InfoScale™ 9.0 Storage Foundation Cluster File System High Availability Administrator's Guide - Linux

To configure the Azure KMS service on the cloud provider:

1. Set up an Application Service Principal:

   • Register an Application in Azure AD:

     • Sign in to the Azure Portal.

     • Navigate to Azure Active Directory > App registrations (or search for "App registrations" in the search bar).

     • Click New registration and specify the following details:

       Field	Description
       Name	Enter a name. For example: InfoScaleAppServicePrincipal
       Supported account types	Select Accounts in this organizational directory only (default).
       Redirect URI	Leave blank (not needed for service principal).

     • Click Register.

   • Get the Application (Client) ID and Tenant ID:

     • After registration, go to the Overview page of your new app.

     • Copy the following details: Application/Client ID and Directory/tenant ID.

   • Create a Client Secret (Recommended for remote VM):

     • In the App registration page, go to Certificates & Secrets.

     • Under Client secrets, click New client secret.

     • Enter a description for example, InfoScaleAppSecret and set an expiration by choosing a duration.

     • Click Add.

     • Copy the Value (this is your client secret) immediately, as it won't be shown again.

2. (Optional) Create a new KMS role.

   This step is optional but recommended so a new dedicated role has permissions for only the required operations for InfoScale key vault Client, keeping the principal of least security privilege in mind.

3. Create a key vault.

   During configuration, select Azure role-based access control. For networking, configure and select public/private access based on requirement. Make a note of the Vault URI on the Summary page of the key vault.

4. Assign role to VM's managed identity for Key vault access:

   • In the Key Vault menu, go to Access Control (IAM).

   • Click Add role assignment and in the Add role assignment window do the following:

     • Role: Select Key Vault Crypto Officer (Allows cryptographic operations such as sign, encrypt, and decrypt) or select new custom role created for InfoScale KMS operations.

     • Assign access to: Choose service principal.

     • Click Select members and search for your Application Service Principal (this is the app registered in Azure AD for your remote VM). Select it and click Next > Review + assign.

To configure InfoScale hosts for the KMS service:

1. Update the cloudkmsclient.yaml configuration file. The storage admin needs to update the /etc/vx/cloudkmsclient.yaml file with the required information. Root-level permissions are required to edit this configuration file.

   The following example shows a sample YAML configuration file. The parameters for which you need to specify the values are highlighted in bold:

   global: 
   
     # The cloud KMS provider to use (Valid options are "aws", "azure") 
   
     cloud_kms_provider: "azure" 
   
     # Logging level (e.g., 'INFO', 'DEBUG', 'ERROR') 
   
     log_level: "INFO" 
   
    
   # Configuration for specific cloud providers 
   
   cloud_providers: 
   
     aws: 
   
       # Region name where KMS service is hosted. e.g. "us-east-1" 
   
       region: "" 
   
       # InfoScale user (IAM) information 
   
       aws_account_id: "" 
   
       access_key: "" 
   
       secret_key: "" 
   
       # Name of KMS Specific role to be assumed having appropriate kms permissions 
   
       role_name: "" 
   
       # Set is_ec2_instance to True when Infoscale is running in EC2 
   
       is_ec2_instance: False 
   
       fips: False 
   
     azure: 
   
       # Set is_azure_instance to True when Infoscale is running in Azure instance 
   
       is_azure_instance: False 
   
       # Azure key vault URI (globally unique), 
   
       # For private access: https://<your-keyvault-nam>>.privatelink.vaultcore.azure.net 
   
       # For public access: https://<your-keyvault-name>.vault.azure.net 
   
       key_vault_uri: "" 
   
       # Azure client ID for authentication 
   
       client_id: "" 
   
       # Azure client secret for authentication 
   
       client_secret: "" 
   
       # Azure tenant ID for authentication 
   
       tenant_id: "" 
   
       fips: False 

2. Verify the configuration. After updating the YAML file, run the below command on InfoScale hosts to check if the configuration is done correctly. If InfoScale is deployed in cluster mode, the admin must ensure that all the cluster nodes have the same configuration file.

   # vxencrypt -t cloudkms configure -- dryrun