vSphere persistent disks encryption

You can encrypt virtual machines (VMs) and dynamically provisioned persistent volumes (PVs) on Red Hat OpenShift Container Platform running on top of vSphere.

Note

Red Hat OpenShift Container Platform does not support RWX-encrypted PVs. You cannot request RWX PVs out of a storage class that uses an encrypted storage policy.

You must encrypt VMs before you can encrypt PVs, which you can do during or after installation.

For information about encrypting VMs, see:

  • "Requirements for encrypting virtual machines"

  • "During installation: Step 7 of Installing RHCOS and starting the Red Hat OpenShift Container Platform bootstrap process"

  • "Enabling encryption on a vSphere cluster"

After encrypting VMs, you can configure a storage class that supports dynamic encryption volume provisioning using the vSphere Container Storage Interface (CSI) driver. This can be accomplished in one of two ways using:

  • Datastore URL: This approach is not very flexible, and forces you to use a single datastore. It also does not support topology-aware provisioning.

  • Tag-based placement: Encrypts the provisioned volumes and uses tag-based placement to target specific datastores.

← Previous: Installation of a cluster in FIPS mode | ↑ Up: Secure | ⌂ Home: Red Hat OpenShift Container Platform | Next: etcd encryption →