Enabling customer-managed encryption keys for a machine set

To enhance data security, enable customer-managed encryption on Microsoft Azure by adding the disk encryption set ID to your machine set.

You can supply an encryption key to Azure to encrypt data on managed disks at rest. You can enable server-side encryption with customer-managed keys by using the Machine API.

An Azure Key Vault, a disk encryption set, and an encryption key are required to use a customer-managed key. The disk encryption set must be in a resource group where the Cloud Credential Operator (CCO) has granted permissions. If not, an additional reader role is required to be granted on the disk encryption set.

Prerequisites
Procedure

  • Configure the disk encryption set under the providerSpec field in your machine set YAML file. For example:

    providerSpec:
  value:
    osDisk:
      diskSizeGB: 128
      managedDisk:
        diskEncryptionSet:
          id: /subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.Compute/diskEncryptionSets/<disk_encryption_set_name>
        storageAccountType: Premium_LRS
Additional resources

↑ Up: Enable customer-managed encryption keys | ⌂ Home: Red Hat OpenShift Container Platform | Next: Enabling customer-managed encryption keys for a machine set →