Encrypt the temporary storage space of an elastic container instance to protect data at rest and meet compliance requirements. Encryption uses AES-256 with KMS-managed service keys and applies automatically to all reads and writes.
How it works
Each elastic container instance provides 30 GiB of temporary storage space by default for container images and runtime data. You can increase this size as needed.
To enable encryption, add an annotation to the pod metadata. Elastic Container Instance then encrypts all data on the storage space with AES-256 using KMS service keys, which are free of charge.
Prerequisites
Before you begin, make sure that you have:
-
An activated KMS instance. Purchase a dedicated KMS instance
KMS automatically creates and manages service keys at no cost.
Enable encryption
Add the following annotation to your pod metadata:
|
Annotation |
Value |
Description |
|
|
|
Enables AES-256 encryption for the temporary storage space |
Annotations must be added to the metadata in the configuration file of the pod. For example, when you create a Deployment, you must add annotations in the spec.template.metadata section.
Elastic Container Instance-related annotations are only applied when a pod is created. Adding or modifying these annotations on an existing pod will have no effect.
Example: Deployment with encrypted storage
The following Deployment enables temporary storage encryption:
apiVersion: apps/v1
kind: Deployment
metadata:
name: kms-test
labels:
app: test
spec:
replicas: 1
selector:
matchLabels:
app: test
template:
metadata:
name: kms-test
labels:
app: test
alibabacloud.com/eci: "true" # Schedule the pod on Elastic Container Instance
annotations:
k8s.aliyun.com/eci-ephemeral-storage-options: "{\"encrypted\":\"true\"}" # Encrypt the temporary storage space
spec:
containers:
- name: test
image: registry-vpc.cn-beijing.aliyuncs.com/eci_open/nginx:1.4.2