(Other Schedulers) Encrypting Portworx Volumes using Google Cloud KMS

Portworx Encrypted Volumes

This guide will give you an overview of how to use the encryption feature for Portworx volumes. Under the hood, Portworx uses the libgcrypt library to interface with the dm-crypt module for creating, accessing and managing encrypted devices. Portworx uses the LUKS format of dm-crypt and AES-256 as the cipher with xts-plain64 as the cipher mode.

All encrypted volumes are protected by a passphrase. Portworx uses this passphrase to encrypt the volume data at rest as well as in transit. It is recommended to store these passphrases in a secure secret store.

There are two ways in which you can provide the passphrase to Portworx:

1. Per volume secret: Use a unique secret for each encrypted volume

2. Cluster-wide secret: Use a default common secret for all encrypted volumes

Portworx has two different kinds of encrypted volumes:

• Encrypted Volumes

Encrypted volumes are regular volumes which can be accessed from only one node.

• Encrypted Shared Volumes

Encrypted shared volume allows access to the same encrypted volume from multiple nodes.

Creating and using encrypted volumes

Using per volume secret keys

In this method portworx generates a 128 bit passphrase. This passphrase will be used during encryption and decryption.

To create a volume through pxctl, run the following command

pxctl volume create --secure  enc_vol

To create a volume through docker, run the following command

docker volume create --volume-driver pxd secure=true,name=enc_vol

To attach and mount an encrypted volume through docker, run the following command

docker run --rm -it -v secure=true,name=enc_vol:/mnt busybox

Note that no secret_key needs to be passed in any of the commands.

Using cluster wide secret key

In this method a default cluster wide secret will be set for the Portworx cluster. Such a secret will be referenced by the user and Portworx as default secret. Any volume request referencing the secret name as default will use this cluster wide secret as a passphrase to encrypt the volume.

Step1: Create a cluster wide secret

Use the following command to set the cluster wide secret key

pxctl secrets set-cluster-key --secret <passphrase>

Successfully set cluster secret key!

The <passphrase> in the above command will be used for encrypting the volumes. The cluster wide secret key needs to be set only once.

Step2: Use the cluster wide secret for encrypting volumes

To create a volume using a cluster wide secret through pxctl, run the following command

pxctl volume create --secure --secret_key default enc_vol

To create a volume using a cluster wide secret through docker, run the following command

docker volume create --volume-driver pxd secret_key=default,name=enc_vol

To attach and mount an encrypted volume through docker, run the following command

docker run --rm -it -v secure=true,secret_key=default,name=enc_vol:/mnt busybox

Note the secret_key is set to the value default to indicate PX to use the cluster-wide secret key

Using named secrets

Step1: Create a Named Secret

Use the following CLI command to create a new secret in Google Cloud KMS and provide it an identifier/name:

pxctl secrets gcloud create-secret --secret_id mysecret --passphrase mysecretpassphrase

The above command will create a new key-value pair mysecret=mysecretpassphrase. Portworx will use Google Cloud KMS to encrypt the passphrase mysecretpassphrase and store it in its internal metadata store. To use this passphrase for encrypting volumes provide only the secret ID mysecret to Portworx while creating/attaching the volume.

To list all the named secrets use the following command:

pxctl secrets gcloud list-secrets

Step2: Use the Named Secret for encrypting volumes

To create a volume using a named secret through pxctl, run the following command

pxctl volume create --secure --secret_key mysecret enc_vol

To create a volume using a named secret through docker, run the following command

docker volume create --volume-driver pxd secret_key=mysecret,name=enc_vol

To attach and mount the same encrypted volume through docker, run the following command

docker run --rm -it -v secure=true,secret_key=mysecret,name=enc_vol:/mnt busybox