Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Encryption to dynamic provisioner #30792

Closed
markturansky opened this issue Aug 17, 2016 · 8 comments
Closed

Add Encryption to dynamic provisioner #30792

markturansky opened this issue Aug 17, 2016 · 8 comments
Labels
area/kubectl

Comments

@markturansky
Copy link
Contributor

Summary

Encrypted volumes is a commonly requested feature for Kubernetes storage and requirements exist downstream to use encrypted volumes.

The following is a summary of the three cloud providers that allow dynamic provisioning and the current state of volume encryption for each.

TL;DR:  Add encryption support for EBS PersistentVolumes. AWS has optional encryption and allows key via the API. GCE encrypts volumes by default but does not allow user-defined keys in the API. GCE allows custom keys via manual volume creation in the UI.  Cinder volumes can be manually created w/ encryption.

@kubernetes/sig-storage @abhgupta

@thockin @saad-ali I'm going to follow up with a PR today/tomorrow to meet the 1.4 cutoff on Friday.

Encryption by Cloud Provider

AWS

  • AWS does not encrypt volumes by default
  • AWS API allows an optional boolean flag for encryption
  • AWS API allows a user to specify which key to use for encryption with a default key provided by AWS if not specified.

See:

GCE

  • GCE encrypts all volumes by default
  • Users can provide their own keys, but this is a manual step in the UI only.
  • GCE API does not provide a way to specify which key should encrypt which disk
  • Volume attachment to the node requires the same key it is encrypted with. This is a manual step in the UI only.

See:

Cinder

  • No encryption by default
  • No opt-in encryption via API
  • Block storage can be optionally encrypted
  • Manual creation of the volumes is required

See:

Proposed

Workflow:

  1. Admins create however many keys in AWS as they wish. This is a manual step.
  2. Admins create StorageClasses with the fully-qualified AWS resource name for the key.

Implementation details:

  • Add encryption support to AWS cloud provider
  • Add encryption support to Kubernetes EBS volume plugin
  • Use StorageClass for both the Encrypted boolean and EncryptionKeyName in PV controller
@markturansky markturansky mentioned this issue Aug 18, 2016
Closed
@markturansky
Copy link
Contributor Author

Added to #29006 via jsafrane#7

@thockin
Copy link
Member

thockin commented Aug 18, 2016

If we add any more non-essential changes to #29006, I will personally NAK that PR until 1.5.

That PR is too hard to review as it is. If you want to get this in, send a followup PR with this change as the last commit, and if we get to it, great. Sending a PR on Wednesday 2 days before code freeze does not mean you actually caught the train. It means you are queued up outside the station waiting for a ticket with the rest of the throng.

Sorry to come off coarse, but I have done nothing but code review for weeks, and that PR in particular is a BEAR.

@thockin
Copy link
Member

thockin commented Aug 18, 2016

I looked at your PR. It's probably fine, but PLEASE PLEASE do it as a
followup

On Wed, Aug 17, 2016 at 10:28 PM, Tim Hockin notifications@github.com
wrote:

If we add any more non-essential changes to #29006
#29006, I will personally
NAK that PR until 1.5.

That PR is too hard to review as it is. If you want to get this in, send a
followup PR with this change as the last commit, and if we get to it,
great. Sending a PR on Wednesday 2 days before code freeze does not mean
you actually caught the train. It means you are queued up outside the
station waiting for a ticket with the rest of the throng.

Sorry to come off coarse, but I have done nothing but code review for
weeks, and that PR in particular is a BEAR.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#30792 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AFVgVJ0b-A1ABPP_XemI4E9xZOx1OlZmks5qg-16gaJpZM4Jmv0T
.

@jsafrane
Copy link
Member

I have some comments and yes, please wait until the large PR is merged. It's complicated enough already.

@markturansky
Copy link
Contributor Author

I'm happy to do a follow-up PR. Thanks for allowing this small addition. I'm glad to have caught the train.

@markturansky markturansky mentioned this issue Aug 18, 2016
Merged
k8s-github-robot pushed a commit that referenced this issue Aug 22, 2016
Merge pull request #30880 from markturansky/add_encryption
a316e6d 
Automatic merge from submit-queue

Add encryption to EBS dynamic provisioner

Resolves #30792

Adds encryption to the EBS cloud provider and provisioner.

Follow up to #29006 (all commits but the one in this PR will drop out).

@kubernetes/sig-storage 


```release-note
```
@bambrozio
Copy link

Do we have any similar solution for NFS persistent volumes?
Not sure how to mount and unmount NFS PVs which are encrypted. Perhaps the API should cover it too, as the mount command would deal with it. Does it make sense?

@rmt
Copy link

rmt commented Apr 15, 2018

@bambrozio, https://aws.amazon.com/blogs/aws/new-encryption-of-data-in-transit-for-amazon-efs/ was just released, allowing TLS when mounting an (existing) EFS volume on AWS. I guess that both at-rest encryption and in-transit encryption would have to be added as an option to any EFS provisioner (currently there's one in kubernetes-incubator/external-storage).

It may be possible to use in-transit encryption standalone with pre-provisioned EFS volumes, though, by specifying the fsType as efs when using local storage.

@nick4fake
Copy link

It looks like now encryption is not supported for static volumes (those with "awsElasticBlockStore")

@andraxylia andraxylia mentioned this issue Aug 21, 2018
Closed
@jpds jpds mentioned this issue Aug 6, 2019
Closed
talblubClouby96 added a commit to talblubClouby96/examples that referenced this issue Aug 2, 2024
@talblubClouby96
Merge pull request #30880 from markturansky/add_encryption
cf91c60 
Automatic merge from submit-queue

Add encryption to EBS dynamic provisioner

Resolves kubernetes/kubernetes#30792

Adds encryption to the EBS cloud provider and provisioner.

Follow up to #29006 (all commits but the one in this PR will drop out).

@kubernetes/sig-storage 


```release-note
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/kubectl
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@rmt @nick4fake @jsafrane @thockin @bambrozio @markturansky @k8s-github-robot