Overview
If encryption was not enabled at installation, you can enable internal encryption (encryption with internal key management). After enabling internal encryption, you can switch from internal encryption to an EKM.
If internal encryption was enabled at installation, you can switch from internal encryption to an EKM.
You cannot switch between EKM types.
When encryption is enabled on the cluster, every tenant created on the cluster must be associated with an encryption group. This can be a new or a pre-existing encryption group.
Enabling Encryption with Internal Key Management
Note
If encryption was not enabled at installation, but you want to add EKM encryption, follow the procedure below before enabling EKM encryption.
If internal key management has already been enabled and you want to add EKM encryption, see Enabling EKM Encryption.
Limitations
Enabling encryption on a running cluster (after installation) is supported with the following limitation:
To enable encryption after installation using externally managed keys, encryption must first be enabled using internal encryption. It can then be changed to use one of the external key management services.
Impact of Enablement on a Running Cluster
Enabling encryption during cluster operation triggers a rewrite of all the data and name blocks to ensure that all pre-existing data and name blocks on the cluster are encrypted.
The following are important points to note about the rewrite:
All data is typically rewritten during this rewrite and therefore the impact on storage media endurance is approximately similar to that of deleting all data on the cluster and writing it.
The rewrite proceeds as a background task that cannot be paused or stopped. In case of severe performance degradation, it may be possible for VAST Support to throttle the process and reduce the performance impact.
The rewrite may take a while, and may impact performance for workloads.
If expansions are planned, they should be done prior to enabling encryption so that the rewrite will utilize as many DBoxes as possible and minimize RAID overhead.
A combined option is available for enabling DBox High Availability and encryption simultaneously (detailed in the procedures below). If DBox HA is not yet enabled on the cluster and you intend to enable DBox HA, you should choose the combined option to avoid triggering a rewrite twice, when you enable each feature.
DBox expansion is not available while the rewrite is in progress.
Enabling Encryption from the VAST Web UI
In the VAST Web UI, select Settings -> Data Management..
Under Configuration, select the Encryption checkbox.
The Enable Encryption? dialog appears, prompting you to approve the feature enablement.
Type APPROVE as prompted, in the field provided.
Click Yes, Enable Encryption.
Contrary to the implication in the Enable Encryption? dialog, a rewrite is not yet triggered.
If you want to enable DBox HA as well as encryption, select the DBox HA checkbox as well and follow the instructions in the dialog that appears to approve that you want to enable DBox HA.
Again, a rewrite is not yet triggered.
Click Start Rewrite.
Click Yes to confirm that you want to start a rewrite.
The rewrite begins and a progress bar appears at the top right of the page, reporting the current phase of the rewrite as it progresses and the percentage progress.
The checkboxes that you selected remain selected, indicating which features are enabled.
Enabling Encryption from the VAST CLI
Run the cluster modify command with the
--enable-encryptionoption, or, if you wish to enable DBox High Availability at the same time, run the commandcluster modify --enable-encryption --enable-dbox-ha:cluster modifyNote
Enabling both options at the same time reduces impact on drives and can reduce impact on workloads.
For encryption without DBox HA:
vcli: admin> cluster modify --enable-encryptionFor encryption with DBox HA:
vcli: admin> cluster modify --enable-encryption --enable-dbox-haYou are warned:
Enabling Encryption/DBox HA support triggers a required rewrite of current data. Are you sure you want to proceed? [y/N]Enter 'y' to confirm that you want to proceed.
The rewrite begins.
You can now monitor the progress of the rewrite. Enter the command
cluster show. The command output includes the following fields:Rewrite-phase. During the rewrite, one of the main phases appears here. The order of the phases is:INTERNAL_PRE_REWRITEDATA_REWRITE_PREDATA_REWRITE_SCRUBDATA_REWRITELAYOUT_REWRITE_PRELAYOUT_REWRITEFINALIZE
Rewrite-progress. This shows the percentage progress of the current phase of the rewrite. When it reaches 100% of the final phase, the rewrite is complete.Encryption (and DBox HA capability if applicable) is now fully enabled.
Enabling EKM Encryption
Note
This procedure can be used to enable EKM encryption on a cluster that has encryption enabled with internal management of encryption keys. When you enable an EKM, pre-existing encryption groups are not affected. New tenants can be encrypted with new or pre-existing encryption groups.
Enabling Encryption with an EKM from the VAST Web UI
From the left navigation menu, select Settings, Cluster and then KMIP.
Select Encryption Type to enable on the cluster:
INTERNAL. Encryption with keys managed internally. This is the only type of encryption that can be disabled after installation or enabled after installation.
CIPHER_TRUST_KMIP. Encryption with keys managed externally on Thales Group CipherTrust Data Security Platform.
FORTANIX_KMIP. Encryption with keys managed externally on Fortanix DSM.
HASHICORP_KMIP. Encryption with keys managed externally on HashiCorp Vault Enterprise.
ENTRUST_KMIP. Encryption with keys managed externally on Entrust KeyControl.
AKEYLESS_KMIP. Encryption with keys managed externally on the Akeyless platform.
UTIMACO_KMIP. Encryption with keys managed externally on Utimaco Enterprise Secure Key Manager.
GENERIC_KMIP. Enables generic KMIP support instead of choosing one of the specific EKMs.
Add up to four External Key Management Servers: For each server, enter the server IP address in the Server Address field and the port in the Port field, and then click Add To Table.
Enter the SSL certificate for the connection to the EKM servers:
Click the +Add Certificate link under EKM Certificate and then paste the content of the certificate file into the text field provided. Include the "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" lines from the certificate file content.
Click the +Add Key link under EKM Private Key and paste the content of the private key file of the SSL certificate into the test field provided.
Optionally, enter a CA certificate: Click the +Add Certificate link under EKM CA certificate and paste the content of the CA certificate file.
For Thales Group CipherTrust Data Security Platform only:
In the Auth Domain field, you can specify a subdomain of the EKM root domain (optional).
The subdomain needs to be created on the Thales CipherTrust manager.
When the deployment is complete, encryption groups created on the cluster will have their encryption-at-rest keys generated within the specified subdomain.
In the Use proxy field, you can specify a proxy server through which to connect to the EKM server (optional). Select the check box and then provide the host and port of the proxy server in the fields provided. Specify Host in the format https://proxy-address.
When done, select Save. A message appears that Encryption Settings have been updated.
Any encryption groups created after this procedure will use the newly configured EKM.
Enabling Encryption with an EKM from the VAST CLI
Use the cluster add-ekm command.