Skip to content

Latest commit

 

History

History
34 lines (26 loc) · 874 Bytes

K8S Encryption.md

File metadata and controls

34 lines (26 loc) · 874 Bytes
Raw
title notetype date
K8S Encryption
feed
13-11-2021

In order to enable encryption of data stored in [[etcd cluster]], [[K8S Apiserver]] needs to be configured with the --encryption-provider-config flag:

First, create a file encryption-config.yaml:

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
    - secrets
    providers:
    - aescbc:
        keys:
        - name: key1
          secret: some-example-key
    - identity: {}

Next, make sure that apiserver pod can access the file. For example, create /etc/kubernetes/encryption directory and mount it to the apiserver, and then set the flag like so: --encryption-provider-config=/etc/kubernetes/encryption/encryption-config.yaml.

Status: #💡

References: