Method to encrypt the data at rest for data residing on Kubernetes persistent volumes

1. A system, for self-configuring a self-contained executable module (Pod) utilizing encrypted data storage, comprising:

a network interconnecting components of the system for exchange of data thereon;

at least one server with a processor; and

a computer-readable medium coupled to the processor, the computer-readable medium comprising one or more computer readable instructions, the processor executing the one or more computer readable instructions to execute at least one node;

the at least one node operable to execute an application from application instructions; and

wherein a specification is accessed comprising instructions for creation of a Pod, the Pod to comprise an application container comprising the application instructions and an encrypted data storage utilized by the application;

wherein a server of the system receives notification of the specification and, in response to receiving the notification, further determines that the specification includes a requirement for encrypted data storage and, in response to the further determination, inserts into the specification an initialization container specification for an initialization container comprising an encryption key, wherein the initialization container will execute prior to the execution of the application container;

wherein the at least one node executes the Pod comprising the initialization container and the application container; and

wherein the at least one node executes the initialization container configured with the initialization container specification to perform encryption of data on a disk hardware utilizing the encryption key, mounting of a disk volume, for the disk hardware, at a location path defined in the specification and upon completion of execution of the initialization container, and executes the application container to execute the application accessing the encrypted data storage at such disk hardware via the disk volume.

2. The system of claim 1 , wherein the encrypted data storage is mounted on the disk hardware comprising encrypted data concurrently with non-encrypted data.

3. The system of claim 1 , wherein the encrypted data storage is mounted on the disk hardware comprising encrypted data encrypted with the encryption key concurrently with other encrypted data encrypted with a different encryption key.

4. The system of claim 1 , wherein:

the specification comprises a definition for a sidecar application comprising instructions to close the encrypted data storage; and

a node of the at least one node executes the application container to completion and, therefore, executes the sidecar application.

5. The system of claim 1 , wherein the initialization container is compliant with Kubernetes ‘init container’.

6. The system of claim 1 , wherein the server performs operations via execution of a Kubernetes ‘MutatingAdmissionWebhook’.

7. The system of claim 6 , wherein the Kubernetes ‘MutatingAdmissionWebhook’ calls a second server with a Kubernetes ‘AdmissionReview’ request and, in response, receives the specification for the initialization container.

8. The system of claim 1 , wherein:

the at least one node comprises a first node and a second node; and

wherein the first node executes the Pod comprising the initialization container and the application container; and

moving the Pod from the first node to the second node for execution on the second node and maintaining the encrypted data storage without performing a de-encryption and re-encryption and wherein code of the application accesses the encrypted data storage as encrypted with the encryption key.

9. The system of claim 1 , wherein:

mounting propagation of the initialization container is bidirectional propagation;

mounting propagation for the application container is, host to container, propagation; and

wherein the encrypted data storage is mounted on the disk hardware comprising encrypted data concurrently with non-encrypted data and accessible to each of the initialization container and application container access the disk hardware.

10. The processor of claim 1 , wherein the server performs operations via execution of a Kubernetes ‘MutatingAdmissionWebhook’.

11. The processor of claim 10 , wherein the Kubernetes ‘MutatingAdmissionWebhook’ calls a second server with a Kubernetes ‘AdmissionReview’ request and, in response, receives the specification for the initialization container.

12. A method for configuring a self-contained executable module (Pod) utilizing encrypted data storage, comprising:

accessing a Pod creation specification comprising specification instructions for creation of a Pod, the Pod to comprise an application container comprising application instructions for an application and an encrypted data storage utilized by the application;

determining, by a processor, that the Pod creation specification includes a requirement for encrypted data storage and, in response to determining that the Pod creation specification includes the requirement, automatically inserting into the Pod creation specification an initialization container specification for an initialization container comprising an encryption key, wherein the initialization container will execute prior to execution of the application container;

executing the Pod comprising the initialization container and the application container;

executing the initialization container configured with the initialization container specification; and

wherein the initialization container is configured with the initialization container specification to perform encryption of data on a disk hardware utilizing the encryption key, mounting of a disk volume, for the disk hardware, at a location path defined in the Pod creation specification and upon completion of execution of the initialization container, and executing the application container to execute the application accessing the encrypted data storage at such disk hardware via the disk volume.

13. The method of claim 12 , wherein executing the Pod further comprises mounting the encrypted data storage to the disk hardware comprising encrypted data concurrently with non-encrypted data.

14. The method of claim 12 , wherein executing the Pod further comprises mounting the encrypted data storage to the disk hardware comprising encrypted data encrypted with the encryption key concurrently with other encrypted data encrypted with a different encryption key.

15. The method of claim 12 , wherein:

the Pod creation specification comprises a definition for a sidecar application comprising instructions to close the encrypted data storage; and

upon executing the Pod comprising the initialization container and the application container to completion, executing the sidecar application.

16. The method of claim 12 , wherein accessing the Pod creation specification comprises generating the Pod creation specification from a service requesting execution of the application.

17. The method of claim 12 , comprising operations on a system of networked components executing within a Kubernetes platform.

18. A processor, executing a service, comprising:

accessing a Pod creation specification comprising specification instructions for creation of a Pod, the Pod to comprise an application container comprising the application instructions and an encrypted data storage utilized by the application instructions;

determining, by the processor, that the Pod creation specification includes a requirement for encrypted data storage and, in response, automatically inserting into the Pod creation specification an initialization container specification for an intialization container comprising an encryption key, wherein the initialization container will execute prior to the execution of the application container; and

executing the Pod comprising the initialization container and the application container; and

wherein the service accesses encrypted data and non-encrypted data concurrently maintained on a disk comprising the encrypted data storage; and

wherein the processor executes the initialization container configured with the initialization container specification to perform encryption of data on a disk hardware utilizing the encryption key, mounting of a disk volume, for the disk hardware, at a location path defined in the Pod creation specification and upon completion of execution of the initialization container, and executes the application container to execute the application instructions accessing the encrypted data storage at such disk hardware via the disk volume.

19. The processor of claim 18 , wherein:

the Pod creation specification comprises a definition for a sidecar application comprising instructions to close the encrypted data storage; and

a node of at least one node executes the application container to completion and, therefore, executes the sidecar application.

20. The processor of claim 18 , wherein the initialization container is compliant with Kubernetes ‘init container’.