<p>We are getting warnings in our production logs for .Net Core Web API services that are running in Kubernetes.</p>
<blockquote>
<p>Storing keys in a directory '{path}' that may not be persisted outside
of the container. Protected data will be unavailable when container is
destroyed.&quot;,&quot;@l&quot;:&quot;Warning&quot;,&quot;path&quot;:&quot;/root/.aspnet/DataProtection-Keys&quot;,SourceContext:&quot;Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository&quot;</p>
</blockquote>
<p>We do not explicitly call services.AddDataProtection() in StartUp, but it seems that we are getting the warnings for  services that are using .Net Core 3.1 and .Net 5.(not for .Net Core 2.1)
,that also have in StartUp</p>
<pre><code>services.AddAuthentication Or 
services.AddMvc()
</code></pre>
<p>(May be there are other conditions that I am missing).</p>
<p>I am not able to identify exactly, where it's called but locally I can see related DLLs that are loaded before the access to DataProtection-Keys from XmlKeyManager</p>
<pre><code> Loaded 'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.19\Microsoft.Win32.Registry.dll'. 
 Loaded 'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.19\System.Xml.XDocument.dll'. 
 Loaded 'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.19\System.Private.Xml.Linq.dll'. 
 Loaded 'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.19\System.Private.Xml.dll'. 
 Loaded 'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.19\System.Resources.ResourceManager.dll'.
Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager:
Using 'C:\Users\..\AppData\Local\ASP.NET\DataProtection-Keys' as key repository and Windows DPAPI to encrypt keys at rest.
</code></pre>
<p>Is it safe to ignore such warnings, considering that we do not use DataProtection explicitly, do not use authentication encryption for long periods and during testing we haven't seen any issues?</p>
<p>Or the error means that if  different pods will be involved for the same client,  authentication may fail and it will be better to do something that is suggested in <a href="https://stackoverflow.com/questions/61452280/how-to-store-data-protection-keys-outside-of-the-docker-container">How to store Data Protection-keys outside of the docker container?</a>?</p>

Michael Freidgeim
<p>After analysis how our applications are using protected data(authentication cookies, CSRF tokens etc) our team
decided , that “Protected data will be unavailable when container is destroyed.&quot; is just a warning and would have no customer impact, so we ignore it.</p>
<p>But <a href="https://www.howtogeek.com/693183/what-does-ymmv-mean-and-how-do-you-use-it/" rel="nofollow noreferrer">YMMV</a>.</p>
