The DHCP-DDNS configuration of service dhcp-server dynamic-dns-update contains the TSIG key as "secret": "<base64>" in /run/kea/kea-dhcp-ddns.conf. Kea 3.2 refuses this and kea-dhcp-ddns does not start:

use of clear text TSIG 'secret' is NOT SECURE

I found this while testing Kea 3.2.1 for T8461 (the VLAN fix is only in 3.2.x). test_dhcp_dynamic_dns_update is the only test of test_service_dhcp-server.py that fails with 3.2.1, 16 of 17 pass.

Kea supports secret-file for TSIG keys since 2.5.8. The change writes each key to its own file below /run/kea/, owned by the Kea user with mode 0600, and the configuration points to it with secret-file. The CLI stays the same.

It works with the Kea version in use now and with 3.2.1. I checked both with kea-dhcp-ddns -t and by starting 3.0.3 and 3.2.1 with the generated configuration. With the change and the smoketest adapted to the key files, test_service_dhcp-server.py passes 17 of 17 with 3.2.1. I did not run the suite against 3.0.3 with the change.

This can be merged before Kea 3.2 is built, it does not depend on it.

Related: T8461