Search <book_title>...

InfoScale™ 9.0 Storage Foundation Cluster File System High Availability Administrator's Guide - Linux

Last Published: 2025-04-14

Product(s): InfoScale & Storage Foundation (9.0)

Platform: Linux

Online volume encryption at rest

Volume Manager (VxVM) provides the online volume encryption at rest feature that lets you migrate unencrypted volumes to encrypted ones. Using this feature a volume can be migrated without application downtime, that is, while the file system is mounted and while the I/Os are running. It also avoids complexities, like having to modify application configurations, and has a controlled impact on the application I/O performance.

The online migration process involves mirroring the existing storage configured under a volume, which requires an equal amount of additional storage that gets used in the background.

The process comprises the following phases:

Start
When you initiate this phase, it runs as a background process, during which VxVM takes the following actions:
- Creates an encrypted plex with a layered layout under the volume, with the layout type and allocation attributes that you specify. If you do not provide any specific values, the same layout and allocation attributes as those of the unencrypted plex are used.
- Synchronizes the data from the original layout to the encrypted layout.
Commit
You can initiate this phase only after the Start phase is complete. In this phase, VxVM takes the following actions:
- Swaps the newly created encrypted plex with the original unencrypted one.
- Enables encryption on the top-level volume.
- Stores the unencrypted plex under a temporary volume for later review and deletion.

Note:

A migration commit operation is not permitted on volumes that have associated snapshots. If the unencrypted volume is part of a volume replication configuration, it may have some associated snapshots. You must first delete any existing volume snapshots and then perform the commit operation. After the volume is successfully migrated to an encrypted volume, you can create a new snapshot policy and take those snapshots again.

Optionally, you can perform the following tasks after the Start phase is completed and before you initiate the Commit phase:

Switch Plex - Lets you switch the reads between the source (unencrypted) and the target (encrypted) plexes; meanwhile, the writes continue to happen on both the plexes. Use this option to verify the data that was copied from the source plex in the Start phase.
Abort - Lets you abort the migration. Any intermediate changes made to the storage configuration are rolled back, without any disruption to the application I/Os.

Additionally, you can monitor and control the online migration operations as follows:

You can monitor the operations by using the vxtask list command.
You can control the operations by using the vxtask {pause|resume} <TaskID> command.

The unencrypted volume is migrated to an encrypted one only when both the Start and the Commit phases are completed successfully.

Note:

After the online migration is committed successfully, volume encryption cannot be disabled.

Limitations:

Online migration is not supported in the following cases:
- RAID 5 and erasure coded (EC) volumes
- Volumes with mixed layouts
- Volumes configured for VVR replication
Only one online migration can be performed on an unencrypted volume at a time.

You can use either VxVM commands or the Management Server console of InfoScale Operations Manager to migrate unencrypted volumes to encrypted ones.

See Encrypting existing volumes.