mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-07-31 19:18:40 -04:00
docs: document aws encrypted storage (#1974)
* document AWS encrypted storage * dont use block express disks * Update docs/docs/workflows/storage.md Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * Update docs/docs/workflows/storage.md Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * Update docs/docs/workflows/storage.md Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * Update docs/docs/workflows/storage.md Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> --------- Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
This commit is contained in:
Moritz Sanft
GitHub
parent
05c43137e4
commit
a587558df9
1 changed files with 61 additions and 111 deletions
|
|
@ -9,11 +9,11 @@ Cloud service providers (CSPs) offer their own CSI-based solutions for cloud sto
|
||||||
## Confidential storage
|
## Confidential storage
|
||||||
|
|
||||||
Most cloud storage solutions support encryption, such as [GCE Persistent Disks (PD)](https://cloud.google.com/kubernetes-engine/docs/how-to/using-cmek).
|
Most cloud storage solutions support encryption, such as [GCE Persistent Disks (PD)](https://cloud.google.com/kubernetes-engine/docs/how-to/using-cmek).
|
||||||
Constellation supports the available CSI-based storage options for Kubernetes engines in Azure and GCP.
|
Constellation supports the available CSI-based storage options for Kubernetes engines in AWS, Azure, and GCP.
|
||||||
However, their encryption takes place in the storage backend and is managed by the CSP.
|
However, their encryption takes place in the storage backend and is managed by the CSP.
|
||||||
Thus, using the default CSI drivers for these storage types means trusting the CSP with your persistent data.
|
Thus, using the default CSI drivers for these storage types means trusting the CSP with your persistent data.
|
||||||
|
|
||||||
To address this, Constellation provides CSI drivers for Azure Disk and GCE PD, offering [encryption on the node level](../architecture/keys.md#storage-encryption). They enable transparent encryption for persistent volumes without needing to trust the cloud backend. Plaintext data never leaves the confidential VM context, offering you confidential storage.
|
To address this, Constellation provides CSI drivers for AWS EBS, Azure Disk, and GCE PD, offering [encryption on the node level](../architecture/keys.md#storage-encryption). They enable transparent encryption for persistent volumes without needing to trust the cloud backend. Plaintext data never leaves the confidential VM context, offering you confidential storage.
|
||||||
|
|
||||||
For more details see [encrypted persistent storage](../architecture/encrypted-storage.md).
|
For more details see [encrypted persistent storage](../architecture/encrypted-storage.md).
|
||||||
|
|
||||||
|
|
@ -25,32 +25,28 @@ Constellation supports the following drivers, which offer node-level encryption
|
||||||
<tabItem value="azure" label="Azure">
|
<tabItem value="azure" label="Azure">
|
||||||
|
|
||||||
**Constellation CSI driver for Azure Disk**:
|
**Constellation CSI driver for Azure Disk**:
|
||||||
Mount Azure [Disk Storage](https://azure.microsoft.com/en-us/services/storage/disks/#overview) into your Constellation cluster. See the instructions on how to [install the Constellation CSI driver](#installation) or check out the [repository](https://github.com/edgelesssys/constellation-azuredisk-csi-driver) for more information. Since Azure Disks are mounted as ReadWriteOnce, they're only available to a single pod.
|
Mount Azure [Disk Storage](https://azure.microsoft.com/en-us/services/storage/disks/#overview) into your Constellation cluster.
|
||||||
|
See the instructions on how to [install the Constellation CSI driver](#installation) or check out the [repository](https://github.com/edgelesssys/constellation-azuredisk-csi-driver) for more information.
|
||||||
|
Since Azure Disks are mounted as `ReadWriteOnce`, they're only available to a single pod.
|
||||||
|
|
||||||
</tabItem>
|
</tabItem>
|
||||||
<tabItem value="gcp" label="GCP">
|
<tabItem value="gcp" label="GCP">
|
||||||
|
|
||||||
**Constellation CSI driver for GCP Persistent Disk**:
|
**Constellation CSI driver for GCP Persistent Disk**:
|
||||||
Mount [Persistent Disk](https://cloud.google.com/persistent-disk) block storage into your Constellation cluster.
|
Mount [Persistent Disk](https://cloud.google.com/persistent-disk) block storage into your Constellation cluster.
|
||||||
This includes support for [volume snapshots](https://cloud.google.com/kubernetes-engine/docs/how-to/persistent-volumes/volume-snapshots), which let you create copies of your volume at a specific point in time.
|
Follow the instructions on how to [install the Constellation CSI driver](#installation) or check out the [repository](https://github.com/edgelesssys/constellation-gcp-compute-persistent-disk-csi-driver) for more information.
|
||||||
You can use them to bring a volume back to a prior state or provision new volumes.
|
|
||||||
Follow the instructions on how to [install the Constellation CSI driver](#installation) or check out the [repository](https://github.com/edgelesssys/constellation-gcp-compute-persistent-disk-csi-driver) for information about the configuration.
|
|
||||||
|
|
||||||
</tabItem>
|
</tabItem>
|
||||||
<tabItem value="aws" label="AWS">
|
<tabItem value="aws" label="AWS">
|
||||||
|
|
||||||
:::caution
|
**Constellation CSI driver for AWS Elastic Block Store**
|
||||||
|
Mount [Elastic Block Store](https://aws.amazon.com/ebs/) storage volumes into your Constellation cluster.
|
||||||
Confidential storage isn't yet implemented for AWS. If you require this feature, [let us know](https://github.com/edgelesssys/constellation/issues/new?assignees=&labels=&template=feature_request.md)!
|
Follow the instructions on how to [install the Constellation CSI driver](#installation) or check out the [repository](https://github.com/edgelesssys/constellation-aws-ebs-csi-driver) for more information.
|
||||||
|
|
||||||
You may use other (non-confidential) CSI drivers that are compatible with Kubernetes on AWS.
|
|
||||||
|
|
||||||
:::
|
|
||||||
|
|
||||||
</tabItem>
|
</tabItem>
|
||||||
</tabs>
|
</tabs>
|
||||||
|
|
||||||
Note that in case the options above aren't a suitable solution for you, Constellation is compatible with all other CSI-based storage options. For example, you can use [Azure Files](https://docs.microsoft.com/en-us/azure/storage/files/storage-files-introduction) or [GCP Filestore](https://cloud.google.com/filestore) with Constellation out of the box. Constellation is just not providing transparent encryption on the node level for these storage types yet.
|
Note that in case the options above aren't a suitable solution for you, Constellation is compatible with all other CSI-based storage options. For example, you can use [AWS EFS](https://docs.aws.amazon.com/en_en/eks/latest/userguide/efs-csi.html), [Azure Files](https://docs.microsoft.com/en-us/azure/storage/files/storage-files-introduction), or [GCP Filestore](https://cloud.google.com/filestore) with Constellation out of the box. Constellation is just not providing transparent encryption on the node level for these storage types yet.
|
||||||
|
|
||||||
## Installation
|
## Installation
|
||||||
|
|
||||||
|
|
@ -118,11 +114,29 @@ Note that volume expansion isn't supported for integrity-protected disks.
|
||||||
</tabItem>
|
</tabItem>
|
||||||
<tabItem value="aws" label="AWS">
|
<tabItem value="aws" label="AWS">
|
||||||
|
|
||||||
:::caution
|
AWS comes with two storage classes by default.
|
||||||
|
|
||||||
Confidential storage isn't yet implemented for AWS. If you require this feature, [let us know](https://github.com/edgelesssys/constellation/issues/new?assignees=&labels=&template=feature_request.md)!
|
* `encrypted-rwo`
|
||||||
|
* Uses [SSDs of `gp3` type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html)
|
||||||
|
* ext-4 filesystem
|
||||||
|
* Encryption of all data written to disk
|
||||||
|
* `integrity-encrypted-rwo`
|
||||||
|
* Uses [SSDs of `gp3` type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html)
|
||||||
|
* ext-4 filesystem
|
||||||
|
* Encryption of all data written to disk
|
||||||
|
* Integrity protection of data written to disk
|
||||||
|
|
||||||
You may use other (non-confidential) CSI drivers that are compatible with Kubernetes on AWS.
|
For more information on encryption algorithms and key sizes, refer to [cryptographic algorithms](../architecture/encrypted-storage.md#cryptographic-algorithms).
|
||||||
|
|
||||||
|
:::info
|
||||||
|
|
||||||
|
The default storage class is set to `encrypted-rwo` for performance reasons.
|
||||||
|
If you want integrity-protected storage, set the `storageClassName` parameter of your persistent volume claim to `integrity-encrypted-rwo`.
|
||||||
|
|
||||||
|
Alternatively, you can create your own storage class with integrity protection enabled by adding `csi.storage.k8s.io/fstype: ext4-integrity` to the class `parameters`.
|
||||||
|
Or use another filesystem by specifying another file system type with the suffix `-integrity`, e.g., `csi.storage.k8s.io/fstype: xfs-integrity`.
|
||||||
|
|
||||||
|
Note that volume expansion isn't supported for integrity-protected disks.
|
||||||
|
|
||||||
:::
|
:::
|
||||||
|
|
||||||
|
|
@ -186,9 +200,6 @@ The default storage class is responsible for all persistent volume claims that d
|
||||||
Constellation creates a storage class with encryption enabled and sets this as the default class.
|
Constellation creates a storage class with encryption enabled and sets this as the default class.
|
||||||
In case you wish to change it, follow the steps below:
|
In case you wish to change it, follow the steps below:
|
||||||
|
|
||||||
<tabs groupId="csp">
|
|
||||||
<tabItem value="azure" label="Azure">
|
|
||||||
|
|
||||||
1. List the storage classes in your cluster:
|
1. List the storage classes in your cluster:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
|
|
@ -199,8 +210,8 @@ In case you wish to change it, follow the steps below:
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
|
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
|
||||||
encrypted-rwo (default) azuredisk.csi.confidential.cloud Delete Immediate true 1d
|
encrypted-rwo (default) {your-csp}.csi.confidential.cloud Delete Immediate true 1d
|
||||||
integrity-encrypted-rwo azuredisk.csi.confidential.cloud Delete Immediate false 1d
|
integrity-encrypted-rwo {your-csp}.csi.confidential.cloud Delete Immediate false 1d
|
||||||
```
|
```
|
||||||
|
|
||||||
The default storage class is marked by `(default)`.
|
The default storage class is marked by `(default)`.
|
||||||
|
|
@ -229,67 +240,6 @@ In case you wish to change it, follow the steps below:
|
||||||
|
|
||||||
```shell-session
|
```shell-session
|
||||||
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
|
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
|
||||||
encrypted-rwo azuredisk.csi.confidential.cloud Delete Immediate true 1d
|
encrypted-rwo {your-csp}.csi.confidential.cloud Delete Immediate true 1d
|
||||||
integrity-encrypted-rwo (default) azuredisk.csi.confidential.cloud Delete Immediate false 1d
|
integrity-encrypted-rwo (default) {your-csp}.csi.confidential.cloud Delete Immediate false 1d
|
||||||
```
|
```
|
||||||
|
|
||||||
</tabItem>
|
|
||||||
<tabItem value="gcp" label="GCP">
|
|
||||||
|
|
||||||
1. List the storage classes in your cluster:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
kubectl get storageclass
|
|
||||||
```
|
|
||||||
|
|
||||||
The output is similar to this:
|
|
||||||
|
|
||||||
```shell-session
|
|
||||||
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
|
|
||||||
encrypted-rwo (default) gcp.csi.confidential.cloud Delete Immediate true 1d
|
|
||||||
integrity-encrypted-rwo gcp.csi.confidential.cloud Delete Immediate false 1d
|
|
||||||
```
|
|
||||||
|
|
||||||
The default storage class is marked by `(default)`.
|
|
||||||
|
|
||||||
2. Mark old default storage class as non default
|
|
||||||
|
|
||||||
If you previously used another storage class as the default, you will have to remove that annotation:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
kubectl patch storageclass encrypted-rwo -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'
|
|
||||||
```
|
|
||||||
|
|
||||||
3. Mark new class as the default
|
|
||||||
|
|
||||||
```bash
|
|
||||||
kubectl patch storageclass integrity-encrypted-rwo -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
|
|
||||||
```
|
|
||||||
|
|
||||||
4. Verify that your chosen storage class is default:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
kubectl get storageclass
|
|
||||||
```
|
|
||||||
|
|
||||||
The output is similar to this:
|
|
||||||
|
|
||||||
```shell-session
|
|
||||||
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
|
|
||||||
encrypted-rwo gcp.csi.confidential.cloud Delete Immediate true 1d
|
|
||||||
integrity-encrypted-rwo (default) gcp.csi.confidential.cloud Delete Immediate false 1d
|
|
||||||
```
|
|
||||||
|
|
||||||
</tabItem>
|
|
||||||
<tabItem value="aws" label="AWS">
|
|
||||||
|
|
||||||
:::caution
|
|
||||||
|
|
||||||
Confidential storage isn't yet implemented for AWS. If you require this feature, [let us know](https://github.com/edgelesssys/constellation/issues/new?assignees=&labels=&template=feature_request.md)!
|
|
||||||
|
|
||||||
You may use other (non-confidential) CSI drivers that are compatible with Kubernetes on AWS.
|
|
||||||
|
|
||||||
:::
|
|
||||||
|
|
||||||
</tabItem>
|
|
||||||
</tabs>
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue