Search <book_title>...

Veritas InfoScale™ for Kubernetes Environments 8.0.220 - Linux

Last Published: 2023-10-16

Product(s): InfoScale & Storage Foundation (8.0.220)

Platform: Linux

Configuring InfoScale to enable transfer of keys

You must configure InfoScale to enable a connection with the Key Management Server (KMS) to transfer and save keys.

Complete the following steps

Be ready with the IP address and port number of the Key Management Server (KMS).
Run echo "<IP address of the server >"| base64
Verify the output as under
```
Server output for base64
```
Run echo "<Port number of the server >"| base64
Verify the output as under
```
Port number output for base64
```

Copy the following content into a file and save it as infoscale-kmip-secret.yaml.

apiVersion: v1
data:
  host: <Server output for base64>
  port: <Port number output for base64>
kind: Secret
metadata:
  name: infoscale-kmip-encrypt
  namespace: infoscale-vtas
type: Opaque

Run oc apply -f infoscale-kmip-secret.yaml to deploy the InfoScale secret.
From another terminal, logon to https://www.ibm.com/docs/en/sgklm/&4.1.1?topic=objects-registering-client-by-using-graphical-user-interface.
Select Advanced Configuration > Server Certificate. Click Add. The Add SSL/KMIP Certificate screen opens.
Select Request certificate from a third-party provider and enter values for Certificate label and Certificate description.
Click Add Certificate. The certificate is listed as Administer Server Certificates.
Review the Status of the certificate. The status is Certificate is pending.
From the bastion node, run ssh root@<IP address of the KMS >. Enter the password and login.
The certificate you just created is listed under /opt/IBM/WebSphere/Liberty/products/sklm/data/ as <Time stamp>_<Certificate name>.csr.
Copy content of /opt/IBM/WebSphere/Liberty/products/sklm/data/<Time stamp>_<Certificate name>.csr into another file <Copy of server cert content>.pem.
Run openssl x509 -req -in <Time stamp>_<Certificate name>.csr -CA infoscale-ca.pem -CAkey infoscale-ca-key.pem -CAcreateserial -out <server-certificate-name> -days 1024 -sha256

Review the output as under

-out <server-certificate-name> -days 1024 -sha256

Run openssl x509 -req -in <Copy of server cert content>.pem -CA infoscale-ca.pem -CAkey infoscale-ca-key.pem -CAcreateserial -out <Certificate name>.crt -days 1024 -sha256
Review the output for the following message.
```
Signature ok
```
Copy <Certificate name>.crt to the root directory of the Key Management server.
On the Welcome screen of KMS, click Third-party certificates pending import.
In the Import Certificate screen, click Browse and navigate to the certificate you saved. Click Select.
Run oc get secret -n infoscale-vtas.
Review the output for the following
```
NAME
infoscale-ca
```
Run oc get secret -n infoscale-vtas.
Review the output for the following
```
NAME
infoscale-kmip-encrypt
```
Run oc -n infoscale-vtas get secret infoscale-sds-rest-tls-cert-<cluster-id> -o jsonpath="{.data['tls\.crt']}" | base64 --decode > <kmip-client-cert>,
followed by
oc -n infoscale-vtas get secret infoscale-ca -o jsonpath="{.data['ca\.crt']}" | base64 --decode >> <device-certificate>.crt.
<device-certificate>.crt is created on the bastion node.
Copy <device-certificate>.crt to the root directory of the KMS.
On the KMS, select Advanced Configuration > Client Device Certificates. Click Import.
In the Import SSL/KMIP Certificate for Clients window, assign a name and click Browse to select <device-certificate>.crt from the root directory.
Select the checkbox next to Allow the server to trust this certificate with the associated client device.
Click Import.

After a successful configuration, data is more secure and a need to back up keys required during Disaster Recovery is eliminated.

For a DR configuration

Complete steps 1 to 24 on one of the DR sites to configure infoscale-kmip-encrypt and the server certificate. Ensure that you configure infoscale-kmip-encrypt on all the sites. See steps 4 and 5.
Run the following command on the primary site to get the client certificate.
oc -n infoscale-vtas get secret infoscale-sds-rest-tls-cert-<cluster-id> -o jsonpath="{.data['tls\.crt']}" | base64 --decode > <kmip-primary-cert>
Run the following command on the secondary site to get the client certificate.
oc -n infoscale-vtas get secret infoscale-sds-rest-tls-cert-<cluster-id> -o jsonpath="{.data['tls\.crt']}" | base64 --decode > <kmip-secondary-cert>
Logon to https://www.ibm.com/docs/en/sgklm/4.1.1?topic=&objects-registering-client-by-using-graphical-user-interface and perform the following steps to register client and create client group.
- Navigate to Clients > Clients (subsection) > Create > fill details. Enter <kmip-primary-cert> to register client.
- Similarly, enter <kmip-secondary-cert> to register client.
Logon to https://www.ibm.com/docs/en/sgklm/4.1.1?&topic=mcgctco-creating-managing-client-group-by-using-graphical-user-interface. Navigate to Clients > Client Groups (subsection) > Add > Provide Client Group Name > Create . Select clients from the list and click Save.