Encrypting volumes

[montyz]

It'd be great if I could specify that the es storage be encrypted.

[pieterlange]

You can probably (haven't tried it yet) do this by creating a storageclass with encrypted: true (and a valid key in KMS) and referencing that storageclass in the cluster definition. https://kubernetes.io/docs/concepts/storage/storage-classes/#aws

[peterloron]

You can use this: kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: enc-ebs-gp2 provisioner: kubernetes.io/aws-ebs parameters: type: gp2 fsType: ext4 encrypted: "true"

[montyz]

So far I tried creating a default storage class that is encrypted, as well as specifying an explicit storage class:

  storage:
    type: gp2
    storage-class: standard-xfs

In both cases the operator creates its own storage classes named us-west-* and uses them:

k get sc
NAME                     PROVISIONER             AGE
default                  kubernetes.io/aws-ebs   1d
gp2                      kubernetes.io/aws-ebs   1d
standard-xfs (default)   kubernetes.io/aws-ebs   16h
us-west-2a               kubernetes.io/aws-ebs   16h
us-west-2b               kubernetes.io/aws-ebs   16h
us-west-2c               kubernetes.io/aws-ebs   16h

Also, when I delete the cluster, the pvcs remain behind.

[montyz]

I was able to get this working by setting up my own storage classes named us-west-2* before deploying the cluster. I also had to manually delete the pvcs and pvs before that would work. They aren't deleted when the cluster is deleted and were reused.

[stevesloka]

There is an open issue to fix which will get merged soon. It got lost in a big refactor a while back.