The ncryptopenstorageprovider new command standardizes the creation of secure, encrypted storage volumes across heterogeneous backends. By decoupling the control plane (key management) from the data plane (block storage), it offers a performant, auditable alternative to traditional disk encryption layers. This interface is ready for integration into Kubernetes via a custom CSI driver.

apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: ncrypt-gold provisioner: com.openstorage/ncrypt parameters: backend: "pxd" encryption: "true" kms: "vault" reclaimPolicy: "cryptshred" # Deletion does not delete keys