Encryption
Last updated
Was this helpful?
Last updated
Was this helpful?
In-flight encryption for UltiHash can be configured on two different levels:
Internal Ingress object - part of the UltiHash deployment on Kubernetes
External load balancer - a proxy that fronts Kubernetes cluster and distributes traffic to its nodes
The Helm chart deploys UltiHash with a dedicated object by default. The object is located in the same namespace as the deployed UltiHash cluster and can be found by executing the command below (replace <namespace>
with the Kubernetes namespace where your UltiHash cluster is deployed):
The Ingress object can be configured in a custom way via Helm values:
To enable TLS encryption at Ingress level perform the following actions:
register a domain name for UltiHash cluster in your private or public DNS server (for example example.domain.name
)
generate TLS private key and certificate bound to your registered domain name
enable the Ingress object using your domain name and the corresponding TLS secret in the helm values:
The TLS configuration for an external load balancer heavily depends on the type of the used load balancer. Please refer to the documentation of your load balancer.
The configuration of at-rest encryption for UltiHash cluster depends on the CSI driver used on your Kubernetes cluster. Please refer to the documentation of your CSI driver.
To enable UltiHash cluster using the storage class above, specify it in the helm values of the UltiHash helm chart:
create a Kubernetes secret in your UltiHash namespace with TLS credentials as shown (assume the secret's name is secret-tls
)
shows the TLS configuration for a on AWS (the recommended load balancer type to use on AWS for higher performance).
In the case of on AWS EKS cluster, here is an example of a network load balancer configuration with TLS. To provision a network load balancer automatically, the has to be installed in advance. Modify the helm values of the in the following way:
The example below shows how to enable encryption at rest for data stored in UltiHash in the case of . The driver has to be installed in advance before deploying UltiHash cluster, please follow the . After the EBS CSI driver is installed, provision a storage class on your Kubernetes cluster with the configuration as shown below: