{"id":727,"date":"2023-03-21T23:16:23","date_gmt":"2023-03-21T22:16:23","guid":{"rendered":"https:\/\/kdslabs.fr\/?p=727"},"modified":"2023-04-13T11:40:07","modified_gmt":"2023-04-13T09:40:07","slug":"article-vcenter-part-2-migration-du-native-key-provider-nkp-vers-un-kms-externe","status":"publish","type":"post","link":"https:\/\/kdslabs.fr\/index.php\/2023\/03\/21\/article-vcenter-part-2-migration-du-native-key-provider-nkp-vers-un-kms-externe\/","title":{"rendered":"[ARTICLE] [VCENTER] [PART 2] Migration du Native Key Provider (NKP) vers un KMS Externe"},"content":{"rendered":"\n<h4 class=\"wp-block-heading has-colibri-color-1-color has-text-color\" style=\"font-size:16px\">[ARTICLE] [VCENTER] [PART 2] Migration du Native Key Provider (NKP) vers un KMS Externe<\/h4>\n\n\n\n<p style=\"font-size:14px\">Sur l&#8217;article pr\u00e9c\u00e9dent nous avons vu comment migrer nos workloads d&#8217;un NKP vers un KMS Externe et inversement, mais nous n&#8217;avons pas pris en compte les \u00e9ventuels probl\u00e8mes que nous pouvons rencontrer en PROD, o\u00f9 le moindre arr\u00eat d&#8217;un workload peut \u00eatre critique.<\/p>\n\n\n\n<h4 class=\"wp-block-heading has-colibri-color-1-color has-text-color\" style=\"font-size:16px\"><span style=\"text-decoration: underline\" class=\"underline\">Migration failed =&gt; Workload KO<\/span><\/h4>\n\n\n\n<p style=\"font-size:14px\">Apr\u00e8s la migration des workloads du NKP vers le KMS Externe via le script:<\/p>\n\n\n\n<pre class=\"wp-block-code\" style=\"font-size:14px\"><code>Get-VM \"votreVM\"| Set-VMEncryptionKey -KMSClusterId \"votreKMS\"<\/code><\/pre>\n\n\n\n<p style=\"font-size:14px\">Il se peut que certaines VMs tombent en \u00e9chec lors d&#8217;un re-key, et surtout si celle-ci a plusieurs disques.<br>Cela peut \u00eatre visible directement sur le vCenter ou sur votre script si vous jamais avez inclus un test d&#8217;\u00e9tat OK\/NOK avant de passer \u00e0 la VM suivante.<\/p>\n\n\n\n<h4 class=\"wp-block-heading has-colibri-color-1-color has-text-color\" style=\"font-size:14px\"><span style=\"text-decoration: underline\" class=\"underline\">Les causes possibles (confirm\u00e9 avec des tests, et valid\u00e9 par le support VMware):<\/span><\/h4>\n\n\n\n<ul class=\"wp-block-list\" style=\"font-size:14px\">\n<li><span style=\"text-decoration: underline\" class=\"underline\">vSphere HA VM Monitoring :<\/span> Lors d&#8217;un re-key si la VM prend du temps \u00e0 se chiffrer le vCenter n&#8217;a pas la corr\u00e9lation avec la t\u00e2che en cours qui chiffre la VM, ce qui a pour cons\u00e9quence un reset de la VM entrainant un \u00e9chec de re-key\n<ul class=\"wp-block-list\">\n<li>C&#8217;est pour cela qu&#8217;il est important de v\u00e9rifier chaque workload 1 par 1 apr\u00e8s sa migration (logs vCenter, requ\u00eate PowerCLI (Get-VMEncryptioninfo)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p style=\"font-size:14px\">Message d&#8217;erreur de la VM sur &#8220;<strong>vmware.log<\/strong>&#8220;: <\/p>\n\n\n\n<pre class=\"wp-block-code\" style=\"font-size:14px\"><code>2023-03-10T15:16:22.314Z In(05) vmx - DISKLIB-LINK : \"\/vmfs\/volumes\/vsan:xxxxxxxxx-5exxxxxxx6\/271xxxxxx3-xxac-xx91-xxa0-exxxxxxxx80\/TEST-KEVIN-VM-2-lKPs.vmdk\" : failed to open (Cannot decrypt disk because key or password is incorrect).<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\" style=\"font-size:14px\">\n<li>Le vCenter ne trouve pas le KMS Externe suite \u00e0 un probl\u00e8me de communication entre les deux<\/li>\n<\/ul>\n\n\n\n<p style=\"font-size:14px\">Message d&#8217;erreur du vCenter sur &#8220;<strong>hostd.log<\/strong>&#8220;:<\/p>\n\n\n\n<pre class=\"wp-block-code\" style=\"font-size:14px\"><code>--&gt;    com.vmware.esx.trusted_infrastructure.kms.providers.not_found&lt;The provider 'nom-du-kms-externe' does not exist.&gt;<\/code><\/pre>\n\n\n\n<p style=\"font-size:14px\">R\u00e9ponse du Support VMware sur l&#8217;ordre de chiffrement d&#8217;une VM:<\/p>\n\n\n\n<pre class=\"wp-block-code\" style=\"font-size:14px\"><code>- got new key from key provider -&gt;\n- save new key to keycache -&gt;\n- get old key from old keyprovider -&gt;\n- decrypt kdk with old key-&gt;\n- use new key to encrypt kdk<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading has-colibri-color-1-color has-text-color\" style=\"font-size:14px\"><span style=\"text-decoration: underline\" class=\"underline\">Workaround 1: Unregister \/ Register VM<\/span><\/h4>\n\n\n\n<p style=\"font-size:14px\">Ce premier workaround permet de reset le vmid de la VM et donc de forcer l&#8217;ESXi \u00e0 demander la KEK au KMS via la KEK ID<\/p>\n\n\n\n<pre class=\"wp-block-code\" style=\"font-size:14px\"><code><strong>Note de VMware: How vSphere Virtual Machine Encryption Protects Your Environment<\/strong>\nIf you delete or unregister an encrypted virtual machine, the ESXi host and the cluster remove the KEK from cache. The ESXi host can no longer use the KEK. This behavior is the same for standard key providers and trusted key providers. <\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\" style=\"font-size:14px\">\n<li>Remove from inventory<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/Remove-from-inventory-1-621x1024.png\" alt=\"\" class=\"wp-image-739\" width=\"203\" height=\"334\" srcset=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/Remove-from-inventory-1-621x1024.png 621w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/Remove-from-inventory-1-182x300.png 182w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/Remove-from-inventory-1-768x1265.png 768w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/Remove-from-inventory-1.png 860w\" sizes=\"auto, (max-width: 203px) 100vw, 203px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\" style=\"font-size:14px\">\n<li>V\u00e9rification des fichiers sur le datastore<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/VM-File-after-unregister-1024x397.png\" alt=\"\" class=\"wp-image-740\" width=\"523\" height=\"202\" srcset=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/VM-File-after-unregister-1024x397.png 1024w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/VM-File-after-unregister-300x116.png 300w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/VM-File-after-unregister-768x298.png 768w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/VM-File-after-unregister-1536x595.png 1536w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/VM-File-after-unregister-2048x794.png 2048w\" sizes=\"auto, (max-width: 523px) 100vw, 523px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\" style=\"font-size:14px\">\n<li>Register VM<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/register-VM-1024x428.png\" alt=\"\" class=\"wp-image-741\" width=\"589\" height=\"246\" srcset=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/register-VM-1024x428.png 1024w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/register-VM-300x125.png 300w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/register-VM-768x321.png 768w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/register-VM-1536x642.png 1536w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/register-VM.png 1920w\" sizes=\"auto, (max-width: 589px) 100vw, 589px\" \/><\/figure>\n\n\n\n<p style=\"font-size:14px\">L&#8217;effet de bord de cette action est la perte d&#8217;historiques de la VM c\u00f4t\u00e9 vCenter\/vRops (performances, events, tasks). Cependant les fichiers &#8220;vmware.log&#8221; existent toujours \u00e0 la racine de la VM dans le datastore, il sera donc \u00e0 minima possible de r\u00e9cup\u00e9rer les events via ces fichiers mais ce sera toujours moins productif qu&#8217;une vue graphique sur le vCenter<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"460\" src=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-VM-1024x460.png\" alt=\"\" class=\"wp-image-742\" srcset=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-VM-1024x460.png 1024w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-VM-300x135.png 300w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-VM-768x345.png 768w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-VM-1536x690.png 1536w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-VM-2048x920.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"248\" src=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-event-VM-1024x248.png\" alt=\"\" class=\"wp-image-743\" srcset=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-event-VM-1024x248.png 1024w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-event-VM-300x73.png 300w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-event-VM-768x186.png 768w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-event-VM-1536x372.png 1536w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/perte-historique-event-VM-2048x496.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading has-colibri-color-1-color has-text-color\" style=\"font-size:14px\"><span style=\"text-decoration: underline\" class=\"underline\">Workaround 2: Reload du .vmx<\/span><\/h4>\n\n\n\n<p style=\"font-size:14px\">Contrairement au workaround 1 celui-ci est celui ayant le moins d&#8217;impact parce que vous ne perdrez pas l&#8217;historique de la VM que \u00e7a soit sur le vCenter (performances, events, tasks) ou sur le vRops parce que le &#8220;vmid&#8221; restera le m\u00eame.<\/p>\n\n\n\n<p style=\"font-size:14px\">Il faut donc r\u00e9cup\u00e9rer le vmid de la VM en question via:<\/p>\n\n\n\n<pre class=\"wp-block-code\" style=\"font-size:14px\"><code>vim-cmd vmsvc\/getallvms<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"93\" src=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmid-before-unregister-1024x93.png\" alt=\"\" class=\"wp-image-734\" srcset=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmid-before-unregister-1024x93.png 1024w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmid-before-unregister-300x27.png 300w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmid-before-unregister-768x70.png 768w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmid-before-unregister-1536x140.png 1536w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmid-before-unregister-2048x187.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p style=\"font-size:14px\">Une fois cet ID d\u00e9termin\u00e9 il faut simplement remplacer &#8220;getallvms&#8221; par &#8220;reload&#8221; en indiquant l&#8217;ID<\/p>\n\n\n\n<pre class=\"wp-block-code\" style=\"font-size:14px\"><code>vim-cmd vmsvc\/reload 62<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmx-reload-without-unregister.png\" alt=\"\" class=\"wp-image-735\" width=\"463\" height=\"43\" srcset=\"https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmx-reload-without-unregister.png 807w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmx-reload-without-unregister-300x28.png 300w, https:\/\/kdslabs.fr\/wp-content\/uploads\/2023\/03\/vmx-reload-without-unregister-768x71.png 768w\" sizes=\"auto, (max-width: 463px) 100vw, 463px\" \/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading has-colibri-color-1-color has-text-color\" style=\"font-size:14px\"><span style=\"text-decoration: underline\" class=\"underline\">Workaround 3: PowerOff des VMs (pr\u00e9conisation VMware)<\/span><\/h4>\n\n\n\n<p style=\"font-size:14px\">Ce workaround est celui qui est le plus contraignant (impact de service + update obligatoire du vCenter avec un patch qui doit sortir officiellement dans quelques mois) et il fonctionnera \u00e0 condition que les 2 Key Provider soient joignables \u00e0 tout moment pendant l&#8217;op\u00e9ration de migration.<\/p>\n\n\n\n<pre class=\"wp-block-code\" style=\"font-size:14px\"><code>1.Upgraded the vc to 70p07 21267547 (not released yet)\n2.Create vm1 on host with vm encryption policy\n3.PowerON VM  and  rekey vm(Failed with: Not support: unable to shallow rekey powered on vm.)\n4.PowerOff VM and shallow Rekey(success\n5.Repeat these steps multiple times, VM doesn\u2019t go in power off state.<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading has-colibri-color-1-color has-text-color\" style=\"font-size:14px\"><span style=\"text-decoration: underline\" class=\"underline\">Workaround 4: D\u00e9sactivation du &#8220;vSphere HA VM Monitoring only&#8221; en amont de phase (valable seulement pour les VMs ayant un warning critical de HA en cours)<\/span><\/h4>\n\n\n\n<p style=\"font-size:14px\">Afin d&#8217;\u00e9viter un failed re-key sur les VMs ayant un warning vSphere HA nous avons 2 choix:<\/p>\n\n\n\n<ul class=\"wp-block-list\" style=\"font-size:14px\">\n<li>Soit d\u00e9sactiver compl\u00e9tement le vSphere HA Monitoring sur le cluster (moins propre et moins safe)\n<ul class=\"wp-block-list\">\n<li>Et surtout <span style=\"text-decoration: underline\" class=\"underline\">n\u00e9cessite <\/span>une \u00e9tude d&#8217;impact avant d\u00e9sactivation de cette option<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Soit cr\u00e9er une &#8220;VM override Rule&#8221; en incluant les VMs voulues (plus propre et plus safe)<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading has-colibri-color-1-color has-text-color\" style=\"font-size:14px\"><span style=\"text-decoration: underline\" class=\"underline\">Conclusion<\/span><\/h4>\n\n\n\n<p style=\"font-size:14px\">Avant toute chose, le chiffrement et la migration de workloads sont une chose \u00e0 ne pas prendre \u00e0 la l\u00e9g\u00e8re parce que la moindre erreur de process (voire un mauvais process identifi\u00e9) peut amener \u00e0 une perte de donn\u00e9es instantan\u00e9e et irr\u00e9versible de la VM si vous n&#8217;avez pas de backup avant op\u00e9ration.<\/p>\n\n\n\n<p style=\"font-size:12px\"><span style=\"text-decoration: underline\" class=\"underline\"><strong>Sources:<\/strong><\/span><br>How vSAN Encryption Works<br><a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/6.7\/com.vmware.vsphere.virtualsan.doc\/GUID-37F9636A-7481-4486-AAA9-E0A1A49343A1.html\">https:\/\/docs.vmware.com\/en\/VMware-vSphere\/6.7\/com.vmware.vsphere.virtualsan.doc\/GUID-37F9636A-7481-4486-AAA9-E0A1A49343A1.html<\/a><\/p>\n\n\n\n<p style=\"font-size:12px\">How vSphere Virtual Machine Encryption Protects Your Environment<br><a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/7.0\/com.vmware.vsphere.security.doc\/GUID-8D7D09AC-8579-4A33-9449-8E8BA49A3003.html\">https:\/\/docs.vmware.com\/en\/VMware-vSphere\/7.0\/com.vmware.vsphere.security.doc\/GUID-8D7D09AC-8579-4A33-9449-8E8BA49A3003.html<\/a><\/p>\n\n\n\n<p style=\"font-size:12px\">Reloading a vmx file without removing the virtual machine from inventory (1026043)<br><a href=\"https:\/\/kb.vmware.com\/s\/article\/1026043\">https:\/\/kb.vmware.com\/s\/article\/1026043<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Migration des workloads chiffr\u00e9s sur le Native Key Provider (NKP) vers un External KMS<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,18],"tags":[25,26,23,21],"class_list":["post-727","post","type-post","status-publish","format-standard","hentry","category-vmware","category-vsphere-7-0","tag-article","tag-cli","tag-guide","tag-vmware"],"_links":{"self":[{"href":"https:\/\/kdslabs.fr\/index.php\/wp-json\/wp\/v2\/posts\/727","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kdslabs.fr\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kdslabs.fr\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kdslabs.fr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kdslabs.fr\/index.php\/wp-json\/wp\/v2\/comments?post=727"}],"version-history":[{"count":0,"href":"https:\/\/kdslabs.fr\/index.php\/wp-json\/wp\/v2\/posts\/727\/revisions"}],"wp:attachment":[{"href":"https:\/\/kdslabs.fr\/index.php\/wp-json\/wp\/v2\/media?parent=727"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kdslabs.fr\/index.php\/wp-json\/wp\/v2\/categories?post=727"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kdslabs.fr\/index.php\/wp-json\/wp\/v2\/tags?post=727"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}