Efs encryption at rest

[aliaksei-ivanou]

Issue #, if available:

Description of changes:
Creating a workload demonstrating EFS encryption-at-rest capabilities.

team-platform is responsible for creating a storage class efs-encrypted.

team-data deploys an example workload that uses the encrypted storage class via a PersistentVolumeClaim (PVC) efs-encrypted-claim.

❯ kubectl get storageclass
NAME                      PROVISIONER             RECLAIMPOLICY   VOLUMEBINDINGMODE      ALLOWVOLUMEEXPANSION   AGE
efs-encrypted (default)   efs.csi.aws.com         Delete          Immediate              false                  70m
efs-sc                    efs.csi.aws.com         Delete          Immediate              false                  91m
gp2 (default)             kubernetes.io/aws-ebs   Delete          WaitForFirstConsumer   false                  119m

❯ kubectl get storageclass efs-encrypted -o jsonpath='{.parameters.kmsKeyId}'
arn:aws:kms:us-east-1:111222333444:key/19f4f602-dcf3-42a5-8eef-38f2af4b3626%  

❯ kubectl get pvc -n data
NAME                  STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS    AGE
efs-encrypted-claim   Bound    pvc-06df2640-ae2f-44ae-8d5c-82c72e56a9ae   10Gi       RWX            efs-encrypted   63m

❯ kubectl get pods -n data
NAME                 READY   STATUS    RESTARTS   AGE
efs-encryption-app   1/1     Running   0          63m

❯ kubectl describe pvc efs-encrypted-claim -n data
Name:          efs-encrypted-claim
Namespace:     data
StorageClass:  efs-encrypted
Status:        Bound
Volume:        pvc-06df2640-ae2f-44ae-8d5c-82c72e56a9ae
Labels:        argocd.argoproj.io/instance=team-data
Annotations:   pv.kubernetes.io/bind-completed: yes
               pv.kubernetes.io/bound-by-controller: yes
               volume.beta.kubernetes.io/storage-provisioner: efs.csi.aws.com
               volume.kubernetes.io/storage-provisioner: efs.csi.aws.com
Finalizers:    [kubernetes.io/pvc-protection]
Capacity:      10Gi
Access Modes:  RWX
VolumeMode:    Filesystem
Used By:       efs-encryption-app
Events:        <none>

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[shapirov103]

Looks good, please share functional verification result.

[aliaksei-ivanou]

❯ kubectl get pods -o wide -n data

NAME                 READY   STATUS    RESTARTS   AGE     IP            NODE                           NOMINATED NODE   READINESS GATES
ebs-encryption-app   1/1     Running   0          82m     10.0.127.0    ip-10-0-125-125.ec2.internal   <none>           <none>
efs-encryption-app   1/1     Running   0          2m50s   10.0.96.233   ip-10-0-125-125.ec2.internal   <none>           <none>
❯ kubectl exec efs-encryption-app -n data -- bash -c "cat example/out.txt"
Wed Mar 22 19:29:29 UTC 2023
Wed Mar 22 19:29:34 UTC 2023
Wed Mar 22 19:29:39 UTC 2023
Wed Mar 22 19:29:44 UTC 2023
Wed Mar 22 19:29:49 UTC 2023
Wed Mar 22 19:29:54 UTC 2023
Wed Mar 22 19:29:59 UTC 2023
Wed Mar 22 19:30:04 UTC 2023
Wed Mar 22 19:30:10 UTC 2023
Wed Mar 22 19:30:15 UTC 2023
Wed Mar 22 19:30:20 UTC 2023
❯ kubectl exec ebs-encryption-app -n data -- bash -c "cat example/out.txt"
Wed Mar 22 18:07:47 UTC 2023
Wed Mar 22 18:07:52 UTC 2023
Wed Mar 22 18:07:57 UTC 2023
Wed Mar 22 18:08:02 UTC 2023
Wed Mar 22 18:08:07 UTC 2023

[shapirov103]

lgtm