Use the recommendations listed here to ensure your Astra Trident installation is secure.
Run Astra Trident in its own namespace
It is important to prevent applications, application administrators, users, and management applications from accessing Astra Trident object definitions or the pods to ensure reliable storage and block potential malicious activity.
To separate the other applications and users from Astra Trident, always install Astra Trident in its own Kubernetes namespace (
trident). Putting Astra Trident in its own namespace assures that only the Kubernetes administrative personnel have access to the Astra Trident pod and the artifacts (such as backend and CHAP secrets if applicable) stored in the namespaced CRD objects.
You should ensure that you allow only administrators access to the Astra Trident namespace and thus access to the
Use CHAP authentication with ONTAP SAN backends
Astra Trident supports CHAP-based authentication for ONTAP SAN workloads (using the
ontap-san-economy drivers). NetApp recommends using bidirectional CHAP with Astra Trident for authentication between a host and the storage backend.
For ONTAP backends that use the SAN storage drivers, Astra Trident can set up bidirectional CHAP and manage CHAP usernames and secrets through
See here to understand how Astra Trident configures CHAP on ONTAP backends.
Use CHAP authentication with NetApp HCI and SolidFire backends
NetApp recommends deploying bidirectional CHAP to ensure authentication between a host and the NetApp HCI and SolidFire backends. Astra Trident uses a secret object that includes two CHAP passwords per tenant. When Astra Trident is installed, it manages the CHAP secrets and stores them in a
tridentvolume CR object for the respective PV. When you create a PV, Astra Trident uses the CHAP secrets to initiate an iSCSI session and communicate with the NetApp HCI and SolidFire system over CHAP.
|The volumes that are created by Astra Trident are not associated with any Volume Access Group.|
Use Astra Trident with NVE and NAE
NetApp ONTAP provides data-at-rest encryption to protect sensitive data in the event a disk is stolen, returned, or repurposed. For details, refer to Configure NetApp Volume Encryption overview.
If NAE is enabled on the backend, any volume provisioned in Astra Trident will be NAE-enabled.
If NAE is not enabled on the backend, any volume provisioned in Astra Trident will be NVE-enabled unless you set the NVE encryption flag to
falsein the backend configuration.
Volumes created in Astra Trident on an NAE-enabled backend must be NVE or NAE encrypted.
You can manually create an NVE volume in Astra Trident by explicitly setting the NVE encryption flag to
For more information on backend configuration options, refer to: