Compute Infrastructure

Encrypted Workers in the IBM Cloud Container Service

Share this post:

The IBM Cloud Container Service combines Docker and Kubernetes to deliver powerful tools, an intuitive user experiences, and built-in security and isolation. You can rapidly deliver your apps while leveraging IBM Cloud services like artificial intelligence with Watson.

Today, we are proud to announce that we are turning on encryption of worker nodes by default. Many internal teams and external customers asked us for encrypted data volumes on worker nodes, and we listened to you!

What this means for you

As of today, this change makes your data in new clusters and workers that you create even more secure by default.

IBM Cloud Container Service provides encrypted data partitions for all worker nodes by provisioning them with two local SSD partitions. The first boot partition is not encrypted, and the second partition mounted to /var/lib/docker is unlocked at boot time by using LUKS encryption keys. Each worker in each Kubernetes cluster has its own unique LUKS encryption key, managed by the IBM Cloud Container Service. At boot time, they are pulled securely and then discarded after the encrypted disk is unlocked.

You might find that some workloads with high-performance disk I/O requirements are impacted when encrypted. In some of our encrypted performance tests, we saw single-digit percentage disk I/O impact, but in most there was no impact. If you have performance-sensitive workloads, you might want to do benchmarks tests with both encryption-enabled and disabled to help you decide if you want to turn off encryption.

How to get started

From the IBM Cloud console GUI, encryption is already turned on for you. If you want to turn off encryption, clear the Encrypt local disk check box (see below) when you create a cluster or add a worker to an existing cluster.

From the CLI, to take advantage of default encryption, first update your plug-in with the following command:

bx plugin update container-service -r Bluemix

Now, encryption is turned on by default when you create a cluster or add a worker to an existing cluster! If you want to disable encryption, specify the --disable-disk-encrypt option when using the cluster-create or the worker-add commands.

Questions or comments?

Please join us on our public Slack channel at https://ibm-container-service.slack.com.

IBM Cloud Kubernetes Service - Core Dev Lead

More Compute Infrastructure stories
February 12, 2019

Intel on IBM Cloud: The Latest Microarchitecture for Processor Enthusiasts

IBM Cloud is excited to announce the upcoming availability of IBM Cloud Bare Metal and Virtual Servers powered by the new Cascade Lake family of Intel® Xeon® Scalable Processors.

Continue reading

February 12, 2019

IBM POWER9 on IBM Cloud: More Choice and Flexibility, On-Premise and Off

To help clients succeed in today’s hybrid, multicloud reality, the IBM Cloud and IBM Power Systems teams are bringing the IBM POWER9 platform to the cloud with the new IBM Power Systems Virtual Server on IBM Cloud—available in select IBM Cloud data centers spring 2019.

Continue reading

February 11, 2019

IBM Cloud Internet Services is Enhancing the Edge

We are thrilled to announce two very exciting enhancements—"Range" and "Edge Functions"—to IBM Cloud Internet Services (CIS).

Continue reading