Search <book_title>...

Veritas InfoScale™ for Kubernetes Environments 8.0.100 - Linux

Last Published: 2022-07-11

Product(s): InfoScale & Storage Foundation (8.0.100)

Configuring InfoScale to enable transfer of keys

You must configure InfoScale to enable a connection with the Key Management Server (KMS) to transfer and save keys.

Complete the following steps

Be ready with the IP address and port number of the Key Management Server (KMS).
Run echo "<IP address of the server >"| base64
Verify the output as under
```
Server output for base64
```
Run echo "<Port number of the server >"| base64
Verify the output as under
```
Port number output for base64
```

Copy the following content into a file and save it as infoscale-kmip-secret.yaml.

apiVersion: v1
data:
  host: <Server output for base64>
  port: <Port number output for base64>
kind: Secret
metadata:
  name: infoscale-kmip-encrypt
  namespace: infoscale-vtas
type: Opaque

From another terminal, login to the Key Management Server - https://<IP address of the server>:<port number>/ibm/SKLM/login.jsp.
Select Advanced Configuration > Server Certificate. Click Add. The Add SSL/KMIP Certificate screen opens.
Select Request certificate from a third-party provider and enter values for Certificate label and Certificate description.
Click Add Certificate. The certificate is listed as Administer Server Certificates.
Review the Status of the certificate. The status is Certificate is pending.
From the bastion node, run ssh root@<IP address of the KMS >. Enter the password and login.
The certificate you just created is listed under /opt/IBM/WebSphere/AppServer/products/sklm/ as <Time stamp>_<Certificate name>.csr.
Copy content of /opt/IBM/WebSphere/AppServer/products/sklm/<Time stamp>_<Certificate name>.csr into another file <Copy of server cert content>.pem.
Run openssl x509 -req -in <Time stamp>_<Certificate name>.csr -CA infoscale-ca.pem -CAkey infoscale-ca-key.pem -CAcreateserial -out <server-certificate-name> -days 1024 -sha256

Review the output as under

-out <server-certificate-name> -days 1024 -sha256

Run openssl x509 -req -in <Copy of server cert content>.pem -CA infoscale-ca.pem -CAkey infoscale-ca-key.pem -CAcreateserial -out <Certificate name>.crt -days 1024 -sha256
Review the output for the following message.
```
Signature ok
```
Copy <Certificate name>.crt to the root directory of the Key Management server.
On the Welcome screen of KMS, click Third-party certificates pending import.
In the Import Certificate screen, click Browse and navigate to the certificate you saved. Click Select.
On the bastion node, run oc apply -f custom-ca.yaml.
Review the output for the following
```
secret/infoscale-ca configured.
```
Run oc get secret -n infoscale-vtas.
Review the output for the following
```
NAME
infoscale-ca
```
Run oc apply -f infoscale-kmip-secret.yaml to deploy the InfoScale secret.
Run oc get secret -n infoscale-vtas.
Review the output for the following
```
NAME
infoscale-kmip-encrypt
```
Run oc -n infoscale-vtas get secret infoscale-ca -o jsonpath="{.data['tls\.crt']}" | base64 --decode >> <device-certificate>.crt,
followed by
oc -n infoscale-vtas get secret infoscale-ca -o jsonpath="{.data['ca\.crt']}" | base64 --decode >> <device-certificate>.crt.
<device-certificate>.crt is created on the bastion node.
Copy <device-certificate>.crt to the root directory of the KMS.
On the KMS, select Advanced Configuration > Client Device Certificates. Click Import.
In the Import SSL/KMIP Certificate for Clients window, assign a name and click Browse to select <device-certificate>.crt from the root directory.
Select the checkbox next to Allow the server to trust this certificate with the associated client device.
Click Import.

After a successful configuration, data is more secure and a need to back up keys required during Disaster Recovery is eliminated.