title: encrypt kubernetes pvc storage using customer owned key
body: <p>I create and run own Kubernetes cluster, using compute/network of GCP (or AWS). No GKE, AKS.</p>
  <p>I need to encrypt dynamically provisioned PV using my customer's own key.<br />
  Customer requirements means, we build our own KMS and use it for customer key. GCP (or AWS) own KMS is out of question.</p>
  <p>How to go about this?<br />
  For example GCP -<br />
  When I use GCP's CSI driver (pd.csi.storage.gke.io), it appears to allow only GCP KMS. I need to use own.</p>
  <pre><code>apiVersion: storage.k8s.io/v1
  kind: StorageClass
  metadata:
    name: custcmk-gcpcsi-sc
  provisioner: pd.csi.storage.gke.io
  volumeBindingMode: WaitForFirstConsumer
  allowVolumeExpansion: true
  parameters:
    type: pd-standard
    disk-encryption-kms-key: projects/key-project-id/locations/location/keyRings/key-ring/cryptoKeys/key
  
  </code></pre>
  <p>Of course, in above example, key is specified in storage class. In actual use, I have to use different customer keys per storage provision.<br />
  Is it possible to specify key in PVC instead?</p>
  <p>Basically, our clusters are spread over cloud providers GCP, Azure, AWS.., so the maximum extent of platform specific resource we can use is compute/network.</p>
  <p>Has anyone dealt with similar situation successfully?</p>