Encryption

ITX Launcher Server does not itself perform encryption and decryption of the data at rest. To ensure the data in your persistent volumes is encrypted at rest, when defining persistent volume claims for the ITX Launcher Server, you must specify a filesystem-based storage class that is available in your cluster and supports encryption. For some storage classes, the data may be encrypted automatically by their respective storage providers, but in some cases additional manual configuration may be necessary, such as definition and enablement of encryption keys. For more information, see documentation for the storage classes available in your environment.

In those cases where filesystem-based encryption is not available or only needed in select circumstances, the ITX cipher adapter may be used in maps, flows and configuration files to encrypt data that is stored to disk and decrypt the same data that is retrieved from disk. This capability is documented in the ITX Design Studio examples and online help. The data is encrypted with a highly secure symmetric AES-256 cipher. The key that is used for encryption and decryption can be stored as a secret in the cluster. By mounting the secret key via the external.secrets section of the values.yaml file, the data at rest on disk remains securely encrypted.