Encryption key namespace for containerized workloads
In general, techniques are described for an encryption key namespace of a kernel, executed by a host computing device, the encryption key namespace having a configuration file that stores an association of a key identifier and a container identifier by which the host computing device can obtain a data encryption key to use for decrypting/encrypting data for the container identified by the container identifier. In this way, a user may associate a container (or container image) with a unique key identifier. By configuring this association in the encryption key namespace for the container, the container may be identified and automatically associated with a key identifier for the appropriate key for decrypting/encrypting data for the container. The host computing device may then obtain, from a key management service, the key using the key identifier.
1. A method comprising:
configuring, by a computing device, an encryption key namespace of a kernel of the computing device, the encryption key namespace including an encryption key identifier in association with a container identifier that identifies a container from among a plurality of containers;
initializing, by the computing device, after configuring the encryption key namespace, the container with a plurality of namespaces, the namespaces including the encryption key namespace, wherein the initialized container is automatically associated with the container identifier in the encryption key namespace;
obtaining, by the computing device as part of initializing the container, from the encryption key namespace, the encryption key identifier using the container identifier;
requesting, by the computing device, an encryption key for the encryption key identifier from a key management service; and
using the encryption key to decrypt data for use with the container.
2. The method of claim 1 , further comprising:
computing a hash of the container to obtain a hash value, wherein the container identifier is the hash value.
3. The method of claim 1 ,
wherein the container is associated with a customer, and
wherein obtaining the encryption key identifier comprises decrypting, by the computing device, the encryption key namespace using an Application Programming Interface (API) key for the customer.
4. The method of claim 1 , further comprising:
a custom resource for an orchestrator, wherein obtaining the encryption key identifier using the container identifier comprises obtaining, by the custom resource for the orchestrator, the encryption key identifier.
5. The method of claim 1 , further comprising:
a plugin for a container platform, wherein obtaining the encryption key identifier using the container identifier comprises obtaining, by the plugin for the container platform, the encryption key identifier.
6. The method of claim 1 , wherein the encryption key namespace comprises a Linux namespace.
7. The method of claim 1 , wherein receiving the encryption key namespace comprises receiving the encryption key namespace from a key management service.
8. The method of claim 1 , further comprising:
receiving, by the key management service, the encryption key identifier in association with the container identifier; and
configuring, by the key management service, encryption key namespaces in a plurality of host computing devices, each of the encryption key namespaces including the encryption key identifier in association with the container identifier.
9. A method comprising:
receiving, by a computing system, an encryption key identifier in association with a container identifier that identifies a container from among a plurality of containers;
storing, by the computing system, an encryption key identified by the encryption key identifier; and
configuring, by the computing system, encryption key namespaces in a plurality of host computing devices, each of the encryption key namespaces including the encryption key identifier in association with the container identifier, wherein each of the encryption key namespaces is a corresponding encryption key namespace of a kernel of the corresponding host computing device of the plurality of host computing devices, wherein the container is automatically associated with the container identifier in the encryption key namespace.
10. The method of claim 9 , wherein configuring the encryption key namespaces comprises:
determining the plurality of host computing devices are associated with a customer or tenant for the container; and
configuring the encryption key namespaces in the plurality of host computing devices in response to the determination.
11. A computing device comprising:
processing circuitry coupled to a memory, the processing circuitry and memory configured to:
configure an encryption key namespace of a kernel of the computing device, the encryption key namespace including a key identifier in association with a container identifier that identifies a container from among a plurality of containers;
initialize the container with a plurality of namespaces, the namespaces including the encryption key namespace, wherein the initialized container is automatically associated with the container identifier in the encryption key namespace;
obtain, as part of initializing the container, from the encryption key namespace, the key identifier using the container identifier;
request an encryption key for the key identifier from a key management service; and
use the encryption key to decrypt data for use with the container.
12. The computing device of claim 11 , the processing circuitry and memory configured to:
compute a hash of the container to obtain a hash value, wherein the container identifier is the hash value.
13. The computing device of claim 11 ,
wherein the container is associated with a customer, and
wherein, to obtain the encryption key identifier, the processing circuitry and memory are configured to decrypt the encryption key namespace using an Application Programming Interface (API) key for the customer.
14. The computing device of claim 11 , further comprising:
a custom resource for an orchestrator,
wherein, to obtain the encryption key identifier using the container identifier, the processing circuitry and memory are configured to execute the custom resource for the orchestrator to obtain the encryption key identifier.
15. The computing device of claim 11 , further comprising:
a plugin for a container platform,
wherein, to obtain the encryption key identifier using the container identifier, the processing circuitry and memory are configured to execute the plugin for the container platform to obtain the encryption key identifier.
16. The computing device of claim 11 , wherein the encryption key namespace comprises a Linux namespace.
17. The computing device of claim 11 , wherein to receive the encryption key namespace the processing circuitry and memory are configured to receive the encryption key namespace from a key management service.