Chapter 4. Configure encryption with Transport Layer Security (TLS/SSL)

Transport Layer Security (TLS/SSL) can be used to encrypt management and storage layer communications between nodes. This helps ensure that your data remains private.

Encryption can be configured using either self-signed certificates or certificates signed by a Certificate Authority.

This document assumes that you want to enable encryption on an existing deployment. However, encryption can also be configured as part of the deployment process. See Deploying Red Hat Hyperconverged Infrastructure for Virtualization for details: https://access.redhat.com/documentation/en-us/red_hat_hyperconverged_infrastructure_for_virtualization/1.7/html/deploying_red_hat_hyperconverged_infrastructure_for_virtualization/.

4.1. Configuring TLS/SSL using self-signed certificates

Important

Enabling or disabling encryption is a disruptive process that requires virtual machines and the Hosted Engine to be shut down.

  1. Shut down all virtual machines

    See Shutting Down a Virtual Machine in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html/virtual_machine_management_guide/chap-administrative_tasks.

  2. Move all storage domains except the hosted engine storage domain into Maintenance mode

    See Moving Storage Domains to Maintenance Mode in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html/administration_guide/sect-storage_tasks.

  3. Move the hosted engine into global maintenance mode

    Run the following command on the hyperconverged host that hosts the hosted engine: 

    # hosted-engine --set-maintenance --mode=global

  4. Shut down the hosted engine virtual machine

    Run the following command on the hyperconverged host that hosts the hosted engine: 

    # hosted-engine --vm-shutdown

    Verify that the hosted engine has shut down by running the following command: 

     # hosted-engine --vm-status

  5. Stop all high availability services

    Run the following command on all hyperconverged hosts: 

    # systemctl stop ovirt-ha-agent
# systemctl stop ovirt-ha-broker

  6. Unmount the hosted engine storage domain from all hyperconverged hosts 

    # hosted-engine --disconnect-storage

  7. Verify that all volumes are unmounted

    On each hyperconverged host, verify that all gluster volumes are no longer mounted. 

    # mount

  8. Prepare self-signed certificates

    Follow Procedure 23.1. Preparing a self-signed certificate in the Red Hat Gluster Storage Administration Guide: Preparing Certificates.

  9. Stop all volumes 

    # gluster v stop <VolumeName>

  10. Restart glusterd on all nodes 

    # systemctl restart glusterd

  11. Enable TLS/SSL encryption on all volumes 

    # gluster volume set <volname> client.ssl on
# gluster volume set <volname> server.ssl on

  12. Specify access permissions on all hosts 

    # gluster volume set <volname> auth.ssl-allow "host1,host2,host3"

  13. Start all volumes 

    # gluster v start <VolumeName>

  14. Verify that no TLS/SSL errors occurred

    Check the /var/log/glusterfs/glusterd.log file on each physical machine to ensure that no TLS/SSL related errors occurred, and setup completed successfully.

  15. Start all high availability services

    Run the following commands on all hyperconverged hosts: 

    # systemctl start ovirt-ha-agent
# systemctl start ovirt-ha-broker

  16. Move the hosted engine out of Global Maintenance mode 

    # hosted-engine --set-maintenance --mode=none

    The hosted engine starts automatically after a short wait.

  17. Wait for nodes to synchronize

    Run the following command on the first hyperconverged host to check synchronization status. If engine status is listed as unknown stale-data, synchronization requires several more minutes to complete.

    The following output indicates completed synchronization. 

    # hosted-engine --vm-status | grep 'Engine status'
Engine status   : {"health": "good", "vm": "up", "detail": "up"}
Engine status   : {"reason": "vm not running on this host",
  "health": "bad", "vm": "down", "detail": "unknown"}
Engine status   : {"reason": "vm not running on this host",
  "health": "bad", "vm": "down", "detail": "unknown"}

  18. Activate all storage domains

    Activate the master storage domain first, followed by all other storage domains.

    For details on activating storage domains, see Activating Storage Domains from Maintenance Mode in the Red Hat Virtualization documentation: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html/administration_guide/sect-storage_tasks.

  19. Start all virtual machines

    See Starting a Virtual Machine in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html/virtual_machine_management_guide/sect-starting_the_virtual_machine.

4.2. Configuring TLS/SSL using Certificate Authority signed certificates

Important

Enabling or disabling encryption is a disruptive process that requires virtual machines and the Hosted Engine to be shut down.

Important

Ensure that you have appropriate certificates signed by a Certificate Authority before proceeding. Obtaining certificates is outside the scope of this document, but further details are available in the Red Hat Gluster Storage Administration Guide: https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.5/html/administration_guide/chap-network_encryption#chap-Network_Encryption-Prereqs.

  1. Shut down all virtual machines

    See Shutting Down a Virtual Machine in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html/virtual_machine_management_guide/chap-administrative_tasks.

  2. Move all storage domains except the hosted engine storage domain into Maintenance mode

    See Moving Storage Domains to Maintenance Mode in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html/administration_guide/sect-storage_tasks.

  3. Move the hosted engine into global maintenance mode

    Run the following command on the hyperconverged host that hosts the hosted engine: 

    # hosted-engine --set-maintenance --mode=global

  4. Shut down the hosted engine virtual machine

    Run the following command on the hyperconverged host that hosts the hosted engine: 

    # hosted-engine --vm-shutdown

    Verify that the hosted engine has shut down by running the following command: 

     # hosted-engine --vm-status

  5. Stop all high availability services

    Run the following command on all hyperconverged hosts: 

    # systemctl stop ovirt-ha-agent
# systemctl stop ovirt-ha-broker

  6. Unmount the hosted engine storage domain from all hyperconverged hosts 

    # hosted-engine --disconnect-storage

  7. Verify that all volumes are unmounted

    On each hyperconverged host, verify that all gluster volumes are no longer mounted. 

    # mount

  8. Configure Certificate Authority signed encryption

    Important

    Ensure that you have appropriate certificates signed by a Certificate Authority before proceeding. Obtaining certificates is outside the scope of this document.

    1. Place certificates in the following locations on all nodes.

      /etc/ssl/glusterfs.key
      The node’s private key.
      /etc/ssl/glusterfs.pem
      The certificate signed by the Certificate Authority, which becomes the node’s certificate.
      /etc/ssl/glusterfs.ca
      The Certificate Authority’s certificate.

    2. Stop all volumes 

      # gluster v stop <VolumeName>

    3. Restart glusterd on all nodes 

      # systemctl restart glusterd

    4. Enable TLS/SSL encryption on all volumes 

      # gluster volume set <volname> client.ssl on
# gluster volume set <volname> server.ssl on

    5. Specify access permissions on all hosts 

      # gluster volume set <volname> auth.ssl-allow "host1,host2,host3"

    6. Start all volumes 

      # gluster v start <VolumeName>

  9. Verify that no TLS/SSL errors occurred

    Check the /var/log/glusterfs/glusterd.log file on each physical machine to ensure that no TLS/SSL related errors occurred, and setup completed successfully.

  10. Start all high availability services

    Run the following commands on all hyperconverged hosts: 

    # systemctl start ovirt-ha-agent
# systemctl start ovirt-ha-broker

  11. Move the hosted engine out of Global Maintenance mode 

    # hosted-engine --set-maintenance --mode=none

    The hosted engine starts automatically after a short wait.

  12. Wait for nodes to synchronize

    Run the following command on the first hyperconverged host to check synchronization status. If engine status is listed as unknown stale-data, synchronization requires several more minutes to complete.

    The following output indicates completed synchronization. 

    # hosted-engine --vm-status | grep 'Engine status'
Engine status   : {"health": "good", "vm": "up", "detail": "up"}
Engine status   : {"reason": "vm not running on this host",
  "health": "bad", "vm": "down", "detail": "unknown"}
Engine status   : {"reason": "vm not running on this host",
  "health": "bad", "vm": "down", "detail": "unknown"}

  13. Activate all storage domains

    Activate the master storage domain first, followed by all other storage domains.

    For details on activating storage domains, see Activating Storage Domains from Maintenance Mode in the Red Hat Virtualization documentation: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html/administration_guide/sect-storage_tasks.

  14. Start all virtual machines

    See Starting a Virtual Machine in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html/virtual_machine_management_guide/sect-starting_the_virtual_machine.