容器化环境的数据加密是金融、医疗等行业合规的基石，需从传输、存储、内存与密钥管理四个维度构建纵深防御。以下从各层加密的原理、实现机制、容器生态集成及 Java 应用实践系统阐述。
一、数据加密全景架构
#mermaid-svg-6fqlZ7S2nL3jJh7V{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-6fqlZ7S2nL3jJh7V .error-icon{fill:#552222;}#mermaid-svg-6fqlZ7S2nL3jJh7V .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-6fqlZ7S2nL3jJh7V .marker{fill:#333333;stroke:#333333;}#mermaid-svg-6fqlZ7S2nL3jJh7V .marker.cross{stroke:#333333;}#mermaid-svg-6fqlZ7S2nL3jJh7V svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-6fqlZ7S2nL3jJh7V p{margin:0;}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge{stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section--1 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section--1 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section--1 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section--1 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section--1 path{fill:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section--1 text{fill:#ffffff;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon--1{font-size:40px;color:#ffffff;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge--1{stroke:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth--1{stroke-width:17;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section--1 line{stroke:hsl(60, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-0 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-0 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-0 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-0 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-0 path{fill:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-0 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-0{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-0{stroke:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-0{stroke-width:14;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-0 line{stroke:hsl(240, 100%, 83.5294117647%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-1 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-1 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-1 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-1 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-1 path{fill:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-1 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-1{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-1{stroke:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-1{stroke-width:11;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-1 line{stroke:hsl(260, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-2 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-2 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-2 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-2 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-2 path{fill:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-2 text{fill:#ffffff;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-2{font-size:40px;color:#ffffff;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-2{stroke:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-2{stroke-width:8;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-2 line{stroke:hsl(90, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-3 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-3 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-3 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-3 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-3 path{fill:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-3 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-3{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-3{stroke:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-3{stroke-width:5;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-3 line{stroke:hsl(120, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-4 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-4 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-4 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-4 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-4 path{fill:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-4 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-4{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-4{stroke:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-4{stroke-width:2;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-4 line{stroke:hsl(150, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-5 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-5 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-5 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-5 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-5 path{fill:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-5 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-5{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-5{stroke:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-5{stroke-width:-1;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-5 line{stroke:hsl(180, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-6 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-6 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-6 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-6 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-6 path{fill:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-6 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-6{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-6{stroke:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-6{stroke-width:-4;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-6 line{stroke:hsl(210, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-7 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-7 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-7 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-7 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-7 path{fill:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-7 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-7{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-7{stroke:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-7{stroke-width:-7;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-7 line{stroke:hsl(270, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-8 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-8 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-8 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-8 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-8 path{fill:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-8 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-8{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-8{stroke:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-8{stroke-width:-10;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-8 line{stroke:hsl(330, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-9 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-9 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-9 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-9 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-9 path{fill:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-9 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-9{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-9{stroke:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-9{stroke-width:-13;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-9 line{stroke:hsl(0, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-10 rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-10 path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-10 circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-10 polygon,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-10 path{fill:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-10 text{fill:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .node-icon-10{font-size:40px;color:black;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-edge-10{stroke:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge-depth-10{stroke-width:-16;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-10 line{stroke:hsl(30, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:lightgray;}#mermaid-svg-6fqlZ7S2nL3jJh7V .disabled text{fill:#efefef;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-root rect,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-root path,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-root circle,#mermaid-svg-6fqlZ7S2nL3jJh7V .section-root polygon{fill:hsl(240, 100%, 46.2745098039%);}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-root text{fill:#ffffff;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-root span{color:#ffffff;}#mermaid-svg-6fqlZ7S2nL3jJh7V .section-2 span{color:#ffffff;}#mermaid-svg-6fqlZ7S2nL3jJh7V .icon-container{height:100%;display:flex;justify-content:center;align-items:center;}#mermaid-svg-6fqlZ7S2nL3jJh7V .edge{fill:none;}#mermaid-svg-6fqlZ7S2nL3jJh7V .mindmap-node-label{dy:1em;alignment-baseline:middle;text-anchor:middle;dominant-baseline:middle;text-align:center;}#mermaid-svg-6fqlZ7S2nL3jJh7V :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 容器化数据加密
传输加密
Service Mesh mTLS
Overlay 网络 IPsec
HTTPS/gRPC
数据库连接 TLS
存储加密（静态）
宿主机磁盘加密 LUKS
持久卷加密 CSI 插件
对象存储加密 S3 SSE
镜像层与仓库加密
敏感文件 tmpfs 内存
内存加密
SGX/TDX
内存页加密
密钥管理
K8s Secrets + etcd 加密
Vault, HSM
CSI Secret Store
密钥生命周期与轮转
Java 应用加密
Spring Cloud Vault
Jasypt / AES 字段加密
连接池 TLS 配置
二、传输加密：保障网络链路安全
容器间网络流量默认可能明文传输，必须对服务间通信进行加密，同时防止中间人攻击。
| 加密层次 | 实现机制 | 原理 | 适用场景 |
|---|---|---|---|
| Service Mesh mTLS | Istio/Linkerd 自动注入 Sidecar 代理，代理之间自动双向 TLS 握手，应用无感知 | Sidecar 代理拦截流量，使用自动轮换的证书进行加密，结合 SPIFFE 身份验证 | 微服务间东西向流量加密，零信任安全 |
| Overlay 网络加密 | Docker Swarm 或 CNI 插件（如 Weave）在 VXLAN 隧道上启用 IPsec 加密 | 在封装包之前用 IPsec 加密整个二层帧，跨主机流量不可见 | 无需改动应用，但增加 CPU 开销 |
| 应用层 TLS | Java 应用直接配置 HTTPS (TLS 1.3)，使用证书连接数据库、消息队列 | 传输层安全协议，通过信任的 CA 证书验证对端 | 外部 API 暴露、数据库连接等南北向流量 |
| VPN/专线 | 对于跨数据中心通信，通过 VPN 网关或专线建立加密隧道 | 物理或虚拟设备在公网上提供加密通道 | 混合云、多区域部署 |
推荐方案：生产环境优先使用 Service Mesh 实现 mTLS，既可加密通信，又能提供身份和细粒度访问控制。网络层 Overlay 加密可作为补充。
三、存储加密：保护数据静态安全
容器化环境的静态数据分布在宿主机磁盘、持久卷、对象存储等多个位置，需分层加密。
3.1 存储加密层级与原理
#mermaid-svg-5SFSAFXG6BIdQ73O{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-5SFSAFXG6BIdQ73O .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-5SFSAFXG6BIdQ73O .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-5SFSAFXG6BIdQ73O .error-icon{fill:#552222;}#mermaid-svg-5SFSAFXG6BIdQ73O .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-5SFSAFXG6BIdQ73O .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-5SFSAFXG6BIdQ73O .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-5SFSAFXG6BIdQ73O .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-5SFSAFXG6BIdQ73O .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-5SFSAFXG6BIdQ73O .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-5SFSAFXG6BIdQ73O .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-5SFSAFXG6BIdQ73O .marker{fill:#333333;stroke:#333333;}#mermaid-svg-5SFSAFXG6BIdQ73O .marker.cross{stroke:#333333;}#mermaid-svg-5SFSAFXG6BIdQ73O svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-5SFSAFXG6BIdQ73O p{margin:0;}#mermaid-svg-5SFSAFXG6BIdQ73O .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-5SFSAFXG6BIdQ73O .cluster-label text{fill:#333;}#mermaid-svg-5SFSAFXG6BIdQ73O .cluster-label span{color:#333;}#mermaid-svg-5SFSAFXG6BIdQ73O .cluster-label span p{background-color:transparent;}#mermaid-svg-5SFSAFXG6BIdQ73O .label text,#mermaid-svg-5SFSAFXG6BIdQ73O span{fill:#333;color:#333;}#mermaid-svg-5SFSAFXG6BIdQ73O .node rect,#mermaid-svg-5SFSAFXG6BIdQ73O .node circle,#mermaid-svg-5SFSAFXG6BIdQ73O .node ellipse,#mermaid-svg-5SFSAFXG6BIdQ73O .node polygon,#mermaid-svg-5SFSAFXG6BIdQ73O .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-5SFSAFXG6BIdQ73O .rough-node .label text,#mermaid-svg-5SFSAFXG6BIdQ73O .node .label text,#mermaid-svg-5SFSAFXG6BIdQ73O .image-shape .label,#mermaid-svg-5SFSAFXG6BIdQ73O .icon-shape .label{text-anchor:middle;}#mermaid-svg-5SFSAFXG6BIdQ73O .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-5SFSAFXG6BIdQ73O .rough-node .label,#mermaid-svg-5SFSAFXG6BIdQ73O .node .label,#mermaid-svg-5SFSAFXG6BIdQ73O .image-shape .label,#mermaid-svg-5SFSAFXG6BIdQ73O .icon-shape .label{text-align:center;}#mermaid-svg-5SFSAFXG6BIdQ73O .node.clickable{cursor:pointer;}#mermaid-svg-5SFSAFXG6BIdQ73O .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-5SFSAFXG6BIdQ73O .arrowheadPath{fill:#333333;}#mermaid-svg-5SFSAFXG6BIdQ73O .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-5SFSAFXG6BIdQ73O .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-5SFSAFXG6BIdQ73O .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-5SFSAFXG6BIdQ73O .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-5SFSAFXG6BIdQ73O .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-5SFSAFXG6BIdQ73O .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-5SFSAFXG6BIdQ73O .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-5SFSAFXG6BIdQ73O .cluster text{fill:#333;}#mermaid-svg-5SFSAFXG6BIdQ73O .cluster span{color:#333;}#mermaid-svg-5SFSAFXG6BIdQ73O div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-5SFSAFXG6BIdQ73O .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-5SFSAFXG6BIdQ73O rect.text{fill:none;stroke-width:0;}#mermaid-svg-5SFSAFXG6BIdQ73O .icon-shape,#mermaid-svg-5SFSAFXG6BIdQ73O .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-5SFSAFXG6BIdQ73O .icon-shape p,#mermaid-svg-5SFSAFXG6BIdQ73O .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-5SFSAFXG6BIdQ73O .icon-shape .label rect,#mermaid-svg-5SFSAFXG6BIdQ73O .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-5SFSAFXG6BIdQ73O .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-5SFSAFXG6BIdQ73O .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-5SFSAFXG6BIdQ73O :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 应用层
Java 应用
字段级加密 (AES)
数据库
对象存储层
对象存储
服务端加密 SSE
存储卷层
持久卷声明
CSI 加密插件
卷数据加密
物理/宿主机层
磁盘
LUKS 全盘加密
| 加密层 | 机制 | 优点 | 缺点 |
|---|---|---|---|
| 宿主机 LUKS | Linux Unified Key Setup 对块设备加密，在挂载时解密 | 全透明，容器无感知，防范物理磁盘丢失 | 无法阻止宿主机 root 访问，密钥在宿主机内存中 |
| CSI 卷加密 | 通过存储 CSI 驱动（如 AWS EBS encryption, Portworx, Ceph RBD encryption）在存储级自动加密卷 | 对 Pod 透明，密钥可由 KMS 管理，每个卷可单独加密 | 需存储后端支持，可能增加 I/O 延迟 |
| 对象存储 SSE | S3 等服务端加密，使用 SSE-S3, SSE-KMS 或 SSE-C 密钥 | 海量数据自动加密，集成 KMS | 数据处于云外部，需信任云服务商 |
| 应用层字段加密 | Java 应用使用 AES 等算法对敏感字段加密后存入数据库 | 即使数据库泄露，数据仍不可读；可结合 Vault 管理密钥 | 需改动代码，影响查询和索引，增加 CPU 开销 |
| tmpfs 内存文件系统 | 挂载 tmpfs 卷存放敏感信息（如密钥文件、证书），容器停止后数据消失，不落盘 | 防止敏感数据写入持久层 | 重启丢失，仅适用于临时凭证 |
Java 应用最佳实践：
- 对身份证、银行卡号、手机号等采用应用层加密（如 AES-256-GCM），密钥从 Vault 或 KMS 动态获取。
- 数据库连接使用 TLS，避免明文传输；连接池配置
useSSL=true。 - 配置文件中的密码通过环境变量或 Secret 注入，不写死；Spring Cloud Config 支持加密配置。
3.2 容器镜像与仓库加密
- 镜像签名：使用 Cosign 或 Notation 对镜像摘要签名，确保镜像未篡改。
- 仓库加密：Harbor 等私有仓库可配置存储后端加密（如 S3 加密），镜像层在仓库中加密保存。
- 镜像扫描：加密前通过 Trivy 扫描漏洞，防止带有恶意代码或泄露密钥的镜像被打包加密。
四、内存加密与机密计算
对于极高安全场景（如支付 PIN、私钥处理），可利用可信执行环境（TEE）保护运行时内存数据，即使宿主机被攻破也无法读取。
| 技术 | 原理 | 容器化实现 |
|---|---|---|
| Intel SGX / TDX | 在 CPU 内创建 Enclave，内存页加密，只有 Enclave 内代码可访问 | 通过 Gramine、Occlum 等库将应用程序包运行在 SGX Enclave 中，或使用机密容器方案（如 K8s 机密计算节点） |
| AMD SEV / SEV-ES | 虚拟机内存加密，防止 Hypervisor 读取 | 配合 KubeVirt 或 Kata Containers 运行加密虚拟机 |
| Kata Containers + Confidential Computing | 轻量级虚拟机专为容器设计，结合 SEV/TDX 加密整个 VM 内存 | 直接将 Pod 调度到开启 SEV 的 Kata 运行时节点上 |
机密计算对 Java 应用的影响：需使用支持 TEE 的 JDK 发行版，部分 I/O 操作受限，适用于核心算法（如风控模型评分）隔离执行。
五、密钥管理：加密的基石
密钥的安全存储、分发和轮转是加密系统的核心。
#mermaid-svg-SANmEyiSXgh01b2R{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-SANmEyiSXgh01b2R .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-SANmEyiSXgh01b2R .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-SANmEyiSXgh01b2R .error-icon{fill:#552222;}#mermaid-svg-SANmEyiSXgh01b2R .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-SANmEyiSXgh01b2R .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-SANmEyiSXgh01b2R .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-SANmEyiSXgh01b2R .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-SANmEyiSXgh01b2R .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-SANmEyiSXgh01b2R .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-SANmEyiSXgh01b2R .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-SANmEyiSXgh01b2R .marker{fill:#333333;stroke:#333333;}#mermaid-svg-SANmEyiSXgh01b2R .marker.cross{stroke:#333333;}#mermaid-svg-SANmEyiSXgh01b2R svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-SANmEyiSXgh01b2R p{margin:0;}#mermaid-svg-SANmEyiSXgh01b2R .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-SANmEyiSXgh01b2R .cluster-label text{fill:#333;}#mermaid-svg-SANmEyiSXgh01b2R .cluster-label span{color:#333;}#mermaid-svg-SANmEyiSXgh01b2R .cluster-label span p{background-color:transparent;}#mermaid-svg-SANmEyiSXgh01b2R .label text,#mermaid-svg-SANmEyiSXgh01b2R span{fill:#333;color:#333;}#mermaid-svg-SANmEyiSXgh01b2R .node rect,#mermaid-svg-SANmEyiSXgh01b2R .node circle,#mermaid-svg-SANmEyiSXgh01b2R .node ellipse,#mermaid-svg-SANmEyiSXgh01b2R .node polygon,#mermaid-svg-SANmEyiSXgh01b2R .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-SANmEyiSXgh01b2R .rough-node .label text,#mermaid-svg-SANmEyiSXgh01b2R .node .label text,#mermaid-svg-SANmEyiSXgh01b2R .image-shape .label,#mermaid-svg-SANmEyiSXgh01b2R .icon-shape .label{text-anchor:middle;}#mermaid-svg-SANmEyiSXgh01b2R .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-SANmEyiSXgh01b2R .rough-node .label,#mermaid-svg-SANmEyiSXgh01b2R .node .label,#mermaid-svg-SANmEyiSXgh01b2R .image-shape .label,#mermaid-svg-SANmEyiSXgh01b2R .icon-shape .label{text-align:center;}#mermaid-svg-SANmEyiSXgh01b2R .node.clickable{cursor:pointer;}#mermaid-svg-SANmEyiSXgh01b2R .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-SANmEyiSXgh01b2R .arrowheadPath{fill:#333333;}#mermaid-svg-SANmEyiSXgh01b2R .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-SANmEyiSXgh01b2R .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-SANmEyiSXgh01b2R .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-SANmEyiSXgh01b2R .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-SANmEyiSXgh01b2R .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-SANmEyiSXgh01b2R .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-SANmEyiSXgh01b2R .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-SANmEyiSXgh01b2R .cluster text{fill:#333;}#mermaid-svg-SANmEyiSXgh01b2R .cluster span{color:#333;}#mermaid-svg-SANmEyiSXgh01b2R div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-SANmEyiSXgh01b2R .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-SANmEyiSXgh01b2R rect.text{fill:none;stroke-width:0;}#mermaid-svg-SANmEyiSXgh01b2R .icon-shape,#mermaid-svg-SANmEyiSXgh01b2R .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-SANmEyiSXgh01b2R .icon-shape p,#mermaid-svg-SANmEyiSXgh01b2R .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-SANmEyiSXgh01b2R .icon-shape .label rect,#mermaid-svg-SANmEyiSXgh01b2R .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-SANmEyiSXgh01b2R .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-SANmEyiSXgh01b2R .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-SANmEyiSXgh01b2R :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} Java 应用
Kubernetes 内部
外部密钥管理
etcd 加密
挂载
Vault 集成
读取挂载的 Secret
动态生成凭据
自动轮转
encryption-provider-config
硬件安全模块 HSM
云 KMS 服务
HashiCorp Vault
K8s Secret
etcd
Secret Store CSI Driver
Pod tmpfs
Spring Boot
K8s
- K8s Secrets 加密 ：配置
EncryptionConfiguration对 etcd 中的 Secret 进行 AES 加密，防止 etcd 裸泄露。 - 外部 KMS：使用云服务商 KMS 或 HashiCorp Vault 管理密钥。Vault 可以动态生成数据库密码、自动轮转，并通过 Kubernetes Auth 方法授权 Pod 访问。
- CSI Secret Store Driver：将 Vault 等密钥库中的敏感信息以 tmpfs 卷的形式挂载到 Pod，不暴露在 etcd 中。
- 密钥轮转：数据库密码、TLS 证书应设置有效期，Vault 等工具自动轮转并通知应用刷新。
六、Java 应用集成加密的最佳实践
- 配置加密：使用 Spring Cloud Config + Vault 将敏感配置加密存储，应用启动时解密。
- 字段加密 ：在实体层使用
@Convert注解或 Jasypt 等库，对数据库字段自动加解密，密钥来自 KMS。 - HTTPS 与 mTLS ：配置
server.ssl.*属性，使用密钥库文件（由 Secret 挂载）。对于微服务间调用，如果未使用 Service Mesh，可通过RestTemplate配置 SSLContext 实现 mTLS。 - 日志脱敏：自定义 Logback/Log4j2 转换器，自动遮盖加密前的明文数据，确保日志不泄露。
- 安全审计：所有加解密操作记录日志，满足等保要求。
七、思维导图总结
#mermaid-svg-oMPSJNAxWcU41E9G{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-oMPSJNAxWcU41E9G .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-oMPSJNAxWcU41E9G .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-oMPSJNAxWcU41E9G .error-icon{fill:#552222;}#mermaid-svg-oMPSJNAxWcU41E9G .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-oMPSJNAxWcU41E9G .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-oMPSJNAxWcU41E9G .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-oMPSJNAxWcU41E9G .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-oMPSJNAxWcU41E9G .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-oMPSJNAxWcU41E9G .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-oMPSJNAxWcU41E9G .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-oMPSJNAxWcU41E9G .marker{fill:#333333;stroke:#333333;}#mermaid-svg-oMPSJNAxWcU41E9G .marker.cross{stroke:#333333;}#mermaid-svg-oMPSJNAxWcU41E9G svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-oMPSJNAxWcU41E9G p{margin:0;}#mermaid-svg-oMPSJNAxWcU41E9G .edge{stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .section--1 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section--1 path,#mermaid-svg-oMPSJNAxWcU41E9G .section--1 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section--1 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section--1 path{fill:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section--1 text{fill:#ffffff;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon--1{font-size:40px;color:#ffffff;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge--1{stroke:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth--1{stroke-width:17;}#mermaid-svg-oMPSJNAxWcU41E9G .section--1 line{stroke:hsl(60, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-0 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-0 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-0 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-0 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-0 path{fill:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-0 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-0{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-0{stroke:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-0{stroke-width:14;}#mermaid-svg-oMPSJNAxWcU41E9G .section-0 line{stroke:hsl(240, 100%, 83.5294117647%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-1 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-1 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-1 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-1 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-1 path{fill:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-1 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-1{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-1{stroke:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-1{stroke-width:11;}#mermaid-svg-oMPSJNAxWcU41E9G .section-1 line{stroke:hsl(260, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-2 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-2 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-2 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-2 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-2 path{fill:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-2 text{fill:#ffffff;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-2{font-size:40px;color:#ffffff;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-2{stroke:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-2{stroke-width:8;}#mermaid-svg-oMPSJNAxWcU41E9G .section-2 line{stroke:hsl(90, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-3 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-3 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-3 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-3 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-3 path{fill:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-3 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-3{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-3{stroke:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-3{stroke-width:5;}#mermaid-svg-oMPSJNAxWcU41E9G .section-3 line{stroke:hsl(120, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-4 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-4 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-4 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-4 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-4 path{fill:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-4 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-4{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-4{stroke:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-4{stroke-width:2;}#mermaid-svg-oMPSJNAxWcU41E9G .section-4 line{stroke:hsl(150, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-5 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-5 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-5 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-5 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-5 path{fill:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-5 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-5{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-5{stroke:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-5{stroke-width:-1;}#mermaid-svg-oMPSJNAxWcU41E9G .section-5 line{stroke:hsl(180, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-6 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-6 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-6 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-6 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-6 path{fill:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-6 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-6{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-6{stroke:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-6{stroke-width:-4;}#mermaid-svg-oMPSJNAxWcU41E9G .section-6 line{stroke:hsl(210, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-7 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-7 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-7 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-7 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-7 path{fill:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-7 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-7{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-7{stroke:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-7{stroke-width:-7;}#mermaid-svg-oMPSJNAxWcU41E9G .section-7 line{stroke:hsl(270, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-8 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-8 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-8 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-8 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-8 path{fill:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-8 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-8{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-8{stroke:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-8{stroke-width:-10;}#mermaid-svg-oMPSJNAxWcU41E9G .section-8 line{stroke:hsl(330, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-9 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-9 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-9 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-9 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-9 path{fill:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-9 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-9{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-9{stroke:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-9{stroke-width:-13;}#mermaid-svg-oMPSJNAxWcU41E9G .section-9 line{stroke:hsl(0, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-10 rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-10 path,#mermaid-svg-oMPSJNAxWcU41E9G .section-10 circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-10 polygon,#mermaid-svg-oMPSJNAxWcU41E9G .section-10 path{fill:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-10 text{fill:black;}#mermaid-svg-oMPSJNAxWcU41E9G .node-icon-10{font-size:40px;color:black;}#mermaid-svg-oMPSJNAxWcU41E9G .section-edge-10{stroke:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .edge-depth-10{stroke-width:-16;}#mermaid-svg-oMPSJNAxWcU41E9G .section-10 line{stroke:hsl(30, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled,#mermaid-svg-oMPSJNAxWcU41E9G .disabled circle,#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:lightgray;}#mermaid-svg-oMPSJNAxWcU41E9G .disabled text{fill:#efefef;}#mermaid-svg-oMPSJNAxWcU41E9G .section-root rect,#mermaid-svg-oMPSJNAxWcU41E9G .section-root path,#mermaid-svg-oMPSJNAxWcU41E9G .section-root circle,#mermaid-svg-oMPSJNAxWcU41E9G .section-root polygon{fill:hsl(240, 100%, 46.2745098039%);}#mermaid-svg-oMPSJNAxWcU41E9G .section-root text{fill:#ffffff;}#mermaid-svg-oMPSJNAxWcU41E9G .section-root span{color:#ffffff;}#mermaid-svg-oMPSJNAxWcU41E9G .section-2 span{color:#ffffff;}#mermaid-svg-oMPSJNAxWcU41E9G .icon-container{height:100%;display:flex;justify-content:center;align-items:center;}#mermaid-svg-oMPSJNAxWcU41E9G .edge{fill:none;}#mermaid-svg-oMPSJNAxWcU41E9G .mindmap-node-label{dy:1em;alignment-baseline:middle;text-anchor:middle;dominant-baseline:middle;text-align:center;}#mermaid-svg-oMPSJNAxWcU41E9G :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 容器数据加密
传输
Service Mesh
Overlay IPsec
应用层 TLS
静态存储
LUKS 全盘
CSI 卷加密
对象存储 SSE
应用字段 AES
tmpfs 敏感文件
内存
SGX/TDX Enclave
SEV 加密 VM
Kata 机密容器
密钥管理
K8s Secret + etcd 加密
Vault / KMS
CSI Secret Store
自动轮转
Java 实现
Spring Cloud Vault
Jasypt/AES 字段加密
日志脱敏
TLS/mTLS 配置
总结：容器化环境的数据加密并非单一手段，而是覆盖"传输加密、存储分层加密、机密计算和密钥全生命周期管理"的多层体系。在金融级场景中，需综合 Service Mesh mTLS、CSI 卷加密、应用字段 AES、KMS 密钥管理，并结合 Java 应用的无感集成，才能既满足合规又保证性能。在高级面试中，能系统阐述这一框架，并针对具体场景给出各层的技术选型理由，是容器安全架构能力的核心体现。