Announcing the integration of Red Hat OpenShift on IBM Cloud and IBM Cloud Kubernetes Service with IBM Cloud Hyper Protect Crypto Services.

Moving confidential data and workloads to the cloud brings up challenges with ensuring the right security controls are in place to protect the data. Customers want to ensure that their data and IP are safe from both internal and external threats. IBM recently announced industry-leading security capabilities to enable enterprise customers who are looking to store highly sensitive data in the public cloud.

The industry’s highest level of encryption key protection is now available for IBM Cloud Kubernetes Service and Red Hat OpenShift on IBM Cloud through integration with IBM Cloud Hyper Protect Crypto Services.

What is IBM Cloud Hyper Protect Crypto Services?

IBM Cloud Hyper Protect Crypto Services is a single-tenant Key Management Service and a Cloud Hardware Security Module (HSM) service. Key vaulting is provided by dedicated, customer-controlled cloud HSMs that are built on FIPS 140-2 Level 4-certified (tamper-proof) hardware, the highest offered by any cloud provider in the industry. The service offers Keep Your Own Key (KYOK) capabilities, which allow customers to have exclusive key control— only authorized users have access (no privileged users, including IBM Cloud admins, have access) to encryption keys.

What is Red Hat OpenShift on IBM Cloud?

Red Hat OpenShift on IBM Cloud is a managed service that simplifies deployment and configuration of the OpenShift Container Platform. As a managed service, IBM will automate initial provisioning as well as ongoing maintenance, including operating system patches, vulnerability remediation, and any updates in the OpenShift stack. 

What is the IBM Cloud Kubernetes Service?

IBM Cloud Kubernetes Service is a managed container service offering that leverages Kubernetes as the container orchestration solution. It delivers powerful management tools, an intuitive user experience, and built-in security and isolation to enable rapid delivery of applications, all while leveraging Cloud Services and cognitive capabilities from Watson. As a certified CNCF K8s provider, IBM Cloud Kubernetes Service provides native Kubernetes capabilities like intelligent scheduling, self-healing, horizontal scaling, service discovery and load balancing, automated rollouts and rollbacks, and secret and configuration management.

Protecting sensitive data in applications

When it comes to cloud native applications built with Kubernetes, data protection should cover both Kubernetes secrets and the persistent datastores used by the apps. IBM Cloud Kubernetes Service already provides support for Bring Your Own Key (BYOK) through integration with IBM Key Protect. Key Protect is a multi-tenant service with key vaulting provided by IBM-controlled, FIPS 140-2 Level 3 certified Hardware Security Modules (HSM).

Exclusive key control with KYOK

Customers looking to safeguard highly sensitive data want to use their own keys for encryption and also require complete control of their encryption keys. For these customers, Hyper Protect Crypto Services provides exclusive control over the entire key hierarchy, including the master key of the HSM that protects the secrets. The Level-4 certification assures that the HSM is tamper-proof—it can sense any attempt to compromise the HSM via physical, chemical, or environmental changes and immediately responds by auto-erasing the keys stored, which then invalidates the data that the keys protect.

  • Kubernetes secrets: A secret is an object that stores sensitive data like a password, a token, or a key. There are built-in secrets that are created automatically by Kubernetes, such as the secret containing credentials for access the API endpoint. There are also user-created secrets, such as storing access information to leverage other IBM Cloud services, including Watson and IBM Cloud Container Registry. By default, the Kubernetes master (API server) stores secrets as base64 encoded plain text in etcd. In order to enable customer-managed encryption control for the secrets, IBM Kubernetes Service now provides support for Keep Your Own Key (KYOK) through integration with Hyper Protect Crypto Services.
  • Persistent datastores used by the app: IBM Cloud Kubernetes Service allows customers to store data on persistent storage. Supported storage types include VPC Block Storage and Cloud Object Storage, both of which integrate with Hyper Protect Crypto Services to provide customers with KYOK capability.

The KYOK integration is also available for Red Hat OpenShift on IBM Cloud for protection of Kubernetes secrets.

Learn more

For more information, see “Protecting sensitive information in your cluster.”

For general questions, engage our team via Slack by registering here and join the discussion in the #general channel on our public IBM Cloud Kubernetes Service Slack.


More from Announcements

IBM TechXchange underscores the importance of AI skilling and partner innovation

3 min read - Generative AI and large language models are poised to impact how we all access and use information. But as organizations race to adopt these new technologies for business, it requires a global ecosystem of partners with industry expertise to identify the right enterprise use-cases for AI and the technical skills to implement the technology. During TechXchange, IBM's premier technical learning event in Las Vegas last week, IBM Partner Plus members including our Strategic Partners, resellers, software vendors, distributors and service…

Introducing Inspiring Voices, a podcast exploring the impactful journeys of great leaders

< 1 min read - Learning about other people's careers, life challenges, and successes is a true source of inspiration that can impact our own ambitions as well as life and business choices in great ways. Brought to you by the Executive Search and Integration team at IBM, the Inspiring Voices podcast will showcase great leaders, taking you inside their personal stories about life, career choices and how to make an impact. In this first episode, host David Jones, Executive Search Lead at IBM, brings…

IBM watsonx Assistant and NICE CXone combine capabilities for a new chapter in CCaaS

5 min read - In an age of instant everything, ensuring a positive customer experience has become a top priority for enterprises. When one third of customers (32%) say they will walk away from a brand they love after just one bad experience (source: PWC), organizations are now applying massive investments to this experience, particularly with their live agents and contact centers.  For many enterprises, that investment includes modernizing their call centers by moving to cloud-based Contact Center as a Service (CCaaS) platforms. CCaaS solutions…

See what’s new in SingleStoreDB with IBM 8.0

3 min read - Despite decades of progress in database systems, builders have compromised on at least one of the following: speed, reliability, or ease. They have two options: one, they could get a document database that is fast and easy, but can’t be relied on for mission-critical transactional applications. Or two, they could rely on a cloud data warehouse that is easy to set up, but only allows lagging analytics. Even then, each solution lacks something, forcing builders to deploy other databases for…