CTE for Kubernetes Administration Guide
Getting Started with CTE for K8s
- Container Image Fingerprint
- Introduction to CipherTrust Transparent Encryption for Kubernetes
  - Configuration Concepts
  - CTE for Kubernetes Terminology
- Installation Methods
  - Using Operator
    - Introduction to the Kubernetes Operator Resource
    - Installation, Deployment and Configuration
    - Installing and Managing CTE for Kubernetes in an Operator Environment
    - Kubernetes Operator Maintenance
  - Using Helm with CTE for Kubernetes
    - Installing and Deploying with Helm
    - Migrating a CTE install from Helm to Operator deployment
    - Deploying in an Air-Gapped Kubernetes Cluster using HELM
    - Upgrading CTE for Kubernetes with a Helm-based Installation
- Deployment Methods
  - Deploying with a Custom Resource Definition
  - Deploying CTE for Kubernetes in an Air-Gapped OpenShift Container Platform Cluster using CTE for Kubernetes Operator
- Preparing a CTE for Kubernetes Volume for Deployment
  - Preparing CipherTrust Manager
  - Create a CTE Policy for Kubernetes
  - Prepare a file system persistent volume
  - Deploying CTE for Kubernetes Storage Classes
  - Deploying Pods/Services in a Kubernetes Cluster
  - Using Dynamic PVCs with CTE for Kubernetes
  - Creating a CTE for Kubernetes Claim Against the PVC
  - Individual Guard Policy Tuning
  - Create a CTE-CSI protected Persistent Storage Claim by deploying an Application/Staging pod
  - Allow only Trusted Pods to mount to CTE for Kubernetes volumes
  - Using Taints and Tolerations
- Data Transformation
  - Using Initial Data Transformation for CTE for Kubernetes
  - Applying Data Transformation Key Rotation to CTE for Kubernetes
  - Decryption using Data transformation with CTE for Kubernetes
Volume Management
- Volume Cloning Support
- Volume Snapshot and Restoring
- Volume Resizing and Expansion
Advanced Configuration and Troubleshooting
- Using External Certificates with CTE for Kubernetes
- Troubleshooting

Creating a CTE for Kubernetes Claim Against the PVC

Note

For the next step, you must have your PV and PVC already deployed.

Create the following YAML file:

cte-csi-claim.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
    name: cte-claim
    annotations:
        # The following must match your CTE Kubernetes Policy name.
        csi.cte.cpl.thalesgroup.com/policy: policy_1 
        # NFS source persistent volume claim
        csi.cte.cpl.thalesgroup.com/source_pvc: nfs-test-claim 
spec:
    storageClassName: <CHANGE to the storageclass name that you deployed. For example: e.g. csi-test-sc>
    accessModes:
        - ReadWriteMany
resources:
    requests:
        storage: 1Ki

To deploy the cte-csi-claim.yaml script, type:
```
kubectl apply -f cte-csi-claim.yaml
```

Note

AccessMode of CTE-PVC must be the same as the sourcePVC accessMode.
Multiple CTE-PVC cannot use same sourcePVC (csi.cte.cpl.thalesgroup.com/source_pvc: nfs-test-claim) at the same time.

Suggest A Change

Creating a CTE for Kubernetes Claim Against the PVC

On this page