https://danielchg.github.io/tags/storage/Recent content in Storage on Daniel OpsHugoen-usTue, 06 Oct 2026 09:00:00 +0200https://danielchg.github.io/posts/odf-encryption-vault/Tue, 06 Oct 2026 09:00:00 +0200https://danielchg.github.io/posts/odf-encryption-vault/<h1 id="table-of-contents">Table of Contents</h1> <ul> <li><a href="#table-of-contents">Table of Contents</a> <ul> <li><a href="#introduction">Introduction</a></li> <li><a href="#architecture-overview">Architecture Overview</a></li> <li><a href="#install-and-configure-vault-in-the-hub-cluster">Install and Configure Vault in the HUB Cluster</a> <ul> <li><a href="#install-vault-with-helm">Install Vault with Helm</a></li> <li><a href="#initialize-vault">Initialize Vault</a></li> <li><a href="#expose-vault-to-the-outside">Expose Vault to the Outside</a></li> <li><a href="#create-the-vault-secret-backend-for-odf">Create the Vault Secret Backend for ODF</a></li> <li><a href="#configure-vault-policy">Configure Vault Policy</a></li> </ul> </li> <li><a href="#configure-odf-on-the-spoke-cluster">Configure ODF on the Spoke Cluster</a> <ul> <li><a href="#create-serviceaccount-in-the-tenant-namespace">Create ServiceAccount in the Tenant Namespace</a></li> <li><a href="#create-serviceaccount-and-rbac-for-odf">Create ServiceAccount and RBAC for ODF</a></li> <li><a href="#configure-kms-connectivity-for-odf">Configure KMS Connectivity for ODF</a></li> <li><a href="#configure-vault-kubernetes-authentication">Configure Vault Kubernetes Authentication</a></li> <li><a href="#create-the-encrypted-storageclass">Create the Encrypted StorageClass</a></li> </ul> </li> <li><a href="#test-the-encryption">Test the Encryption</a></li> <li><a href="#conclusions">Conclusions</a></li> <li><a href="#references">References</a></li> </ul> </li> </ul> <h2 id="introduction">Introduction</h2> <p>Data security is a critical concern in any production environment, especially when sensitive workloads run on shared infrastructure. OpenShift Data Foundation (ODF) supports Persistent Volume (PV) encryption at rest using an external Key Management System (KMS). One of the most common and powerful options for this is HashiCorp Vault.</p>