSM Partitions. From there, you can edit the Partition settings (TSB URL, JWT, assigned users, ...).

tip

The additional Partitions don't need to be on the same HSM cluster as the Base Partition. It is possible to manage both CloudHSM Partitions and on-premise HSM Partitions through a single CyberVault KMS installation.