Sidecar Authentication

The ALTR sidecar authenticates to ALTR’s SaaS control plane using key-pair authentication. Generate a valid RSA key pair before installing a sidecar.

RSA Key Requirements

Requirements for the generated key pair:

• Algorithm — RSA 2048 or higher.
• Private key — non-password-protected, PEM-encoded, PKCS#8 format.
• Public key — PEM-encoded, PKIX or PKCS#1 format.

Mount the private key to the sidecar at /app/private.pem, or specify a different location using an environment variable. See Sidecar Environment Variables for the variable that sets the private key path.

Generate an RSA Key Pair

To generate an RSA key pair:

1. Sign in to the server that will run the sidecar.

2. Generate an RSA key pair and view the public key:

   openssl genpkey -out private.pem -algorithm RSA -pkeyopt rsa_keygen_bits:2048
   openssl rsa -in private.pem -pubout -out public.pem
   less public.pem

3. Record the public key value. You register it in ALTRNet when you register the sidecar.

   -----BEGIN PUBLIC KEY-----
   <PUBLIC_KEY_VALUE>
   -----END PUBLIC KEY-----

4. Record the private key’s location on the server.

For key-rotation requirements, including how ALTR supports 2 public keys for a sidecar at once, see Rotate Sidecar Authentication Keys.