Overview
While Kubernetes provides a great authentication model for its users, storage systems could be exposed to malicious requests. PX-Security provides a method to protect against such requests, further providing deployers with a more secured system.
The following reference architecture describes how to setup PX-Security to authenticate PVC requests from Kubernetes. This model leverages Kubernetes user authentication, which secures access to Namespaces, Secrets, and PersistentVolumes. With access already provided and secured by Kubernetes, this reference architecture provides a model to secure the communication between Kubernetes and Portworx. Securing Portworx also protects the storage system from unwanted access from outside Kubernetes.
Perform the steps in the following sections to set up PX-Security according to this reference architecture:
Prerequisites
- Your Portworx cluster is using a DaemonSet-based installation (not via the Operator)
- You must be running Portworx version 2.1 or greater on Kubernetes
📄️ Step 1: Generate shared secrets
📄️ Step 2: Enable security in Portworx
📄️ Step 3: Generate tokens
Now that the system is up and running you can create tokens.