Strimzi
Persistent claim #6366
-
|
Hi Is there any way we can create PVC with Encryption type - Customer-managed instead of Google Managed? the PVC encryption type is this something Strimzi set during the creation of the PVC? or this is something we need to do when setting up the Persistent Volume storage class? If we use CMEK, do we need to mention that somewhere in KAFKA broker creation yaml? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
I guess I do not have deep enough experience with GKE to understand all the differences and TBH I do not know what exactly customer managed encryption means here. But I would expect this to be configured in the Storage Class which is used to create the PVCs (which in turn create the PVs). Thsi is for example where some of the encryption details are configured for EBS volumes in Amazon AWS (such as which KMS key should be used etc.). |
Beta Was this translation helpful? Give feedback.
-
|
Thank you, I did run a POC in our setup. All we have to do is change the storage class so that PVC is claimed of the correct Persistent Volume. It works fine and only change to strimzi is documented in https://strimzi.io/blog/2019/07/08/persistent-storage-improvements/ by you in detail how to change class: |
Beta Was this translation helpful? Give feedback.
I guess I do not have deep enough experience with GKE to understand all the differences and TBH I do not know what exactly customer managed encryption means here. But I would expect this to be configured in the Storage Class which is used to create the PVCs (which in turn create the PVs). Thsi is for example where some of the encryption details are configured for EBS volumes in Amazon AWS (such as which KMS key should be used etc.).