Encrypting Postgres Data at Rest in Kubernetes

Re:Encrypting Postgres Data at Rest in Kubernetes by sylr on Sunday October 31, 2021 @02:37PM (#29059197)

I consider anything in kubernetes disposable. I want to be able to lift and shift anything in a new cluster without any migration in a matter of minutes.

Anything "stateful" like a database breaks this paradigm.

I have nothing against databases used as cache that can be "re-filled" upon re-creation, but I believe anything holding business critical data shall be held outside of a kubernetes cluster. Why, because being one command away deleting your StatefulSet, Helm Release ... etc scares the shit out of me.

You can of course minimize the risk with correct RBAC, ensure proper backup/restore migrations but that require lots of staff and efforts I can't spare.

So until I can be reassured that I have all the tooling that can recover rapidly any catastrophic failure/mishap, and that all this tooling is tested monthly, I enforce using managed databases services.

[ Parent | on HN ]

Re:Encrypting Postgres Data at Rest in Kubernetes by kobalsky on Sunday October 31, 2021 @03:17PM (#29059515)

if you set a retain policy on persistentvolumes it will prevent your volumes from being deleted even when you delete the owning objets. cloud providers will keep the virtual drive on those cases even if you delete everything

regardless, it’s the wrong thing to fear. this is at the level of logging in every user as root on your servers and databases because proper user management would require extra staff and efforts you can’t spare.

[ Parent | on HN ]

Re:Encrypting Postgres Data at Rest in Kubernetes by dilyevsky on Sunday October 31, 2021 @03:05PM (#29059422)

There are databases where individual nodes are disposable. A lot of managed dbs aren’t exactly zero ops and hard to service without downtime too

[ Parent | on HN ]