Skip to main content
Version: 3.3

Encrypt Portworx Volumes

This guide will give you an overview of how to use the encryption feature for Portworx volumes. Under the hood, Portworx uses the libgcrypt library to interface with the dm-crypt module for creating, accessing and managing encrypted devices. Portworx uses the LUKS format of dm-crypt and AES-256 as the cipher with xts-plain64 as the cipher mode.

All encrypted volumes are protected by a passphrase. Portworx uses this passphrase to encrypt the volume data at rest as well as in transit. It is recommended to store these passphrases in a secure secret store.

There are two ways in which you can provide the passphrase to Portworx:

  • Per volume secret: Use a unique secret for each encrypted volume
  • Cluster-wide secret: Use a default common secret for all encrypted volumes

Depending on your choice of secret provider, follow the instructions to first configure a secret store with Portworx Enterprise to store your passphrases, and then encrypt the PVCs by using the secrets and passphrases.

Secret ProviderStep 1: Set Up a Secret StoreStep 2: Encrypt Volumes Using Secrets
IBM key management servicesSet Up IBM key management services
AWS KMSSet up AWS KMS
Kubernetes SecretsSet up Kubernetes Secrets
VaultSet up Vault
Vault TransitSet Up Vault Transit
Google Cloud KMSSet up Google Cloud KMS

You can also set up Azure Key Vault to support volume encryption, similar to other secret providers. However, encryption using named secrets is not supported with Azure Key Vault. For information about setting up Azure Key Vault for volume encryption, Set up Azure Key Vault.

To encrypt volumes, follow the steps in Encrypting Kubernetes PVCs with Google Cloud KMS. Note that the "Encryption using named secrets" option is not supported with Azure Key Vault.