search

ovh / public-cloud-roadmap

Agile roadmap for OVHcloud Public Cloud services. Discover the features our product teams are working on, comment and influence our backlog.
https://www.ovhcloud.com/en/public-cloud/
187 stars 5 forks source link

Encrypted Block Volumes #307

Open JacquesMrz opened 2 years ago

JacquesMrz commented 2 years ago

As a user I want to be able to encrypt my block volumes.

scndel commented 2 years ago

A must which would facilitate the fulfillment of some of our requirements, as far as the scope includes volumes (block storage) for OVH Managed *Kubernetes* and uses server-side encryption with customer-provided encryption, like available now on OVH Object Storage (S3).

biapar commented 1 year ago

Can I have more info about encryption on OVH Object Storage (S3)? Thanks.

JohannesHeld commented 1 year ago

Customized encryption of data at rest is an important feature. Especially for potential customers from the financial sector.

JacquesMrz commented 1 year ago

Can I have more info about encryption on OVH Object Storage (S3)? Thanks.

Hi @biapar , here is the guide about Encryption on S3 Object Storage in OVHcloud: https://docs.ovh.com/ie/en/storage/object-storage/s3/encrypt-your-objects-with-sse-c/

biapar commented 1 year ago

Can I have more info about encryption on OVH Object Storage (S3)? Thanks.

Hi @biapar , here is the guide about Encryption on S3 Object Storage in OVHcloud.

Where?

scndel commented 1 year ago

Hi, any update on the topic ? It's a real requirement from some customers.

igorrenquin commented 1 year ago

Hi,

ghost commented 1 year ago

Hi,

Any update on the topic ?

MrOffline77 commented 11 months ago

Push - Want to see this in K8S 👍

scndel commented 11 months ago

Hi @JacquesMrz , it impacts our own roadmap so it'd be also nice to know that you will NOT implement it within next months (therefore we'll unfortunately aim towards another encryption solution).

MrOffline77 commented 6 months ago

In the Openstack world there is Cinder Barbican to provide encryption at rest (LUKS) for Cinder volumes. As an MKS customer, I would like to be able to use transparent encryption at rest on a PV. For example via a specific annotation on the PVC. We solve the issue so far by running a Ceph cluster ourselves in the cluster which runs on the PV of the MKS. We then work with transparent OSD encryption and create our own storage class. In doing so, we lose approx. 50% of the IOPS.

As a transitional solution, it would help if MKS had the high-speed GEN2 storage available in order to have more IOPS available.

julienkosinski commented 4 months ago

Hi @JacquesMrz , it impacts our own roadmap so it'd be also nice to know that you will NOT implement it within next months (therefore we'll unfortunately aim towards another encryption solution).

If I read the roadmap correctly, it looks like it should be implemented more or less between July and October 2024 :).

biapar commented 4 months ago

Hi Julie Which Solution Do you use? @Ovh: Why this delay?

julienkosinski commented 4 months ago

@biapar Well, as of now, unencrypted volumes...

biapar commented 4 months ago

Nooo… I made a custom enc solution in c#. On the server I use a private key to enc the file and after I save on the blob. After I decrypt to read.

julienkosinski commented 4 months ago

@biapar Nice! :) In this regard, depending on your use case, you might be interested in SOPS (but I advise waiting until SOPS have a clearer release cycle, which should be explained soon). The most sensitive data I have to store are on the OVH Object Storage which has a built-in encryption option. So I think to wait on OVH encryption for the Block part.

MrOffline77 commented 4 months ago

Feel free to reach out to me for support in setting up rook with encryption at rest at OVH MKS. We are happy to assist you.

julienkosinski commented 4 months ago

Thank you! :)