Home / server / Questions / 988812
Accepted
Meghana B Srinath
Asked: 2019-10-22 01:33:04 +0800 CST

Dynamic PVC/storage class encryption in GCP

  • 772

I'm trying to create PVC which has the storage class encrypted. These PVCs are created dynamically. As per this link- https://kubernetes.io/docs/concepts/storage/storage-classes/#gce-pd for AWS EBS, there is a parameter 'encrypted' which can be set to true or false to enable the encryption for the disk/volume. Example below for AWS:

kind: StorageClass
apiVersion: storage.k8s.io/v1beta1
metadata:
  name: ebs
provisioner: kubernetes.io/aws-ebs
parameters:
  zone: "###ZONE###"
  encrypted: "true"

However, there is no such parameter for GCE PD in GCP. Is there any way in which I can provide the encryption parameter for the GCE PD so that the resulting disk is encrypted?

storage

1 Answers

  1. Best Answer

    Following the Encrypt disks with customer-supplied encryption keys:

    By default, Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.

    If you provide your own encryption keys, Compute Engine uses your key to protect the Google-generated keys used to encrypt and decrypt your data. Only users who can provide the correct key can use resources protected by a customer-supplied encryption key.

    Google does not store your keys on its servers and cannot access your protected data unless you provide the key. This also means that if you forget or lose your key, there is no way for Google to recover the key or to recover any data encrypted with the lost key.

    When you delete a persistent disk, Google discards the cipher keys, rendering the data irretrievable. This process is irreversible.

    Type of issued storage depends on options you will specify:

    Storage options will help you ensure the Zonal standard persistent disks and Regional persistent disks have:

    -Encryption at rest: yes

    -Custom encryption keys: yes

    Follow the Encrypt disks with customer-supplied encryption keys procedure to encrypt new persistent disks with your own key. You cannot encrypt existing persistent disks with your own key.

    Please pay attention to restrictions:

    Compute Engine does not store encryption keys with instance templates, so you cannot use your own keys to encrypt disks in a managed instance group.

    Hope this help you understand this topic

    • 0