Open supershal opened 3 months ago
KMS V2 encryption provider for AWS: https://github.com/kubernetes-sigs/aws-encryption-provider
Nutanix has a local native KMS service (PE -> Settings -> Data-at-rest Encryption) which can be explored to create a kubernetes plugin for nutanix KMS service.
We should support KMS V2 Encryption for encryption at REST.
The KMS V2 encryption: https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/#encrypting-your-data-with-the-kms-provider-kms-v2
there are multiple encryption providers are supported: aesgcm, aescbc etc. however they are not recommended because of vulnerability found with them. https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers
KMS v2 is recommended provider. It will require setting KMS plugin for external KMS provider. The external KMS provider can be could specific or custom. They are supported using KMS plugin mechanism. https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/#implementing-a-kms-plugin
We should explore how can we install and configure the plugin for a cloud provider and how can we configure
EncryptionConfiguration
to use the plugin.