Configuring KMS-based encryption on an Kubernetes cluster

InfoScale for Kubernetes supports robust data-at-rest encryption for volumes and disk groups by integrating with external, KMIP-compliant Key Management Servers (KMS). To enable this functionality, administrators must establish a secure connection using a custom CA certificate, which can be generated using tools such as cfssl. Once the certificate is configured as a Kubernetes secret, the system can securely transfer and manage encryption keys.

Ongoing maintenance is critical to ensure continued encryption. External CA certificates require manual renewal after 12 months, with administrators encouraged to initiate the process after the eighth month. Additionally, InfoScale client rest certificates must be renewed and re-uploaded to the KMS server every three months. Following certificate updates, specific secrets must be deleted to trigger automatic regeneration, and the KMS configuration process must be re-verified to maintain the integrity of the encryption lifecycle.