How to encrypt an ephemeral volume?

[schlichtanders]

Hi there,

I am looking for ways to encrypt everything at rest.
What I found so far:

• hetzner csi driver allows for encryption https://github.com/hetznercloud/csi-driver/blob/main/docs/kubernetes/README.md#volumes-encrypted-with-luks
• kubernetes allows to use any volume provisioner for ephemeral storage https://kubernetes.io/docs/concepts/storage/ephemeral-volumes/#generic-ephemeral-volumes

What I don't know:

• is hetzner csi the thing which accesses the plain local storage, like the storage which is used by default for ephemeral volumes? I really would like to reuse the storage of the hetzner instances and encrypt that

@mysticaltech can you help? Do you know someone who can help?

[schlichtanders]

I found it in this super list of csi drivers https://kubernetes-csi.github.io/docs/drivers.html

"A Container Storage Interface (CSI) Driver for Hetzner Cloud Volumes"

so this is not useful for encrypting the standard storage...

[schlichtanders]

thank Justin, of course I fine-grained kubernetes authorisation (this was the first I thought about). I also fine-grained network policies. Now the last piece missing is the encryption (as far as I understood Kubernetes).

[schlichtanders]

@aleksasiriski @JustinGuese I looked into the OpenEBS documentation, especially the encryption at rest...
... it looks very complicated and even outdated as the two links about cStore and localPV point to an archived repository.

Do you have a resource about how you configure it in kube-hetzner so that it creates encrypted ephemeral volumes?

The only problem with OpenEBS is that it doesn't actually limit your volumes to the specified amount of storage that is requested, but to the amount of storage available on the node.

@aleksasiriski this sounds crucial, as I need to make sure that no pod is eating the others temporary space ...

[schlichtanders]

I just realized that I also ideally need to encrypt the docker thin writable layer (which uses the overlay2 file system).

My final goal is to run different pods such that the one pod cannot extract sensible information from the other pod...
I still hope there is a somehow easy to maintain solution.

---

EDIT: I realized further that I actually only need to encrypt the docker writable layer (I realized it is actually containerd running inside k3s).

It seems this is not at all supported, but really everywhere people say you may encrypt the entire blockstorage (i.e. the entire node). So if multiple processes run on the same node (even with docker/containerd only), the processes may get access to the left-overs in the block storage of previous file-operations of other containers. Isn't docker/kubernetes also meant for isolation of different applications?

[schlichtanders]

I summarized my confusion into this discussion from containerd containerd/containerd#9148

I bet that my security concerns are not really apt in that if you only have a filesystem like overlayFS, you never can access the block storage directly and hence will never be able to read out other's sensible information.

If that is indeed true, the only thing left is to encrypt the entire node with LUKS (as far as I understood). (Not sure how to do that actually)

[schlichtanders]

I opened a new discussion for how to encrypt a node: #997