Re:Encrypting Postgres Data at Rest in Kubernetes
by CamouflagedKiwi on Sunday October 31, 2021 @12:53PM
(#29058322)
Agreed, although it does mean that if you release the volume you aren't relying on the cloud provider to wipe it before reuse (AFAIK they generally do that, AWS definitely does but it's possible other providers might not, especially if you're on some more custom OpenShift style setup).
[ Parent
| on HN ]
Re:Encrypting Postgres Data at Rest in Kubernetes
by jeffbee on Sunday October 31, 2021 @01:06PM
(#29058428)
GCE persistent disks are always encrypted anyway, with a customer-provided key if the customer chooses, or an automatic ephemeral key otherwise. I think the only storage option in GCE that doesn't feature customer encryption keys is locally-attached SSD, where you'd need to layer your own crypto on top. Definitely don't rely on cloud providers to wipe your data.