In this lesson, you will learn how to implement encryption at rest for your Persistent Volumes (PVs) to ensure your data remains unreadable even if the physical disk is stolen or accessed unauthorizedly.
The Problem: Physical Security Risks
While we often focus on securing data in transit or within our containers, data stored on disks is often overlooked. If a cloud provider’s physical disk is decommissioned or a node’s storage is accessed via low-level system permissions, sensitive information could be exposed. To mitigate this, we use Encryption at Rest.
Implementing Encryption at Rest
In Kubernetes, encryption at rest is typically handled at the storage infrastructure layer rather than within the Kubernetes manifest itself. When you provision persistent storage (using a StorageClass), you instruct the underlying cloud provider (like AWS, GCP, or Azure) to manage the encryption keys—often referred to as Customer Managed Keys (CMK) or Service Managed Keys.
When you define your StorageClass, you specify parameters that trigger this encryption. For example, in an AWS environment using the EBS CSI driver, your StorageClass configuration looks like this:
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: encrypted-ebs
provisioner: ebs.csi.aws.com
parameters:
type: gp3
encrypted: "true"
kmsKeyId: "arn:aws:kms:region:account:key/your-key-id"
By setting encrypted: "true", the Kubernetes provisioner communicates with the cloud API to ensure that every volume dynamically created via this class is encrypted using the specified KMS (Key Management Service) key.
Why this matters
Because Kubernetes dynamically provisions these volumes, managing encryption individually would be error-prone. By baking the encryption requirement into the StorageClass, you enforce a "secure-by-default" posture for every application in your cluster. If a volume is created without these parameters, it risks being stored in plain text. By automating this, you ensure that even if an attacker gains physical access to the storage medium, the data remains ciphertext, protected by the cryptographic keys managed in your KMS.
Key Takeaway: By defining encryption parameters within your Kubernetes StorageClass, you ensure that every volume provisioned for your workloads is automatically encrypted at the infrastructure layer, protecting data from unauthorized physical access.