Kubernetes offers the ability to encrypt sensitive data at rest. In order to take advantage of this feature, it is necessary to generate an encryption key and a data encryption config. In this learning activity, you will learn how to generate an encryption key and a data encryption config file for Kubernetes.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Generate an encryption key and include it in a Kubernetes data encryption config file.
To accomplish this task, do the following on the workspace server:
ENCRYPTION_KEY=$(head -c 32 /dev/urandom | base64) cat > encryption-config.yaml << EOF kind: EncryptionConfig apiVersion: v1 resources: - resources: - secrets providers: - aescbc: keys: - name: key1 secret: ${ENCRYPTION_KEY} - identity: {} EOF- Copy the file to the Kubernetes controller servers.
Copy
encryption-config.yamlto each Kubernetes controller by running these commands from the workspace server. Be sure to replace the placeholders with the actual IP addresses of the controller servers.scp encryption-config.yaml cloud_user@<controller 1 public ip>:~/ scp encryption-config.yaml cloud_user@<controller 2 public ip>:~/
