Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

このコンテンツは選択した言語では利用できません。

12.3. Enabling Encryption for an Existing Container Native Storage Setup

You can configure network encryption for an existing Container Native Storage setup for both I/O encryption and management encryption.

12.3.1. Enabling I/O encryption for a Volume

Enable the I/O encryption between the servers and clients for a volume:

Note

The servers are the OpenShift nodes on which Red Hat Gluster Storage pods are running.
The clients are the remaining OpenShift nodes on which Red Hat Gluster Storage is not running.
  1. Stop all the application pods that have the Red Hat Gluster Storage volumes.
  2. Stop the volume. 
    # oc rsh <gluster_pod_name> gluster volume stop VOLNAME
    Copy to Clipboard Toggle word wrap
    The gluster pod name is the name of one of the Red Hat Gluster Storage pods of the trusted storage pool to which the volume belongs.
  3. Set the list of common names for clients allowed to access the volume. Be sure to include the common names of all the servers. 
    # oc rsh <gluster_pod_name> gluster volume set VOLNAME auth.ssl-allow 'server1,server2,server3,client1,client2,client3'
    Copy to Clipboard Toggle word wrap

    Note

    If you set auth.ssl-allow option with * as value, any TLS authenticated clients can mount and access the volume from the application side. Hence, you set the option's value to * or provide common names of clients as well as the nodes in the trusted storage pool.
  4. Enable client.ssl and server.ssl on the volume. 
    # oc rsh <gluster_pod_name> gluster volume set VOLNAME client.ssl on
# oc rsh <gluster_pod_name> gluster volume set VOLNAME server.ssl on
    Copy to Clipboard Toggle word wrap
  5. Start the volume. 
    # oc rsh <gluster_pod_name> gluster volume start VOLNAME
    Copy to Clipboard Toggle word wrap
  6. Start the application pods to use the I/O encrypted Red Hat Gluster Storage volumes.

12.3.2. Enabling Management Encryption

Though, Red Hat Gluster Storage can be configured only for I/O encryption without using management encryption, management encryption is recommended. On an existing installation, with running servers and clients, schedule a downtime of volumes, applications, clients, and other end-users to enable management encryption.
You cannot currently change between unencrypted and encrypted connections dynamically. Bricks and other local services on the servers and clients do not receive notifications from glusterd if they are running when the switch to management encryption is made.
  1. Stop all the application pods that have the Red Hat Gluster Storage volumes.
  2. Stop all the volumes. 
    # oc rsh <gluster_pod_name> gluster volume stop VOLNAME
    Copy to Clipboard Toggle word wrap
  3. Stop the Red Hat Gluster Storage pods. 
    # oc delete daemonset glusterfs
    Copy to Clipboard Toggle word wrap
  4. On deletion of daemon set the pods go down. To verify if the pods are down, execute the following command: 
    # oc get pods
    Copy to Clipboard Toggle word wrap
  5. Create the /var/lib/glusterd/secure-access file on all OpenShift nodes. 
    # touch /var/lib/glusterd/secure-access
    Copy to Clipboard Toggle word wrap
  6. Create the Red Hat Gluster Storage deamonset by executing the following command: 
    # oc process glusterfs | oc create -f -
    Copy to Clipboard Toggle word wrap
  7. On creation of daemon set the pods are started. To verify if the pods are started, execute the following command: 
    # oc get pods
    Copy to Clipboard Toggle word wrap
  8. Start all the volumes. 
    # oc rsh <gluster_pod_name> gluster volume start VOLNAME
    Copy to Clipboard Toggle word wrap
  9. Start the application pods to use the management encrypted Red Hat Gluster Storage.
トップに戻る
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2025 Red Hat