ホーム
製品
Red Hat Enterprise Linux
10
Managing storage devices
21.6. Creating an encrypted Stratis pool using a key in the kernel keyring

21.6. Creating an encrypted Stratis pool using a key in the kernel keyring

To secure your data, you can use the kernel keyring to create an encrypted Stratis pool from one or more block devices.

When you create an encrypted Stratis pool this way, the kernel keyring is used as the primary encryption mechanism. After subsequent system reboots this kernel keyring is used to unlock the encrypted Stratis pool.

When creating an encrypted Stratis pool from one or more block devices, note the following:

Each block device is encrypted using the cryptsetup library and implements the LUKS2 format.
Each Stratis pool can either have a unique key or share the same key with other pools. These keys are stored in the kernel keyring.
The block devices that comprise a Stratis pool must be either all encrypted or all unencrypted. It is not possible to have both encrypted and unencrypted block devices in the same Stratis pool.
Block devices added to the data cache of an encrypted Stratis pool are automatically encrypted.

Prerequisites

Stratis v2.1.0 or later is installed and the stratisd service is running. For more information, see Installing Stratis.
The block device on which you are creating a Stratis pool is not in use, unmounted, and is at least 1 GB in space.
On the IBM Z architecture, the /dev/dasd* block devices must be partitioned. Use the partition in the Stratis pool.
For information about partitioning DASD devices, see Configuring a Linux instance on 64-bit IBM Z.

Procedure

Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool:
```
# wipefs --all block-device
```
The block-device value is the path to the block device; for example, /dev/sdb.
If you have not set a key already, run the following command and follow the prompts to create a key set to use for the encryption:
```
# stratis key set --capture-key key-description
```
The key-description is a reference to the key that gets created in the kernel keyring. You will be prompted to enter a key value at the command-line. You can also place the key value in a file and use the --keyfile-path option instead of the --capture-key option.
Create the encrypted Stratis pool and specify the key description to use for the encryption:
```
# stratis pool create --key-desc key-description my-pool block-device
```
key-description
References the key that exists in the kernel keyring, which you created in the previous step.
my-pool
Specifies the name of the new Stratis pool.
block-device
Specifies the path to an empty or wiped block device.
You can also specify multiple block devices on a single line by using the following command:
# stratis pool create --key-desc key-description my-pool block-device-1 block-device-2

Verification

Verify that the new Stratis pool was created:
```
# stratis pool list
```

21.6. Creating an encrypted Stratis pool using a key in the kernel keyring

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

多様性を受け入れるオープンソースの強化

会社概要

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links