Post

/clusters/{id}/add_ekm/

You can use this endpoint to enable data encryption on a cluster that does not already have encryption enabled. In this case, encryption keys must be managed internally. You can also use this endpoint to enable an external key manager (EKM) if the cluster already has encryption enabled with internal key management. You cannot switch from one EKM to another.

Security

HTTP

Type basic

Basic authentication using VMS user name and password

API Key: ApiToken

Header parameter nameApiToken

Send current valid API token in an Authorization header with format Api-Token .

Body parameters

object

ekm_servers

string

List of EKM servers: 10.0.0.1:5696,11.0.0.1:5697

ekm_certificate

string

EKM certificate

ekm_private_key

string

EKM private key

ekm_ca_certificate

string

EKM CA certificate

ekm_bypass_validation

boolean

Set to true to bypass EKM certificate validation.

encryption_type

string

Specifies how to manage encryption keys for all new encryption groups on the cluster. Only one encryption type can be enabled on the cluster. If encryption is not enabled already, the only valid option is INTERNAL, which enables data encryption with keys managed internally. If internal encryption is already enabled, you can specify one of the other options. If an EKM is already enabled, you cannot switch to another EKM. CIPHER_TRUST_KMIP=Keys are stored and managed on Thales Group CipherTrust Data Security Platform, FORTANIX_KMIP=Keys are stored and managed on Fortanix DSM, HASHICORP_KMIP=Keys are stored and managed on HashiCorp Vault Enterprise, ENTRUST_KMIP=Keys are stored and managed on Entrust KeyControl, UTAMICO_KMIP=Keys are stored and managed on the Utamico platform, AKEYLESS_KMIP=Keys are stored and managed on the Akeyless platform.

Valid values[ "INTERNAL", "CIPHER_TRUST_KMIP", "FORTANIX_KMIP", "HASHICORP_KMIP", "ENTRUST_KMIP", "UTAMICO_KMIP", "AKEYLESS_KMIP" ]

ekm_auth_domain

string

Applicable only if encryption_type=CIPHER_TRUST_KMIP. Specifies the CipherTrust authentication domain of the user. This is the domain where the user was created. The default is an empty string, which is equivalent to the root domain.

ekm_domain

string

Applicable only when encryption_type=CIPHER_TRUST_KMIP. Specifies a child domain name for use when logging in. New keys are created inside the domain.

ekm_proxy_address

string

Applicable only when encryption_type=CIPHER_TRUST_KMIP. Specifies a proxy address for connection to the Thales CipherTrust Manager via proxy. Provide the proxy address in the format https://proxy-address:port.

Responses

204

Enable Data Encryption with Internal Key Management or Switch from Internal to External Key Management