---
name: openshift-encryption-vpc-worker-disks
title: Setting up worker node disk encryption for VPC clusters
description: '[Virtual Private Cloud]'
last-updated: 2026-07-30
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/openshift?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Setting up worker node disk encryption for VPC clusters
{: #encryption-vpc-worker-disks}

[Virtual Private Cloud]{: tag-vpc}


By default, the one primary disk of VPC worker nodes is AES-256 bit encrypted at rest by the [underlying VPC infrastructure provider](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about&format=markdown#vpc-storage-encryption).

There is a temporary limitation when using a Key Protect single tenant instance for bring your own key (BYOK) encyrption for boot disk and cluster encryption. To use a single tenant instance with your cluster, you must ensure that their service-to-service authorizaiton policy is scoped to the Key Protect service or instance level and not to a key or key ring. This limiation applies only to Key Protect single tenant instances.
{: important}


You can manage the encryption of the worker nodes by enabling a KMS provider at the worker pool level.

1. [Create a KMS instance and root key](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption-setup&format=markdown).
2. Make sure that you have the following service authorization policies in IBM Cloud IAM, created under the account where the KMS instance resides, with the following details:
    - **Required service access policy for Kubernetes Service and the KMS provider**
        1. Set the **Source account** for **This account** if the cluster you want to authorize accessing KMS resides in the current account, otherwise if the cluster located under a different account, select **Other account** and provide the account ID.
        2. Set the **Source service** to **Kubernetes Service**.
        3. Set the **Target service** to your KMS provider, such as **Key Protect**.
        4. Include at least **Reader** service access.
        5. Enable the authorization to be delegated by the source and dependent services.
    - **Required service access policy for Cloud Block Storage and the KMS provider**
        1. Set the **Source account** for **This account** if the cluster you want to authorize accessing KMS resides in the current account, otherwise if the cluster located under a different account, select **Other account** and provide the account ID.
        2. Set the **Source service** to **Cloud Block Storage**.
        3. Set the **Target service** to your KMS provider, such as **Key Protect**.
        4. Include at least **Reader** service access.

    Red Hat OpenShift on IBM Cloud automatically creates a service-to-service delegation policy for the Cloud Block Storage service in the IBM-managed service account to the KMS provider instance under the account where the KMS instance and CRK reside. This delegation policy is required so that the VPC infrastructure can encrypt the boot volume of the worker nodes in the IBM-managed service account with your customer-provided root key of the KMS provider. If you have issues deploying worker nodes, verify that this delegated authorization policy exists in your [IAM authorizations](https://cloud.ibm.com/iam/authorizations){: external}/
    {: note}

1. **Optional**: If you have context-based restriction enabled on your KMS instance, complete the following steps.

    1. Create a network zone that includes Block Storage for VPC.

        ```sh
        ibmcloud cbr zone-create --name example-zone-1 --description "Block Storage" --service-ref service_name=server-protect
        ```
        {: pre}

    1. Create a new CBR rule that references the network zone you created in the previous step, or update an existing CBR rule. For more information, see [Creating rules by using the CLI](https://cloud.ibm.com/docs/iam?topic=iam-context-restrictions-create&interface=cli&format=markdown#context-restrictions-create-rules-cli).


1. Create a cluster or worker pool that includes the account where the KMS instance resides, the KMS provider instance and root key. Each worker node in the worker pool then is encrypted by the KMS provider that you manage. Each worker pool in your cluster can use the same KMS instance and root key, the same KMS instance with different root keys, or different instances.
    - **Creating a cluster**: Only the `default` worker pool's nodes are encrypted. After you create the cluster, if you create more worker pools, you must enable encryption in each pool separately. For more information, see [Creating clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-vpc-gen2&interface=ui&format=markdown) or the [CLI reference documentation](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli&format=markdown#cluster-create-vpc-gen2-cli).

    - **Creating a worker pool**: For more information, see [Creating VPC worker pools](https://cloud.ibm.com/docs/openshift?topic=openshift-add-workers-vpc&format=markdown#vpc_add_pool) or the [CLI reference documentation](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli&format=markdown#worker-pool-create-vpc-gen2-cli).


1. Verify that your worker pool is encrypted by reviewing the worker pool details.
    - **UI**: After selecting your cluster from the [console](https://cloud.ibm.com/containers/cluster-management/clusters){: external}, click **Worker pools**. Then, click your worker pool.
    - **CLI**: Review the **KMS** and **CRK** fields in the output of the following command. Note that the **KMS** and **CRK** fields are displayed only if BYOK encryption is enabled.
        ```sh
        ibmcloud oc worker-pool get --worker-pool WORKER_POOL_NAME_OR_ID --cluster CLUSTER_NAME_OR_ID
        ```
        {: codeblock}

1. Optional: [Rotate the root key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=ui&format=markdown) periodically per your company's security compliance guidelines. For more information, see the [Managing encryption topic in the VPC documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&format=markdown).

    Do not delete your KMS instance. You can't change the KMS instance that is used to encrypt the worker pool. If you disable or delete the root key, your worker nodes enter a `critical` state until you restore the root key and [reboot](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli&format=markdown#worker-reboot-cli) the worker nodes.
    {: important}

The encryption for the disks of the worker nodes in your worker pool are now managed by the root key in your KMS provider. If you created a cluster, the worker pool is the `default` worker pool.