Method and service to encrypt data stored on volumes used by containers
A method and service to encrypt data at rest on disks that are managed by a container orchestrator (CO) using a container storage interface (CSI). The method and service including intercepting a request transferred from a CO to a CSI plugin and sending the intercepted request to an encryption proxy plugin. The method and service also including examining the request to determine if encryption is needed. In response to encryption being needed, performing encryption on the volume. The method and service also transferring the intercepted request to the container storage interface plugin.
1. A system that executes a method of operating an intermediate service to perform encryption on a storage volume, the system comprising:
a processor; and
memory including one or more instructions that when executed by the processor cause the processor to:
intercept a request transferred from a container orchestrator to a container storage interface plugin;
transfer the intercepted request to the intermediate service;
examine the request to determine if encryption is needed;
in response to encryption being needed:
transfer the intercepted request to the container storage interface plugin;
intercept a response from the container storage interface plugin to the container orchestrator; and
perform encryption on the storage volume.
2. The system of claim 1 , wherein the request comprises a remote procedure call.
3. The system of claim 1 , wherein the request comprises a request to create the storage volume.
4. The system of claim 1 , wherein the request comprises a request to attach the storage volume.
5. The system of claim 1 , wherein performing the encryption comprises performing the encryption using cryptsetup library.
6. The system of claim 1 , wherein performing the encryption comprising making the storage volume accessible to a node.
7. The system of claim 1 , wherein the storage volume comprises a persistent storage volume.
8. A hardware encryption proxy component to perform encryption on a storage volume, the hardware encryption proxy component comprising:
a communication interface configured to intercept a request transferred from a container orchestrator to a container storage interface plugin;
a processor configured to examine the request to determine if encryption is needed;
in response to encryption being needed,
the communication interface configured to transfer the intercepted request to the container storage interface plugin and to intercept a response from the container storage interface plugin to the container orchestrator; and
the processor configured to encrypt the storage volume.
9. The hardware encryption proxy component of claim 8 , wherein the request comprises a remote procedure call.
10. The hardware encryption proxy component of claim 8 , wherein the request comprises a request to create the storage volume.
11. The hardware encryption proxy component of claim 8 , wherein the request comprises a request to attach the storage volume.
12. The hardware encryption proxy component of claim 8 , wherein performing the encryption comprises performing the encryption using cryptsetup library.
13. The hardware encryption proxy component of claim 8 , wherein performing the encryption comprising making the storage volume accessible to a node.
14. The hardware encryption proxy component of claim 8 , wherein the storage volume comprises a persistent storage volume.
15. A non-transitory computer readable medium having stored thereon instructions that, when executed by a processor, perform a method of operating an intermediate service to perform encryption on a storage volume, the method comprising:
intercepting a request transferred from a container orchestrator to a container storage interface plugin;
transferring the intercepted request to an encryption proxy plugin;
examining the intercepted request to determine if encryption is needed;
in response to encryption being needed:
transferring the intercepted request to the container storage interface plugin;
intercepting a response from the container storage interface plugin to the container orchestrator; and
performing encryption on the storage volume.
16. The non-transitory computer readable medium of claim 15 , wherein the request comprises a remote procedure call.
17. The non-transitory computer readable medium of claim 15 , wherein the request comprises a request to create the storage volume.
18. The non-transitory computer readable medium of claim 15 , wherein the request comprises a request to attach the storage volume.
19. The non-transitory computer readable medium of claim 15 , wherein performing the encryption comprises performing the encryption using cryptsetup library.
20. The non-transitory computer readable medium of claim 15 , wherein performing the encryption comprises making the storage volume accessible to a node.