<p>I have an EBS volume that I am using that is not encrypted and has a bunch on data on it.
I want to take a snapshot of the data on that volume, create a new EBS volume from that snapshot but encrypt it, and then and use it in my EKS cluster.
I know how to create a persistent volume, persistent volume claim and then mount it in a pod for an unencrypted EBS volume. How do I do this with an encrypted EBS volume?
I did try the above, restored the snapshot and selected to use encryption with the default key and successfully mounted the encrypted EBS volume to the pod and I could see the files but when I opened the files they were indeed unreadable and therefore encrypted. I assume I need to apply the key somewhere somehow to allow me to properly read the files in the pod?</p>
<p>Here is the code to create the persistent volume :</p>
<pre><code>apiVersion: v1
kind: PersistentVolume
metadata:
  name: existing-volume-2
  annotations:
    #pv.kubernetes.io/provisioned-by: ebs.csi.aws.com
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: standard-rwo
  claimRef:
    name: my-pvc
    namespace: default

  awsElasticBlockStore:
    volumeID: &quot;vol-xxx82072b1bd3a222&quot;
    fsType: ext4
  nodeAffinity:
    required:
      nodeSelectorTerms:
      - matchExpressions:
        - key: topology.kubernetes.io/zone
          operator: In
          values:
          - us-east-1a
</code></pre>
<p>Here is the code for the persistent volume claim -</p>
<pre><code>apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  storageClassName: standard-rwo
  volumeName: existing-volume-2
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
</code></pre>
<p>Here is the code to bring up the pos that will use the PVC -</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: web-server
spec:
  containers:
   - name: web-server
     image: alpine:latest
     command:
      - /bin/sh
      - &quot;-c&quot;
      - &quot;sleep 60m&quot;
     volumeMounts:
       - mountPath: /tmp
         name: data
  volumes:
   - name: data
     persistentVolumeClaim:
       claimName: my-pvc
</code></pre>

<p>I figured it out -
(from <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html</a>)</p>
<p>1 - Create a snapshot of the original unencrypted volume.</p>
<p>2 - Create a copy of the snapshot you just took and check the option to make it encrypted.</p>
<p>3 - Create the new encrypted volume by restoring the copy that you just encrypted. That volume will be encrypted by default.</p>
<p>4 - Create the persistent volume using the new encrypted volume.</p>
