Integrating GKE and KMS
It is feasible to use KMS to encrypt the Secrets on the Google Kubernetes Container Engine. By default, GKE will encrypt data at rest, and the encryption is managed by GCP. Apart from this secure handling of our data, we might want to have more control over the encryption of the data. In this case, we have the option to encrypt the data residing on Kubernetes by using a KMS key that we provision and maintain in our GCP project. We shall start by provisioning the KMS key:
resource "google_kms_key_ring" "ksm_key_ring" {
name = "ksm-key-ring"
location = var.region
}
resource "google_kms_crypto_key" "ksm_secret_key" {
name = "ksm-secret-encryption"
key_ring = google_kms_key_ring.ksm_key_ring.id
lifecycle {
prevent_destroy = false
}
} We should also assign permissions in order...
