diff --git a/security/envs/dev/templates/team-platform.yaml b/security/envs/dev/templates/team-platform.yaml index 5a32a2dc3..30afa2b0c 100644 --- a/security/envs/dev/templates/team-platform.yaml +++ b/security/envs/dev/templates/team-platform.yaml @@ -19,6 +19,8 @@ spec: helm: values: | spec: + efsKmsKey: {{ index .Values.spec "efsKmsKey" }} + efsFileSystemId: {{ index .Values.spec "efsFileSystemId" }} ebsKmsKey: {{ index .Values.spec "ebsKmsKey" }} syncPolicy: automated: diff --git a/teams/team-data/dev/templates/efs-ecncrypted-storage-pvc.yaml b/teams/team-data/dev/templates/efs-ecncrypted-storage-pvc.yaml new file mode 100644 index 000000000..74c64608b --- /dev/null +++ b/teams/team-data/dev/templates/efs-ecncrypted-storage-pvc.yaml @@ -0,0 +1,29 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: efs-encrypted-claim +spec: + accessModes: + - ReadWriteMany + storageClassName: efs-encrypted + resources: + requests: + storage: 10Gi +--- +apiVersion: v1 +kind: Pod +metadata: + name: efs-encryption-app +spec: + containers: + - name: app + image: centos + command: ["/bin/sh"] + args: ["-c", "while true; do echo $(date -u) >> /example/out.txt; sleep 5; done"] + volumeMounts: + - name: persistent-storage + mountPath: /example + volumes: + - name: persistent-storage + persistentVolumeClaim: + claimName: efs-encrypted-claim \ No newline at end of file diff --git a/teams/team-platform/dev/templates/efs-encrypted-storage-class.yaml b/teams/team-platform/dev/templates/efs-encrypted-storage-class.yaml new file mode 100644 index 000000000..e91e5bad9 --- /dev/null +++ b/teams/team-platform/dev/templates/efs-encrypted-storage-class.yaml @@ -0,0 +1,18 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: efs-encrypted + annotations: + storageclass.kubernetes.io/is-default-class: "true" +provisioner: efs.csi.aws.com +mountOptions: + - tls +parameters: + fileSystemId: {{ .Values.spec.efsFileSystemId }} + provisioningMode: efs-ap + directoryPerms: "700" + gidRangeStart: "1000" # optional + gidRangeEnd: "2000" # optional +{{ if .Values.spec.efsKmsKey }} + kmsKeyId: {{ .Values.spec.efsKmsKey }} +{{ end }}