[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for Kubernetes](../../index.md) > [Step-by-step guides](../index.md) > Working with persistent volumes > Encrypted disks for persistent volumes

# Using encrypted disks for persistent volumes

Managed Service for Kubernetes supports the use of Compute Cloud disks [encrypted](../../../compute/concepts/encryption.md) with custom Yandex Key Management Service [symmetric keys](../../../kms/concepts/key.md) for persistent volumes.

{% note info %}

To use encrypted disks, the [cloud service account](../../concepts/index.md#service-accounts) attached to your Managed Service for Kubernetes cluster must have the `kms.keys.encrypterDecrypter` [role](../../../kms/security/index.md#kms-keys-encrypterDecrypter) for the key or folder.

{% endnote %}

You can use encrypted disks for both [static](#static-provisioning) and [dynamic](#dynamic-provisioning) provisioning of persistent volumes.

## Static volume provisioning {#static-provisioning}

1. [Create](../../../kms/operations/key.md) a symmetric key in Key Management Service.
1. [Create](../../../compute/operations/disk-create/empty.md) an encrypted disk using the key you created.

    Save the disk ID for later use.
1. [Assign](../../../iam/operations/roles/grant.md) the `kms.keys.encrypterDecrypter` [role](../../../kms/security/index.md#kms-keys-encrypterDecrypter) for a key or folder to the cloud service account of the Managed Service for Kubernetes cluster.
1. [Provide](static-create-pv.md) a persistent volume. In the `PersistentVolume` manifest, specify the ID of the disk you created in the `spec:csi:volumeHandle` parameter.

## Dynamic volume provisioning {#dynamic-provisioning}

1. [Create](../../../kms/operations/key.md) a symmetric key in Key Management Service.

    Save the key ID for later use.
1. [Assign](../../../iam/operations/roles/grant.md) the `kms.keys.encrypterDecrypter` [role](../../../kms/security/index.md#kms-keys-encrypterDecrypter) for a key or folder to the cloud service account of the Managed Service for Kubernetes cluster.
1. [Install kubect](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../connect/index.md#kubectl-connect).
1. In the `encrypted-storage-class.yaml` file, create a manifest for the new [storage class](manage-storage-class.md):

    ```yaml
    kind: StorageClass
    apiVersion: storage.k8s.io/v1
    metadata:
      name: <storage_class_name>
    provisioner: disk-csi-driver.mks.ycloud.io
    volumeBindingMode: WaitForFirstConsumer
    parameters:
      type: <disk_type>
      csi.storage.k8s.io/fstype: ext4
      kmsKeyId: <symmetric_key_ID>
    allowVolumeExpansion: true
    reclaimPolicy: Delete
    ```
    
    Where:
    * `metadata:name`: Any storage class name.
    * `parameters:type`: [Disk type](../../concepts/volume.md#disks-types) in Compute Cloud. The possible values are:
      * `network-ssd`: Network SSD.
      * `network-hdd`: Network HDD.
      * `network-ssd-nonreplicated`: Non-replicated SSD.
      * `network-ssd-io-m3`: Ultra high-speed network storage with three replicas (SSD).
    * `parameters:kmsKeyId`: Symmetric key ID.

1. Create a storage class:

    ```bash
    kubectl apply -f encrypted-storage-class.yaml
    ```

1. In the `encrypted-pvc.yaml` file, create a manifest for the new `PersistentVolumeClaim`:

    ```yaml
    apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      name: <PVC_name>
    spec:
      accessModes:
        - ReadWriteOnce
      storageClassName: <storage_class_name>
      resources:
        requests:
          storage: 4Gi
    ```

    Where:
    * `metadata:name`: Any name for the `PersistentVolumeClaim`.
    * `spec:storageClassName`: Name of the storage class you created earlier.

1. Create a `PersistentVolumeClaim`:

    ```bash
    kubectl apply -f encrypted-pvc.yaml
    ```

1. In the `pod-with-encrypted-pvc.yaml` file, create a manifest for the pod with a dynamically provisioned persistent volume:

    ```yaml
    apiVersion: v1
    kind: Pod
    metadata:
      name: <pod_name>
    spec:
      containers:
        - name: app
          image: ubuntu
          command: ["/bin/sh"]
          args: ["-c", "while true; do echo $(date -u) >> /data/out.txt; sleep 5; done"]
          volumeMounts:
            - name: persistent-storage
              mountPath: /data
      volumes:
        - name: persistent-storage
          persistentVolumeClaim:
            claimName: <PVC_name>
    ```

    Where:
    * `metadata:name`: Any name for the pod.
    * `spec:volumes:persistentVolumeClaim:claimName`: Name of the `PersistentVolumeClaim` you created earlier.

1. Create a pod:

    ```bash
    kubectl apply -f pod-with-encrypted-pvc.yaml
    ```

    After you create the pod, a new encrypted disk with `k8s-csi` prefixed to its name will appear under **Compute Cloud** in **Disks** in the [management console](https://console.yandex.cloud).

### See also {#see-also}

* [Volume](../../concepts/volume.md)
* [Encryption in Managed Service for Kubernetes](../../concepts/encryption.md) 
* [Encryption in Compute Cloud](../../../compute/concepts/encryption.md)
* [Dynamic volume provisioning](dynamic-create-pv.md)
* [Static volume provisioning](static-create-pv.md)
* [Managing storage classes](manage-storage-class.md)