Encryption at rest

QuasarSDS can encrypt each volume with AES-XTS-256. Encryption is enabled only through the StorageClass: a pool never applies it by inheritance.

1. Create the Secret with the keys

AES-XTS needs two different keys of 32 random bytes each. The Secret must live in the quasarsds-system namespace:

openssl rand 32 > encryption_key
openssl rand 32 > encryption_key2
kubectl -n quasarsds-system create secret generic quasarsds-volume-key \
  --from-file=encryption_key=encryption_key \
  --from-file=encryption_key2=encryption_key2

warning

Keep a secure copy of the keys. Without them, the volume's data cannot be recovered.

2. Encrypted StorageClass

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: quasarsds-rf3-encrypted
provisioner: quasarsds.io
volumeBindingMode: WaitForFirstConsumer
parameters:
  poolName: fast-pool
  strategy: RF3
  encryptionProtection: "true"
  encryptionKeySecret: quasarsds-volume-key