Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

このコンテンツは選択した言語では利用できません。

Chapter 4. Configure Encryption with Transport Layer Security (TLS/SSL)

Transport Layer Security (TLS/SSL) can be used to encrypt management and storage layer communications between nodes. This helps ensure that your data remains private.

Encryption can be configured using either self-signed certificates or certificates signed by a Certificate Authority.

This document assumes that you want to enable encryption on an existing deployment. However, encryption can also be configured as part of the deployment process. See Deploying Red Hat Hyperconverged Infrastructure for details: https://access.redhat.com/documentation/en-us/red_hat_hyperconverged_infrastructure/1.0/html/deploying_red_hat_hyperconverged_infrastructure/.

4.1. Configuring TLS/SSL using self-signed certificates
リンクのコピー

Important

Enabling or disabling encryption is a disruptive process that requires virtual machines and the Hosted Engine to be shut down.

  1. Shut down all virtual machines

    See Shutting Down a Virtual Machine in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/html/virtual_machine_management_guide/chap-administrative_tasks.

  2. Move all storage domains except the hosted engine storage domain into Maintenance mode

    See Moving Storage Domains to Maintenance Mode in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/html/administration_guide/sect-storage_tasks.

  3. Move the hosted engine into global maintenance mode

    Run the following command on the hypervisor that hosts the hosted engine: 

    # hosted-engine --set-maintenance --mode=global
    Copy to Clipboard Toggle word wrap

  4. Shut down the hosted engine virtual machine

    Run the following command on the hypervisor that hosts the hosted engine: 

    # hosted-engine --vm-shutdown
    Copy to Clipboard Toggle word wrap

    Verify that the hosted engine has shut down by running the following command: 

     # hosted-engine --vm-status
    Copy to Clipboard Toggle word wrap

  5. Stop all high availability services

    Run the following command on all hypervisors: 

    # systemctl stop ovirt-ha-agent
# systemctl stop ovirt-ha-broker
    Copy to Clipboard Toggle word wrap

  6. Unmount the hosted engine storage domain from all hypervisors 

    # hosted-engine --disconnect-storage
    Copy to Clipboard Toggle word wrap

  7. Verify that all volumes are unmounted

    On each hypervisor, verify that all gluster volumes are no longer mounted. 

    # mount
    Copy to Clipboard Toggle word wrap

  8. Create a gdeploy configuration file

    Use the template file in Section B.1, “Example gdeploy configuration file for setting up TLS/SSL” to create a new configuration file that will set up TLS/SSL on your deployment.

  9. Run gdeploy using your new configuration file

    On the first physical machine, run gdeploy using the configuration file you created in the previous step: 

    # gdeploy -c set_up_encryption.conf
    Copy to Clipboard Toggle word wrap

    This may take some time to complete.

  10. Verify that no TLS/SSL errors occurred

    Check the /var/log/glusterfs/glusterd.log file on each physical machine to ensure that no TLS/SSL related errors occurred, and setup completed successfully.

  11. Start all high availability services

    Run the following commands on all hypervisors: 

    # systemctl start ovirt-ha-agent
# systemctl start ovirt-ha-broker
    Copy to Clipboard Toggle word wrap

  12. Move the hosted engine out of Global Maintenance mode 

    # hosted-engine --set-maintenance --mode=none
    Copy to Clipboard Toggle word wrap

    The hosted engine starts automatically after a short wait.

  13. Wait for nodes to synchronize

    Run the following command on the first hypervisor to check synchronization status. If engine status is listed as unknown stale-data, synchronization requires several more minutes to complete.

    The following output indicates completed synchronization. 

    # hosted-engine --vm-status | grep 'Engine status'
Engine status   : {"health": "good", "vm": "up", "detail": "up"}
Engine status   : {"reason": "vm not running on this host",
  "health": "bad", "vm": "down", "detail": "unknown"}
Engine status   : {"reason": "vm not running on this host",
  "health": "bad", "vm": "down", "detail": "unknown"}
    Copy to Clipboard Toggle word wrap

  14. Activate all storage domains

    Activate the master storage domain first, followed by all other storage domains.

    For details on activating storage domains, see Activating Storage Domains from Maintenance Mode in the Red Hat Virtualization documentation: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/html/administration_guide/sect-storage_tasks.

  15. Start all virtual machines

    See Starting a Virtual Machine in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/html/virtual_machine_management_guide/sect-starting_the_virtual_machine.

4.2. Configuring TLS/SSL using Certificate Authority signed certificates
リンクのコピー

Important

Enabling or disabling encryption is a disruptive process that requires virtual machines and the Hosted Engine to be shut down.

Important

Ensure that you have appropriate certificates signed by a Certificate Authority before proceeding. Obtaining certificates is outside the scope of this document, but further details are available in the Red Hat Gluster Storage Administration Guide: https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.2/html/administration_guide/chap-network_encryption#chap-Network_Encryption-Prereqs.

  1. Shut down all virtual machines

    See Shutting Down a Virtual Machine in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/html/virtual_machine_management_guide/chap-administrative_tasks.

  2. Move all storage domains except the hosted engine storage domain into Maintenance mode

    See Moving Storage Domains to Maintenance Mode in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/html/administration_guide/sect-storage_tasks.

  3. Move the hosted engine into global maintenance mode

    Run the following command on the hypervisor that hosts the hosted engine: 

    # hosted-engine --set-maintenance --mode=global
    Copy to Clipboard Toggle word wrap

  4. Shut down the hosted engine virtual machine

    Run the following command on the hypervisor that hosts the hosted engine: 

    # hosted-engine --vm-shutdown
    Copy to Clipboard Toggle word wrap

    Verify that the hosted engine has shut down by running the following command: 

     # hosted-engine --vm-status
    Copy to Clipboard Toggle word wrap

  5. Stop all high availability services

    Run the following command on all hypervisors: 

    # systemctl stop ovirt-ha-agent
# systemctl stop ovirt-ha-broker
    Copy to Clipboard Toggle word wrap

  6. Unmount the hosted engine storage domain from all hypervisors 

    # hosted-engine --disconnect-storage
    Copy to Clipboard Toggle word wrap

  7. Verify that all volumes are unmounted

    On each hypervisor, verify that all gluster volumes are no longer mounted. 

    # mount
    Copy to Clipboard Toggle word wrap

  8. Configure Certificate Authority signed encryption

    Important

    Ensure that you have appropriate certificates signed by a Certificate Authority before proceeding. Obtaining certificates is outside the scope of this document.

    1. Place certificates in the following locations on all nodes.

      /etc/ssl/glusterfs.key
      The node’s private key.
      /etc/ssl/glusterfs.pem
      The certificate signed by the Certificate Authority, which becomes the node’s certificate.
      /etc/ssl/glusterfs.ca
      The Certificate Authority’s certificate.

    2. Stop all volumes 

      # gluster volume stop all
      Copy to Clipboard Toggle word wrap

    3. Restart glusterd on all nodes 

      # systemctl restart glusterd
      Copy to Clipboard Toggle word wrap

    4. Enable TLS/SSL encryption on all volumes 

      # gluster volume set <volname> client.ssl on
# gluster volume set <volname> server.ssl on
      Copy to Clipboard Toggle word wrap

    5. Specify access permissions on all hosts 

      # gluster volume set <volname> auth.ssl-allow "host1,host2,host3"
      Copy to Clipboard Toggle word wrap

    6. Start all volumes 

      # gluster volume start all
      Copy to Clipboard Toggle word wrap

  9. Verify that no TLS/SSL errors occurred

    Check the /var/log/glusterfs/glusterd.log file on each physical machine to ensure that no TLS/SSL related errors occurred, and setup completed successfully.

  10. Start all high availability services

    Run the following commands on all hypervisors: 

    # systemctl start ovirt-ha-agent
# systemctl start ovirt-ha-broker
    Copy to Clipboard Toggle word wrap

  11. Move the hosted engine out of Global Maintenance mode 

    # hosted-engine --set-maintenance --mode=none
    Copy to Clipboard Toggle word wrap

    The hosted engine starts automatically after a short wait.

  12. Wait for nodes to synchronize

    Run the following command on the first hypervisor to check synchronization status. If engine status is listed as unknown stale-data, synchronization requires several more minutes to complete.

    The following output indicates completed synchronization. 

    # hosted-engine --vm-status | grep 'Engine status'
Engine status   : {"health": "good", "vm": "up", "detail": "up"}
Engine status   : {"reason": "vm not running on this host",
  "health": "bad", "vm": "down", "detail": "unknown"}
Engine status   : {"reason": "vm not running on this host",
  "health": "bad", "vm": "down", "detail": "unknown"}
    Copy to Clipboard Toggle word wrap

  13. Activate all storage domains

    Activate the master storage domain first, followed by all other storage domains.

    For details on activating storage domains, see Activating Storage Domains from Maintenance Mode in the Red Hat Virtualization documentation: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/html/administration_guide/sect-storage_tasks.

  14. Start all virtual machines

    See Starting a Virtual Machine in the Red Hat Virtualization documentation for details: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/html/virtual_machine_management_guide/sect-starting_the_virtual_machine.

トップに戻る
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2025 Red Hat