Skip to content

Commit 8f8f6ca

Browse files
Jenny-AnneJenny-Anne
authored
MTV-3397-Enabling nbde vmware (#779)
* enabling nbde vmware * edits * code snippet formatting * concept and procedure * concept * procedure * cr snippet * nbde and luks updates * NBDE updates
1 parent 6c82b0d commit 8f8f6ca

File tree

3 files changed

+95
-7
lines changed

3 files changed

+95
-7
lines changed

‎documentation/doc-Planning_your_migration/assemblies/assembly_planning-migration-vmware.adoc‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ ifdef::context[:parent-context: {context}]
1313

1414
You prepare and create your VMware vSphere migration plan by performing the following high-level steps in the MTV UI:
1515

16-
- Create ownerless network maps
17-
- Add a VMware vSphere source provider
18-
- Select a migration network for a VMware source provider
19-
- Add an OpenShift Virtualization destination provider
20-
- Select a migration network for an OpenShift Virtualization provider
21-
- Create a VMware vSphere migration plan
16+
- Create ownerless network maps.
17+
- Add a VMware vSphere source provider.
18+
- Select a migration network for a VMware source provider.
19+
- Add an OpenShift Virtualization destination provider.
20+
- Select a migration network for an OpenShift Virtualization provider.
21+
- Create a VMware vSphere migration plan.
2222

2323
:context: vmware
2424
:vmware:
@@ -47,9 +47,12 @@ include::../modules/selecting-migration-network-for-virt-provider.adoc[leveloffs
4747

4848
include::../modules/creating-plan-wizard-vmware.adoc[leveloffset=+1]
4949

50-
5150
:!vmware:
5251

52+
include::../modules/con_migration-of-luks-encrypted-disks.adoc[leveloffset=+1]
53+
54+
include::../modules/proc_enabling-nbde-with-clevis.adoc[leveloffset=+1]
55+
5356
ifdef::parent-context[:context: {parent-context}]
5457
ifndef::parent-context[:!context:]
5558

‎documentation/modules/con_migration-of-luks-encrypted-disks.adoc‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Module included in the following assemblies:
2+
//
3+
// assembly_planning-migration-vmware.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="con_migration-of-luks-encrypted-disks_{context}"]
7+
8+
= Migration of LUKS-encrypted disks
9+
10+
[role="_abstract"]
11+
If you have virtual machines (VMs) with LUKS-encrypted disks in your source VMware VSphere environment, you can migrate them to Red Hat {virt} by enabling Network-Bound Disk Encryption (NBDE) with Clevis. Alternatively, you can manually add passwords for LUKS-encrypted devices in your migration plan.
12+
13+
If you enable NBDE, passwords are retrieved from the Clevis server. When you manually add LUKS passwords to your migration plan, you provide the list of passwords, and you cannot use NBDE to retrieve them. The two methods for migrating LUKS-encrypted disks are incompatible. You must use either NBDE or manual LUKS passwords to migrate LUKS-encrypted disks.
14+
15+
MTV transfers the data of VMs with LUKS-encrypted disks from the source environment to the target {virt} cluster. MTV reads only the blocks that are required for guest conversion, decrypting the required blocks and re-encrypting them locally with the same key.
16+
17+
Clevis is a client-side framework that automates the decryption of LUKS volumes by binding a LUKS key slot to a policy. During the migration of VMs with LUKS-encrypted disks, MTV authenticates with the configured network service by requesting the key to unlock the LUKS-encrypted disk from the Tang server. The automatic retrieval of the key allows the VM to boot without a manual passphrase entry from an administrator.
18+
19+
Benefits of NBDE::
20+
21+
* *Automation:* Eliminates the need to enter keys manually during migration.
22+
* *Enhanced security:* Maintains the security of VMs throughout their migration lifecycle by preserving LUKS encryption from the source to the destination.
23+
* *Seamless operation:* Ensures that VMs with encrypted disks can be brought online in the new OpenShift Virtualization environment with minimal interruption.
24+
25+

‎documentation/modules/proc_enabling-nbde-with-clevis.adoc‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
// Module included in the following assemblies:
2+
//
3+
// assembly_planning-migration-vmware.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="proc_enabling-nbde-with-clevis_{context}"]
7+
8+
= Enabling Network-Bound Disk Encryption with Clevis
9+
10+
[role="_abstract"]
11+
When you enable Network-Bound Disk Encryption (NBDE) with Clevis, the Tang server manages the keys for Linux Unified Key Setup (LUKS)-encrypted disks during a migration. If you do not use NBDE to migrate LUKS-encrypted disks from your source environment, you can manually add passwords for LUKS-encrypted devices instead. You must use either NBDE or manual LUKS passwords to migrate LUKS-encrypted disks.
12+
13+
You can enable NBDE with Clevis either in the MTV UI or in the YAML file for your migration plan:
14+
15+
* In the MTV UI, you must select either NBDE with Clevis or LUKS passphrases. You can have only one encryption type, and you apply the setting to all VMs in your migration plan.
16+
* In the YAML file for your migration plan, you can combine encryption types and apply the setting to selected VMs in the YAML file.
17+
18+
.Prerequisites
19+
* The Tang server is accessible from your OpenShift cluster and from the migration network.
20+
* You have a LUKS key slot bound to the Tang server policy.
21+
+
22+
NOTE: For MTV to access the keys from the Tang server, the keys must be on a different subnet range than a user-defined network (UDN).
23+
24+
.Procedure
25+
. Enable NBDE with Clevis in the MTV UI.
26+
.. In the Create migration plan wizard, navigate to *Other settings* under *Additional setup* in the left navigation pane.
27+
.. Select *Use NBDE/Clevis*.
28+
+
29+
If you are not using NBDE with Clevis, you add passphrases for LUKS-encrypted devices so that the Tang servers can decrypt the disks during a migration.
30+
.. Click *Next*, and verify that *Use NBDE/Clevis* shows as *Enabled* under *Other settings (optional)*.
31+
.. When you create your migration plan, click *Migration plans* in the left navigation menu, and open the *Plan Details* page for your migration plan.
32+
.. Click the *Edit* icon for *Disk decryption* under *Plan settings*.
33+
.. Verify that *Use network-bound disk encryption (NBDE/Clevis)* is selected.
34+
+
35+
If you are not using NBDE with Clevis, verify that the passphrases for LUKS-encrypted devices are added.
36+
37+
. Enable NBDE with Clevis in the YAML file.
38+
.. Click *Migration plans* in the left navigation menu and open the *Plan Details* page for your migration plan.
39+
.. Click the *YAML* tab to open the `Plan` custom resource (CR) for your migration plan.
40+
.. For each VM under `vms` in the YAML file, enter the encryption type. In this example, you set `nbdeClevis` as the encryption type for `vm-1`, LUKS passphrase as the encryption type for `vm-2`, and no encryption type for `vm-3`:
41+
+
42+
Example:
43+
+
44+
----
45+
vms:
46+
- id: vm-1
47+
name: vm-1-esx8.0-rhel8.10-raid1
48+
targetPowerState: on
49+
nbdeClevis: true
50+
- id: vm-2
51+
name: vm-2-esx8.0-rhel8.10-raid1
52+
luks: { name: 'test-secret-1' }
53+
- id: vm-3
54+
name: vm-3-esx8.0-rhel8.10-raid1
55+
----
56+
57+
.Troubleshooting
58+
* For information about LUKS or Clevis configuration on the source VM, see link:https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html-single/security_hardening/index#configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening[Configuring automated unlocking of encrypted volumes by using policy-based decryption] in the RHEL _Security hardening_ guide.
59+
60+

0 commit comments

Comments
 (0)