What’s new on vSAN Encryption 6.7 U1?

I’ve written a few blog posts in the past about vSAN Data at Rest Encryption (D@RE). These posts explain how encryption works, and how the keys are handed over to vSphere. Go here for more info.

For vSAN D@RE to work properly, ESXi hosts need to be able to reach the KMS cluster during reboot operations. Yes, hopefully you have a cluster for redundancy, but a single KMS server will still work. This is necessary in order for ESXi hosts within the vSAN cluster to be able to obtain both the Host Encryption Key (let’s call this HEK), and the Key Encryption Key (KEK).

Wait!!! Why do we have to go to KMS again if we already received the keys?!?!

See, The Host Encryption Key, and the Key Encryption Key live in a non persistent state in memory, in the key cache. When a vSAN node (ESXi server) is rebooted, these key go away (poof…gone). So, when vSAN encryption is enabled, and the hosts are rebooted, it needs to go out to the KMS and get those keys. So you may want to make sure that your hosts can talk to KMS, and that KMS has your keys before you consider rebooting your hosts. Oh yeah, it goes without saying that the KMS should NOT be in the vSAN cluster, and you can see why.

Once the HEK is obtained, the host reaches a crypto-safe mode, which allows the host to obtain a good operational state, and continue with the boot process, at which point it asks for the KEK from KMS. If the host is not able to obtain such keys from the KMS cluster, the host will continue to boot; however, the disks will not be mounted as the host was not in crypto-safe mode, and it was not able to obtain the KEK from KMS resulting in failure to unwrap the Data Encryption Key (DEK).

In a scenario where hosts are being updated/upgraded via VUM, in most occasions the hosts will do a rolling reboot as part of the VUM process. With vSAN versions 6.7 and prior, rolling reboots of hosts via VUM were allowed, irrelevant of the state of the connection with KMS, and the availability of keys. As already described, these keys are necessary in order to properly mount the drives on each host during a reboot.

In vSAN 6.7 Update 1, VMware has added guard rails to prevent disks of multiple hosts from unmounting due to lack of connectivity with KMS, or accidental key deletion. During an upgrade operation, VUM will place a host in Enhanced Maintenance Mode (EMM), perform updates, reboot, and exit EMM. If after a reboot, the host is not able to reach crypto-safe mode, the host will not exit EMM – stalling the VUM progress. In this case, the host’s drives are not mounted due to it not being able to reach the crypto-safe mode, if we allow the upgrade to continue, all other hosts will upgrade, but all the drives within the vSAN datastore will be unmounted.

This new guard rail, helps prevent losing all vSAN storage due to connectivity issues, or accidental changes with KMS, and key availability. This feature also highlights the benefits of having a HCI solution embedded in the kernel, the ease of orchestration with other vSphere components, and features makes vSAN even more appealing.

Considerations when Enabling vSAN Encryption

In previous posts, I talked about vSAN Encryption architecture, and how to enable such feature. However, there are a couple of considerations aside from the requirements that should be taken into account prior to enabling vSAN Encryption.

BIOS Settings:

With most deployments, whether it is vSphere, or vSAN; I’ve noticed that BIOS settings are often overlook, even though they can help increase performance with a simple change. One of those settings is AES-NI. AES-NI was proposed by Intel some time back, and it is essentially a set of [new] instructions (NI), for the Advanced Encryption Standard (AES); hence the acronym AES-NI. What AES-NI does, is provide hardware acceleration to applications using AES for encryption, and decryption.

Most modern CPUs (Intel & AMD), support AES-NI, and some BIOS configurations from certain hardware vendors already have AES-NI enabled by default. When considering vSAN Encryption, it is imperative to make sure that AES-NI has been enabled in the BIOS, in order to take advantage of such offloading of instructions to the CPU as well as strengthening, and accelerating the execution of AES applications.

Failure to enable AES-NI while Encryption is enabled, may result in a dramatic cpu utilization increase. In recent versions of vSAN, the Health Check UI detects, and alerts when AES-NI has not been enabled. If the BIOS does not have the option to enable AES-NI, it is most likely that the feature is always enabled.

Note: This also applies to VM encryption.

 

Available Space

The other consideration is available space. My previous posts talk about data migration occurring if vSAN Encryption was enabled after data has been moved into the vSAN Datastore, due to the disk format task necessary. Although vSAN Encryption does not incur a space overhead for its operation, it is important to keep in mind that there needs to be enough available space to be able to evacuate an entire disk group during the configuration process.

 

vSAN 6.6 Encryption Configuration

New on vSAN 6.6, vSAN native encryption for data at rest is now available. This feature does not require self-encrypting drives (SEDs). Encryption is supported on both all-flash and hybrid configurations of vSAN, and it is done at the datastore level.

It is important to note that data is encrypted during the de-staging process, which means that all other vSAN features are fully supported, such as deduplication and compression, among others.

Given the multitude of KMS vendors, the setup and configuration of KMS is not part of this document, and it is a pre-requisite prior to enabling encryption on vSAN datastore.

Requirements for vSAN Encryption:

  • Deploy KMS cluster/server of your choice
  • Add/trust KMS server to vCenter UI
  • vSAN encryption requires on-disk format (ODF) version 5
    • You can upgrade this via Web Client
    • or if you enable Encryption or Deduplication and Compression on an existing vSAN cluster, the ODF gets upgraded to the latest version automatically.
  • When vSAN encryption is enabled all disks are reformatted
    • This is achieved in a rolling manner

 

Initial configuration is done in the VMware vCenter Server user interface of the vSphere Web Client. The KMS cluster is added to vCenter Server and a trust relationship is established. The process for doing this is vendor-specific. Consult your KMS vendor documentation prior to adding the KMS cluster to vCenter.

To add the KMS cluster to vCenter in the vSphere Web Client, click on the vCenter server, click on “Configure” tab, “Key Management Servers”, and click “add KMS”. Enter the information for your specific KMS cluster/server.

 

Once the KMS cluster/server has been added, you will need to establish trust with the KMS server. Follow the instructions from your KMS vendor as they differ from vendor to vendor.

 

After the KMS has been configured, you will see that the connections status and the certificate have green checks, meaning we are ready to move forward.

 

Now, we need to verify that all of the disks in the cluster are on version 5 for on-disk format prior to enabling vSAN encryption, since version 5 is a requirement.

 

 

At this point we are ready to turn encryption on, since we have completed the first three steps.

  • Deploy KMS cluster/server of your choice
  • Add/trust KMS server to vCenter UI
  • vSAN encryption requires on-disk format version 5
  • When vSAN encryption is enabled all disks are reformatted

 

To enable vSAN encryption, click on the vSAN cluster, “Configure” tab, and “General” under the vSAN section, and click “edit”. Here we have the option to erase the disk before use. This will increase the time it will take to do the rolling format of the devices, but it will provide better protection.

 

After you click ok, vSAN will remove one Disk Group at a time, format each device, and recreate the Disk Group once the format completed. It will then move on to the next Disk Group until all Disk Groups are recreated, and all devices formatted. During this period, data will be evacuated from the Disk Groups, so you will see components resyncing.

 

Note: This process can take quite some time depending on the amount of data that needs to be migrated during the rolling reformat, so please plan accordingly.

 

Once vSAN encryption is enabled, you are able to disable encryption; however, the same procedure is needed as far as reformatting all the drives in a rolling manner.

 

New Key Generation

You also have the capability of generating new keys for encryption. There are 2 modes for rekeying. One of them is a high level rekey where the data encryption key is wrapped by a new key encryption key. The other level is a complete re-encryption of all data. This second rekey (deep rekey) may take significant time to complete as all the data will have to be re-written, and may decrease performance.

 

 

Summary of expected behaviors:

  • Enabling vSAN Encryption requires disk reformat with object resyncs.
  • You don’t have to erase all the disks first prior to using native encryption unless you want to reduce the possibility of data leakage and have a decreased attack vector. However, this will result in additional time required to erase disks, reformat drives, and enable encryption.
  • Enabling vSAN Deduplication and Compression still requires disk reformat with object resyncs whether the Disk Group is encrypted or not.
  • Disabling any of the aforementioned features requires another reformat of the devices along with object resyncs.

What’s new on vSAN 6.6

Today, one of the largest vSAN releases was announced. This release comes packed with new features, enhancements, and a lot of improvements; making vSAN 6.6 easier to deploy with enhanced performance, and a more complete HCI platform.

What’s New with vSAN 6.6?

Native Encryption 

Encryption is one of the main features for this release. This is a software solution rather than just using self encrypted devices (SEDs), which are not needed by the way. Any HCI can add SEDs and call their solution encryption ready, but vSAN goes a step further and provides software encryption for data at rest.

 

vSAN Configuration Assist 

The vSAN configuration assist allows customer to check hardware compatibility, conduct burn-in tests, check network and vSAN configurations, as well as getting recommendation for optimal cluster configuration based on current status. For example, the configuration assist will check to make sure all vSAN vmknics are configured properly, as well as recommending upgrading on-dik format to the latest versions. Such recommendations will allow for a configuration that follows vSAN best practices.

 

Hardware Lifecycle Management

This feature allows customers to be able to update outdated controller firmware and driver version for example. In such case the outdated hardware will be identified and you will have the option to download and install the latest version directly from the vSphere Web Client. This feature removes the need for vendor-specific tools as it provides an orchestrated hardware lifecycle management across the vSAN cluster.

 

Host Client vSAN visibility

Although vSAN is not heavily dependent on vCenter, in the event that vCenter is not available we lose some visibility from the UI perspective. On vSAN 6.6, the HTML5 Host Client now has visibility and capability of doing health checks not only for the host itself but also for the entire cluster.  Alternatively you can use “esxcli vsan” commands for additional tasks. Such commands have been expanded to keep up with the new features.

 

Web Client Health and Performance Monitoring 

The vSAN health function has now significantly more checks to aid in proper configuration and troubleshooting. Monitoring and alerts have also been added for the new features such as physical disk health, networking, etc. On the performance diagnostics side,  you are now able to query throughput, latency, and IOPs among others.

 

Host Evacuation Pre-checks 

Built into maintenance mode operation and disk/disk group removal, the pre-check allows for lower operational overhead, and reduces risk by helping ensure proper capacity remains after a host evacuation. The pre-check will show if there is sufficient capacity for data movement and how much data will be moved. I really like this feature as it gives visibility to the “What-if” for each option of maintenance mode.

 

Easy Deployment 

The new VCSA is now capable to deploy a vSAN cluster on a single node and place the VCSA appliance on the vSAN datastore. This eliminates the need for external storage, forgoing to claim disks, or bootstrap scripts. This makes greenfield deployments quick and easy for vSAN clusters.

 

Multicast Dependency REMOVED 

Yes! Another big step here. The need for multicast is no longer required. In fact, once you upgrade your vCenter and hosts to version 6.6 the networking mode is automatically changed to unicast.

Proactive Drive HA 

vSAN 6.6 intelligently predicts device failure and proactively move data out of the failing device before it actually fails and cause a Permanent Device Loss action.

 

 

Other Great Additions:

  • vRealize Management Pack for vSAN
  • Easier replacement of witness host on stretched-clusters
  • vSAN API and PowerCLI enhancements
  • Local Failure Protections for Stretched Clusters through Primary and Secondary FTTs
  • Stretched Cluster Site Affinity
  • Deduplication and Compression Performance Enhancements
  • Checksum optimization
  • Rebuild & Resync Enhancements (Partial Rebuilds)
  • Proactive and more aggressive de-staging

 

I’ll be writing a few more blogs about the new features. Stay tuned.