For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt, and this page is available as Markdown at https://docs.us.ovhcloud.com/en/hosted-private-cloud/vmware/vm-encrypt-vnkp.md.
  • English

vNKP - Enabling virtual machine encryption

View as Markdown

This guide aims to explain the implementation details of vSphere Native Key Provider and then perform a virtual machine encryption in the OVHcloud Hosted Private Cloud powered by VMware solution.

Warning

NOTE: OVHcloud provides services for which you are responsible for their configuration and management. You are therefore responsible for their proper functioning.

This tutorial is designed to help you as much as possible with common tasks. If you are having difficulty performing these actions, please contact a specialized service provider. OVHcloud cannot provide you with technical support in this regard.

 

Requirements

  • A VMware on OVHcloud solution in your OVHcloud account
  • Access to the vSphere management interface
  • vSphere and hosts version 7.0 Update 2 or higher
  • The Zerto replication solution is not currently compatible with encryption. This means that encrypted VMs cannot be replicated.

OVHcloud Control Panel Access

  • Direct link: VMware vSphere
  • Navigation path: Hosted Private Cloud > Managed VMware vSphere > Select your vSphere service

 

Introduction

vSphere Native Key provider allows you to encrypt virtual machines, enable vTPM in virtual machines, or enable data-at-rest encryption on vSAN, without the need for an external KMS (Key Management Server).

You can export the vSphere Native Key provider key and import it again on another cluster.

In detail, when encrypting a virtual machine, the ESXi host generates a DEK key, which will be used to encrypt the virtual machine's files and its data. The DEK key is encrypted using the key generated by vSphere Native Key provider. This encrypted DEK is stored with the virtual machine. You can find more details about VMware encryption by referring to the official documentation in the Go further section of the guide.

 

Instructions

Content Overview:

Warning

NOTE: Your VMware on OVHcloud cluster may not be in Version 7.0 Update 2. If so, please contact support to upgrade your infrastructure.

Authorizing a user to administer encryption on a Hosted Private Cloud cluster powered by VMware

Once you have chosen your cluster, go to the Users tab, click the more options ... button to the right of your user, and select Edit.

In the pop-up, toggle the Encryption Management switch and click Confirm.

VMware users tab edit user encryption

Info

It may take several minutes for the update to process. When complete, you will see a green banner at the top of the screen and Yes in the Encryption management column for that user.

 

Creating a vSphere Native Key Provider

We will create the encryption key vSphere Native Key Provider. This key can be used to encrypt files on a virtual machine. If you want to add a virtual device vTPM, it is mandatory to encrypt the VM.

Log in to the vSphere interface. If you need help with this, please refer to our Log in to the vSphere web interface guide.

Click on the root of the cluster in the top left-hand corner, then click on the Configure tab and choose Key Providers.

Click the ADD button and choose Add Native Key Provider from the menu.

Host configure nkp

In the pop-up, type a name in Name.

Warning

NOTE: If your Private Cloud solution is older than Premier VMware on OVHcloud, untick the Use key provider only with TPM protected ESXi hosts (recommended) box.

Click ADD KEY PROVIDER.

Click the BACK-UP button on the left to back up the key outside the cluster.

Native key - VM encrypt vnkp - step 9

Select the checkbox on the left to password-protect the backup.

Native key - VM encrypt vnkp - step 10

Type a password and confirm it. Then select the I have saved the password in a secure place box and click BACK UP KEY PROVIDER.

Native key - VM encrypt vnkp - step 11

The key can now be used to encrypt virtual machines.

Native key - VM encrypt vnkp - step 12

 

Encrypting a virtual machine

We will encrypt a virtual machine and its data.

Warning

NOTE: Encryption of a virtual machine can only be performed when the virtual machine is turned off.

Right-click on the virtual machine and from the VM Policies menu choose Edit VM Storage Policies.

Native key - VM encrypt vnkp - step 13

From the VM Storage Policies drop-down menu, choose VM Encryption Policy and click OK.

Native key - VM encrypt vnkp - step 14

In the virtual machine properties, click the Summary tab. You will see a padlock followed by the text Encrypted with a native key provider indicating that the VM is encrypted.

Native key - VM encrypt vnkp - step 15

 

Migrating an existing encryption solution to vSphere Native Key provider

Some OVHcloud customers use an encryption solution with external KMS keys. Encryption can be migrated to vSphere Native Key Provider.

Follow the instructions below to migrate an encrypted virtual machine with a key generated by an external KMS named cluster to a vSphere Native Key Provider key named MY-NKP.

In the vSphere console for your cluster.

  1. Click on the cluster root in the top left-hand corner.
  2. Go to the top in the Configure tab.
  3. Click Key Providers in the vertical bar.
  4. Select the vSphere Native Key provider key.
  5. Click SET AS DEFAULT.

Native key - VM encrypt vnkp - step 16

Confirm your choice by clicking SET AS DEFAULT.

Native key - VM encrypt vnkp - step 17

The vSphere Native Key Provider key is then set by default.

Native key - VM encrypt vnkp - step 18

Click the virtual machine and go to the Summary tab. This virtual machine uses the standard key provider. We will change the encryption of this virtual machine.

Native key - VM encrypt vnkp - step 19

In the vSphere client, right-click on the virtual machine that needs to be encrypted again. In the VM Policies menu entry, choose Re-encrypt.

Info

The operation related to the new encryption can be done with the virtual machine turned on because only the DEK key is encrypted again.

Native key - VM encrypt vnkp - step 20

The new encryption takes a few milliseconds because the operation performed is only a renewal of the encryption of the DEK key. This key is now encrypted using the new vSphere Native Key Provider key.

Native key - VM encrypt vnkp - step 21

Click the virtual machine on which the encryption has been changed and go to the Summary tab. You can see that encryption uses a native key provider next to the padlock.

Native key - VM encrypt vnkp - step 22

 

Encrypting a Datastore of a vSAN cluster

You can encrypt the Datastore of a vSAN cluster instead of the virtual machines.

Through your vSphere interface, go to your vSAN cluster on the right, select the Configure tab, scroll to Data Services, and click EDIT.

Native key - VM encrypt vnkp - step 23

Enable Data-At-Rest encryption, check Wipe residual Data, choose your Key Provider, and click APPLY.

Info

A warning will inform you that a performance problem may occur when you enable these settings. Please ignore it.

Native key - VM encrypt vnkp - step 24

Go back to Data Services, and you will see that Data encryption at rest is enabled with your key.

Native key - VM encrypt vnkp - step 25

 

Go further

Browse all the VMware on OVHcloud guides.

Browse the rest of the OVHcloud US documentation for guides on our other products and services.

Learn more about VMware on OVHcloud on the OVHcloud US website.