Encryption of snapshot

[pwli]

Is it possible to encrypt snapshots before it leaves the node ?
So that data is encrypted in flight ? May be a config variable to
set up password for encryption and decryption ?

[clintongormley]

@imotov @jaymode what do you think?

[pandujar]

+1

[yarmand]

+1

[clintongormley]

@imotov @jaymode thoughts?

[yarmand]

We needed encryption for our Azure snapshots.
As some backends have encryption directly as a server side option, I implemented encryption directly in the Azure plugin.
For reference, here is the Pull Request for this implementation against elasticsearch 1.7.
When we update to 2.1 I will port this and will submit a PR in this repository.

[pmazeris]

+1

We're using the repositiry-gcs elasticsearch plugin to push to encrypted / acl'ed gcr.io buckets in GKE/Google. Having data already encrypted during transit time would be perfect.

@yarmand, what would be a reasonable ETA for this addtion? Thks

[tlrx]

We talked about this today with @ywelsch and it seems that all cloud based storage providers supported for snapshot/restore (Amazon S3/Azure Storage/Google Cloud Storage) now provide server side encryption and secured transfers over the network using HTTPS. While this level of security can be enough for most users, there's a need for client side encryption.

We don't have immediate plan to add our own client side encryption system in elasticsearch, but we are evaluating the possibility to add client-side encryption when it is supported by the vendor SDK. At the date of today, S3 and Azure provide client side encryption through their SDKs.