How do I mount an encrypted Amazon EFS file system to a pod in Amazon EKS?

Short description

You can encrypt data in your Amazon EFS file system using one of the following methods:

• Encrypting data in transit with TLS
• Encrypting data at rest

In the "Resolution" section, choose an encryption method based on your needs.

Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.

Resolution

Encrypt data in transit with TLS

1.    Deploy the Amazon EFS Container Storage Interface (CSI) driver for your Amazon EKS cluster.

2.    Create an Amazon EFS file system without encryption for your cluster.

3.    Clone the GitHub repository to your local system:

git clone https://github.com/kubernetes-sigs/aws-efs-csi-driver.git

4.    Go to the encryption_in_transit example directory:

cd aws-efs-csi-driver/examples/kubernetes/encryption_in_transit/

5.    Retrieve your Amazon EFS file system ID:

aws efs describe-file-systems --query "FileSystems[*].FileSystemId" --output text

6.    Go to the pv.yaml file in the /examples/kubernetes/encryption_in_transit/specs/ directory. Then, replace the value of VolumeHandle with the FileSystemId of the Amazon EFS file system that needs to be mounted. For example:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: efs-pv
spec:
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: efs-sc
  csi:
    driver: efs.csi.aws.com
    volumeHandle: [FileSystemId]
    volumeAttributes:
      encryptInTransit: "true"

Note: The volumeAttributes: encryptInTransit mount option activates encryption in transit.

7.    Deploy the storage class, persistent volume claim, persistent volume, and pod from the /examples/kubernetes/encryption_in_transit/specs/ directory:

kubectl apply -f specs/storageclass.yaml
kubectl apply -f specs/pv.yaml
kubectl apply -f specs/claim.yaml
kubectl apply -f specs/pod.yaml

8.    After the objects are created, verify that your pod is running:

kubectl get pods

9.    List the persistent volumes in the default namespace:

kubectl get pv

10.    Describe the persistent volume:

kubectl describe pv efs-pv

Note: The Amazon EFS file system ID is listed as the VolumeHandle.

11.    Verify that the data is written onto the Amazon EFS file system:

kubectl exec -ti efs-app -- tail -f /data/out.txt

Encrypt data at rest

1.    Deploy the Amazon EFS CSI driver for your Amazon EKS cluster.

2.    Create an Amazon EFS file system by enabling encryption at rest for your Amazon EKS cluster.

3.    Clone the following GitHub repository to your local system:

git clone https://github.com/kubernetes-sigs/aws-efs-csi-driver.git

4.    Go to the multiple_pods example directory:

cd aws-efs-csi-driver/examples/kubernetes/multiple_pods/

5.    Retrieve your Amazon EFS file system ID:

aws efs describe-file-systems

Example output:

{
 "FileSystems": [
 {
 "SizeInBytes": {
 "Timestamp": ,
 "Value":
 },
 "ThroughputMode": "",
 "CreationToken": “”,
 "Encrypted": true,
 "CreationTime": ,
 "PerformanceMode": "",
 "FileSystemId": "[FileSystemId]",
 "NumberOfMountTargets": ,
 "LifeCycleState": "available",
 "KmsKeyId": "arn:aws:kms:ap-southeast-1:<account_id>:key/854df848-fdd1-46e3-ab97-b4875c4190e6",
 "OwnerId": ""
 },
 ]
}

6.    Go to the pv.yaml file in the /examples/kubernetes/multiple_pods/specs/ directory. Then, replace the value of volumeHandle with the FileSystemId of the Amazon EFS file system that needs to be mounted. For example:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: efs-pv
spec:
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: efs-sc
  csi:
    driver: efs.csi.aws.com
    volumeHandle: [FileSystemId]

7.    Deploy the storage class, persistent volume claim, persistent volume, and pod from the /examples/kubernetes/multiple_pods/specs/ directory:

kubectl apply -f specs/storageclass.yaml
 kubectl apply -f specs/pv.yaml
 kubectl apply -f specs/claim.yaml
 kubectl apply -f specs/pod1.yaml
 kubectl apply -f specs/pod2.yaml

8.    After the objects are created, verify that your pod is running:

kubectl get pods

9.    List the persistent volumes in the default namespace:

kubectl get pv

10.    Describe the persistent volume:

kubectl describe pv efs-pv

11.    Verify that the data is written onto the Amazon EFS file system:

kubectl exec -ti app1 -- tail /data/out1.txt
kubectl exec -ti app2 -- tail /data/out1.txt