Securing Storage

In this lesson we cover how to secure storage in Kubernetes. Kubernetes workloads access storage through PersistentVolumes (PVs) and PersistentVolumeClaims (PVCs). Misconfigured storage access, missing encryption, or inadequate backup and restore practices can expose sensitive data, enable unauthorized reading or tampering, or cause permanent data loss (for example during ransomware or cloud-account compromise). To protect data confidentiality, integrity, and availability, apply layered controls: encryption, access controls (RBAC), consistent StorageClass policies, backups, and monitoring.

Encryption

Encrypting data both at rest and in transit is essential for Kubernetes storage security. Important areas to focus on:

etcd encryption for control-plane data (secrets and other sensitive API objects).
Disk-level or volume encryption for persistent volumes (PVs).
TLS for data in transit between clients, CSI drivers, and storage backends.

Cloud providers commonly offer disk-level encryption options that are surfaced by the CSI driver or in the StorageClass parameters — for example, AWS EBS, Azure Disk Storage, and Google Cloud Persistent Disk. The provisioner in your StorageClass usually forwards encryption-related parameters to the cloud provider or the CSI driver.

The slide titled "Using Encryption" displays three cloud storage icons labeled "AWS EBS," "Azure Disk Storage," and "Google Cloud Persistent Disk." It appears to illustrate encryption options for cloud block storage.

Example: a StorageClass that requests encryption and sets an IOPS parameter. Supported parameter names depend on the cloud provider and CSI driver. In AWS, these parameters are forwarded to the EBS CSI driver when provisioning volumes.

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: secure-storage
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
  encrypted: "true"
  iops: "100"
  throughput: "125"

Notes on drivers and volume types:

Modern clusters use CSI drivers (e.g., ebs.csi.aws.com). Older in-tree provisioners like kubernetes.io/aws-ebs may still exist but are deprecated.
Different volume types (gp2 vs gp3, io1/io2) have different performance/encryption parameters — gp3 exposes explicit iops and throughput, while gp2 ties IOPS to volume size.

Encryption at rest for control plane data (etcd) uses Kubernetes EncryptionConfiguration; for persistent volumes, use provider-specific encryption (StorageClass parameters or disk-level encryption). Always verify the provider and CSI driver you use and the parameters they accept.

Access controls

Restrict who can create, modify, or read storage resources. Kubernetes RBAC controls access to objects such as PVCs and PVs. Apply the principle of least privilege: give only the verbs and resource scope required (namespace vs cluster). Example Role and RoleBinding that grant read-only access to PVCs in the default namespace:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pvc-reader
rules:
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pvc-binding
  namespace: default
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pvc-reader
  apiGroup: rbac.authorization.k8s.io

Best practices:

Bind Roles to service accounts used by applications rather than broad user accounts.
Use Groups for team-level permissions.
Review and audit bindings periodically.

Avoid granting cluster-wide storage permissions unless strictly necessary. Misconfigured cluster roles can allow volume mounts across namespaces or access to sensitive PVs.

StorageClasses and policy

StorageClasses let you standardize provisioning behavior and enforce storage-level security and performance policies across the cluster. Parameters and annotations in a StorageClass can express:

Encryption at rest (encrypted: "true") or use of a customer-managed key (CMK).
Performance settings (IOPS, throughput, volume type).
Reclaim policy and mount options.
CSI driver-specific features such as replication, snapshot support, or topology constraints.

Example benefits:

Ensure every dynamically provisioned volume uses encryption by default.
Separate classes for high-performance and archival workloads.
Use annotations to integrate with backup or retention automation.

Recommended StorageClass policy attributes (examples):

Policy area	Purpose	Example
Encryption	Protect data at rest	`encrypted: "true"` (provider-specific)
Performance	Set IOPS/throughput characteristics	`type: gp3`, `iops: "100"`
Snapshots	Enable snapshot support for backups	CSI snapshot class + retention policies
Topology	Restrict where volumes can be provisioned	`allowedTopologies`

Backup and disaster recovery

Backups are critical for protecting against deletion, corruption, ransomware, and provider failures. Use Kubernetes-aware backup tools that integrate with PV snapshots, object storage, and cluster metadata. Common tools:

Tool	Use case
Velero	Cluster/namespace backup, object storage snapshots, restore workflows
Kasten by Veeam	Enterprise backup and app-centric recovery
Portworx (Pure Storage)	Cloud-native storage with DR and replication
OpenEBS	Container-native storage with dataset-level snapshots and replication

A presentation slide titled "Implementing Backup and Disaster Recovery" featuring four product logos: Velero, Portworx (by Pure Storage), OpenEBS, and Veeam/Kasten. The logos are shown in white card-like boxes across the middle of a dark blue background.

Planning backups:

Encrypt backup data at rest and in transit.
Store backups in a separate account or region to reduce blast radius from account compromise.
Automate snapshot schedules and lifecycle (retention, pruning).
Regularly test restore procedures (scheduled restore drills).

Monitoring and alerting

Monitoring storage health and access patterns helps detect misconfiguration, performance degradation, or suspicious activity. Collect metrics and logs:

PV/PVC capacity and usage growth.
I/O throughput and latency per volume or CSI driver.
Error rates and failed attach/mount events.
CSI driver logs and cloud provider events.

Use Prometheus and Grafana for collection and visualization; configure alerts for actionable thresholds.

A dark-themed Kubernetes monitoring dashboard showing cluster metrics (clusters, nodes, namespaces, workloads, pods, containers) with CPU and memory graphs and a list of deployed container images. Prometheus and Grafana logos are shown to the right.

Suggested alerts:

PVC usage > 80% or rapid growth over short period.
Sustained increase in I/O latency or error rate.
Unexpected mounts of PVs in different namespaces.
Failed snapshot or backup job runs.

Summary

Secure storage in Kubernetes depends on multiple, reinforcing controls:

Encrypt control-plane data (etcd) using EncryptionConfiguration and encrypt persistent volumes using provider/CSI features.
Define StorageClasses that enforce encryption, performance, snapshot, and topology policies consistently.
Use RBAC to limit who can manage or mount PVs/PVCs; prefer service-account and group bindings with least privilege.
Implement automated backups and DR workflows (Velero, Kasten, Portworx, OpenEBS) and test restores regularly.
Monitor storage metrics and logs with Prometheus + Grafana and set alerting for capacity, latency, and unusual access patterns.

A schematic titled "Storage in Kubernetes" showing a cluster with three nodes, each running pods that connect down to persistent volumes. It highlights RBAC access control, regular backups, and data encryption at rest.

Topics covered in this lesson:

PersistentVolumes (PVs) and PersistentVolumeClaims (PVCs)
Encryption at rest and in transit for storage
StorageClass parameters and provisioning (provider/CSI specifics)
Role-Based Access Control for storage resources
Backup and disaster recovery tools and best practices
Monitoring storage metrics and alerting

Links and references

Introduction

Overview of Cloud Native Security

Kubernetes Cluster Component Security

Kubernetes Security Fundamentals

Kubernetes Threat Model

Platform Security

Compliance and Security Frameworks

Encryption

Access controls

StorageClasses and policy

Backup and disaster recovery

Monitoring and alerting

Summary

Watch Video

​Encryption

​Access controls

​StorageClasses and policy

​Backup and disaster recovery

​Monitoring and alerting

​Summary

Watch Video

Encryption

Access controls

StorageClasses and policy

Backup and disaster recovery

Monitoring and alerting

Summary