search

nutanix-cloud-native / cluster-api-runtime-extensions-nutanix

https://nutanix-cloud-native.github.io/cluster-api-runtime-extensions-nutanix/
Apache License 2.0
7 stars 4 forks source link

Support KMS V2 Encryption at REST #624

Open supershal opened 3 months ago

supershal commented 3 months ago

We should support KMS V2 Encryption for encryption at REST.

The KMS V2 encryption: https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/#encrypting-your-data-with-the-kms-provider-kms-v2

there are multiple encryption providers are supported: aesgcm, aescbc etc. however they are not recommended because of vulnerability found with them. https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers

KMS v2 is recommended provider. It will require setting KMS plugin for external KMS provider. The external KMS provider can be could specific or custom. They are supported using KMS plugin mechanism. https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/#implementing-a-kms-plugin

We should explore how can we install and configure the plugin for a cloud provider and how can we configure EncryptionConfiguration to use the plugin.

supershal commented 3 months ago

KMS V2 encryption provider for AWS: https://github.com/kubernetes-sigs/aws-encryption-provider

supershal commented 3 months ago

Nutanix has a local native KMS service (PE -> Settings -> Data-at-rest Encryption) which can be explored to create a kubernetes plugin for nutanix KMS service.