To use Customer Managed Encryption Keys (CMEK) with Azure Key Management Service (KMS) in SingleStore, follow these steps:

1. Create a Customer-Managed Key

   • Navigate to the Azure portal and go to the Key Vault section.

   • Create a new key vault if you do not have one already.

   • Within the key vault, create a new key.

   • Specify the key's details, including key type, algorithm, and key size.

   • Assign appropriate labels to the key for easy identification.

   • Define the key’s administrative permissions. Assign a user or role that will manage the lifecycle of this key, typically an administrative role within your Azure account.

2. Give Permission to SingleStore Azure Account

   • Grant the SingleStore Azure account permission to use the customer-managed keys. This enables the SingleStore Azure accounts to use the key/key vault through the multi-tenant application using the user-assigned managed identity.

3. Configure Cross-Tenant Application

   • Create and configure the cross-tenant application with federated credentials using the user-assigned managed identity.

   • Authenticate the application in the customer account.

   • Provide the necessary permissions to the application for the key vault.

4. Set Up in Storage Account

   • Configure the storage account to use the URL of the key with the application, and set the user-assigned managed identity.

   • Ensure encryption configuration is applied to the storage account.

5. Set Up in Volume

   • Create a disk encryption set with the user-assigned managed identity within the Azure Kubernetes Service (AKS) resource group.

   • Configure the disk encryption set to the relevant storage class parameter.

6. Automate Configuration

   • Utilize the cloudstorage package to perform actions related to Azure. All actions will primarily be performed by the application managed-buckets-azure.

   • Automate the encryption for storage accounts and volumes when creating workspace groups

Here are some specifics for the Azure configuration and setup:

• You need to have a user-assigned managed identity in the resource group.

• The key vault must be in the same region as the disk encryption set.

• Grant roles such as Managed Identity Contributor and Managed Identity Operator to ensure appropriate permissions.

Ensure that you follow proper validation methods and handle errors related to permissions and region conflicts. Regularly review access logs and permissions to maintain security and compliance.