Search <book_title>...

Veritas InfoScale™ for Kubernetes Environments 8.0.300 - Linux

Last Published: 2023-12-12

Product(s): InfoScale & Storage Foundation (8.0.300)

Configuring InfoScale to enable transfer of keys

You must configure InfoScale to enable a connection with the Key Management Server (KMS) to transfer and save rest certs.

If you have created multiple InfoScale clusters, ensure you run steps 23 to 28 for every cluster.

The rest certs are renewed every three months and the renewed certs must be uploaded to the KMS server. Run steps 23 to 28 every three months for encryption to work.

Note:

After a client rest cert is renewed, ensure that you add the renewed client cert to the client group on the KMS server.

Complete the following steps

Note:

The following steps inform you how to configure IBM Key Management Server. As an administrator, you can configure any KMIP-compliant server. Refer to the procedure of that KMIP-compliant server.

Be ready with the IP address and port number of the Key Management Server (KMS).
Run echo "<IP address of the server >"| base64
Verify the output as under
```
Server output for base64
```
Run echo "<Port number of the server >"| base64
Verify the output as under
```
Port number output for base64
```

Copy the following content into a file and save it as infoscale-kmip-secret.yaml.

apiVersion: v1
data:
  host: <Server output for base64>
  port: <Port number output for base64>
kind: Secret
metadata:
  name: infoscale-kmip-encrypt
  namespace: infoscale-vtas
type: Opaque

Run kubectl apply -f infoscale-kmip-secret.yaml to deploy the InfoScale secret.
From another terminal, logon to https://www.ibm.com/docs/en/sgklm/4.1.1?topic=objects-registering-client-by-using-graphical-user-interface.
Select Advanced Configuration > Server Certificate. Click Add. The Add SSL/KMIP Certificate screen opens.
Select Request certificate from a third-party provider and enter values for Certificate label and Certificate description.
Click Add Certificate. The certificate is listed as Administer Server Certificates.
Review the Status of the certificate. The status is Certificate is pending.
From the master node, run ssh root@<IP address of the KMS >. Enter the password and login.
The certificate you just created is listed under /opt/IBM/WebSphere/AppServer/products/sklm/data/ as <Time stamp>_<Certificate name>.csr.
Note:
The path might vary depending on the KMS version.
Copy content of /opt/IBM/WebSphere/Liberty/products/sklm/data/<Time stamp>_<Certificate name>.csr into another file <Copy of server cert content>.pem.
Run openssl x509 -req -in <Time stamp>_<Certificate name>.csr -CA infoscale-ca.pem -CAkey infoscale-ca-key.pem -CAcreateserial -out <server-certificate-name> -days 1024 -sha256
Review the output for the following message.
```
Signature ok
```
Copy <Certificate name>.crt to the root directory of the Key Management server.
On the Welcome screen of KMS, click Third-party certificates pending import.
In the Import Certificate screen, click Browse and navigate to the certificate you saved. Click Select.
Run kubectl get secret -n infoscale-vtas.
Review the output for the following
```
NAME
infoscale-ca
```
Run kubectl get secret -n infoscale-vtas.
Review the output for the following
```
NAME
infoscale-kmip-encrypt
```
Run kubectl -n <namespace where cr is deployed> get secret infoscale-sds-rest-tls-cert-<cluster-id> -o jsonpath="{.data['tls\.crt']}" | base64 --decode > <kmip-device-client-cert>,
Copy <kmip-device-client-cert> to the root directory of the KMS.
On the KMS, select Advanced Configuration > Client Device Certificates. Click Import.
In the Import SSL/KMIP Certificate for Clients window, assign a name and click Browse to select <device-certificate>.crt from the root directory.
Select the checkbox next to Allow the server to trust this certificate with the associated client device.
Click Import.

After a successful configuration, data is more secure and a need to back up keys required during Disaster Recovery is eliminated.

For a DR configuration

Complete steps 1 to 24 on one of the DR sites to configure infoscale-kmip-encrypt and the server certificate. Ensure that you configure infoscale-kmip-encrypt on all the sites. See steps 4 and 5.
Run the following command on the primary site to get the client certificate.
kubectl -n infoscale-vtas get secret infoscale-sds-rest-tls-cert-<cluster-id> -o jsonpath="{.data['tls\.crt']}" | base64 --decode > <kmip-primary-cert>
Run the following command on the secondary site to get the client certificate.
kubectl -n infoscale-vtas get secret infoscale-sds-rest-tls-cert-<cluster-id> -o jsonpath="{.data['tls\.crt']}" | base64 --decode > <kmip-secondary-cert>
Logon to https://www.ibm.com/docs/en/sgklm/4.1.1?topic=objects-registering-client-by-using-graphical-user-interface and perform the following steps to register client and create client group.
- Navigate to Clients > Clients (subsection) > Create > fill details. Enter <kmip-primary-cert> to register client.
- Similarly, enter <kmip-secondary-cert> to register client.
Logon to https://www.ibm.com/docs/en/sgklm/4.1.1?topic=mcgctco-creating-managing-client-group-by-using-graphical-user-interface. Navigate to Clients > Client Groups (subsection) > Add > Provide Client Group Name > Create . Select clients from the list and click Save.
Run steps 23 to 28 again.