Allow root volume encryption (on AWS)

[ghost]

When you have to use encryption at rest, you currently have to create your own encrypted AMIs on AWS and use these as base image.

With AWS you can create EC2 instances directly from a public AMI with an encrypted root volume with you own KMS key. In Terraform, for example, you could do this:

resource "aws_instance" "foobar" {
  ...

  root_block_device {
    volume_size = 256
    encrypted = true
    kms_key_id = data.aws_kms_key.my-key.arn
  }
}

InstanceGroups should support this, too. Suggestion:

apiVersion: kops.k8s.io/v1alpha2
kind: InstanceGroup
metadata:
  labels:
    kops.k8s.io/cluster: example.com
  name: nodes
spec:
  image: <random public image>
  role: Node
  ...
  rootVolumeEncryption: true
  rootVolumeEncryptionKey: <key ARN>
  ...

[johngmyers]

/kind feature
/area provider/aws

[hakman]

@MichaelJDrK do you really need a specific KMS key or the default one will do just fine?

[ghost]

@MichaelJDrK do you really need a specific KMS key or the default one will do just fine?

Sorry for the late answer, I've been on vacation.

Yes, for compliance reasons we have to use customer managed keys (CMK), so we need to provide a specific KMS key

[hakman]

OK, thanks for explaining. Will try to add the encryption keys also in kops 1.19.

[djerraballi]

so as of right now will the root volume encryption flag use the default? Or is the flag just added to the spec, but not actively used?

Edit: nvm see that it's being passed through to the auto scaling group.

[YiannisH]

so as of right now will the root volume encryption flag use the default? Or is the flag just added to the spec, but not actively used?

Edit: nvm see that it's being passed through to the auto scaling group.

As of today which 1.19 is in beta i only see the the root volume encryption can enabled but not with a custom kms key. Correct me if i am wrong.. see here the code 36fbf9f#diff-a0bf037707fdd86cfc323f077cc9fff8c5b3bc7dbf6bfc23cfcb6ae572ce88f3

@hakman Can you please verify the status of this?
Thanks

[scDisorder]

so as of right now will the root volume encryption flag use the default? Or is the flag just added to the spec, but not actively used?
Edit: nvm see that it's being passed through to the auto scaling group.

As of today which 1.19 is in beta i only see the the root volume encryption can enabled but not with a custom kms key. Correct me if i am wrong.. see here the code 36fbf9f#diff-a0bf037707fdd86cfc323f077cc9fff8c5b3bc7dbf6bfc23cfcb6ae572ce88f3

@hakman Can you please verify the status of this?
Thanks

Nope, it is just a field now waiting for its realisation. I hope i'll commit it soon.

[DOboznyi]

@hakman we faced with issue that if you add volume encryption key and encryption itself kops provide new version of launch template, but it doesn't switch default version to new version of launch template. So we should do it manually.

[hakman]

@DOboznyi please create an issue with simplest way to reproduce the problem and will take a look.