<p>I need to encrypt the data on a block device and allow the Pod to access it as a volume.</p>

<p>I noticed its now possible on Google cloud to encrypt a new disk using <a href="https://cloud.google.com/compute/docs/disks/customer-supplied-encryption" rel="nofollow">Customer-Supplied Encryption Keys</a></p>

<p>Can I use self encrypted disk with Kubernetes and attach it to the Pod as volume?</p>

<p>If not, is there any other way to encrypt block device (for example LUKS) and use it with Pods?</p>

<p>My reading of the the Google docs (<a href="https://cloud.google.com/compute/docs/disks/customer-supplied-encryption" rel="nofollow">https://cloud.google.com/compute/docs/disks/customer-supplied-encryption</a>) are that no key is required to mount the disk.  The keys are only provided at disk creation time.</p>

<p>So, the following should work without changes to kubernetes:</p>

<ol>
<li>create encrypted disk "myencrypteddisk" per <a href="https://cloud.google.com/compute/docs/disks/customer-supplied-encryption" rel="nofollow">https://cloud.google.com/compute/docs/disks/customer-supplied-encryption</a></li>
<li>create a pod which mounts GCEPD called "myencrypteddisk".</li>
<li>kubelet will mount the disk on the VM.  It's compute scope should be enough to perform the mount, IIUC.</li>
</ol>
