Why swarm-node.key has two keys

Question

Following this article, I understand that this file is holding the private key which is being used to encrypt the Raft logs and ensure the secure TLS communication between the nodes.

This is the file: /var/lib/docker/swarm/certificates/swarm-node.key
Looking inside its content:

It appears that it has two parts.
The first 1 (marked with green) is the raft-dek.
According to this article:

On manager hosts secrets are always encrypted at rest. By default, the key that encrypts these secrets (known as the Data Encryption Key, DEK) is also stored in plaintext on disk.

What is the second key ? Is it the key that responsible to encrypt the Raft logs ?

Does, this file contains two keys:

1. Encrypt secrets
2. Encrypt the the data to the Raft

?

Answer 1

There are two kinds of data that needs to be encrypted:

1. The general traffic data between nodes.
2. Sensitive secrets.

The traffic data between nodes is encrypted by TLS. The swarm uses MTLS to protect communications between nodes.

The sensitive secrets are encrypted by the DEK.

This swarm-node.key file contains only one private key, which is the key used in TLS. This file is constructed with two parts: the header part and the body part. The body part carries the actual private key. And the header part can carry extra information. In this case, the DEK resides in the header part.

Source code:

// the raft DEK (data encryption key) is stored in the TLS key as a header
// these are the header values
pemHeaderRaftDEK              = "raft-dek"
...