Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

12.4. Configuring an NVMe/TCP host using TLS with Pre-Shared-Keys

You can configure a Non-volatile Memory Express™ (NVMe™) over TCP (NVMe™/TCP) host while enabling TLS encryption. The NVMe/TLS configuration uses a TLS Pre-Shared Key (PSK).

The NVM Express TCP Transport Specification specifies a PSK Interchange Format for exchanging PSK information between systems. You can use nvme-cli or other methods to generate PSKs in this format (for example, create it on a storage target, see your vendor documentation). These configured PSKs are then used by nvme-cli to derive retained PSKs, which are inserted into a kernel keyring for use.

중요

NVMe/TCP using TLS is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

Prerequisites

  • The nvme_tcp kernel module is installed on your system.

  • The following packages are installed on your system:

    • nvme-cli
    • ktls-utils
  • You have the Subsystem NVMe Qualified Name (Subsystem NQN).
  • You have root permissions on the system.

Procedure

  1. Configure Pre-Shared-Key Keyring.

    1. Identify Host NQN: 

      # HOSTNQN=$(nvme show-hostnqn)

    2. Generate and copy a newly configured PSK: 

      # PSK=$(nvme gen-tls-key)
       
      # echo $PSK

    3. Configure Pre-Shared-Key Keyring: 

      # nvme check-tls-key --insert --hostnqn=${HOSTNQN} --subsysnqn=${SUBSYSTEM} --keydata=${PSK} --identity=1

  2. Configure the tlshd service.

    1. Add the keyring name to the /etc/tlshd.conf configuration file: 

      ...
[authenticate]
keyring=.nvme
...

    2. Restart the tlshd service: 

      # systemctl restart tlshd

  3. Enable TLS for NVMe fabrics connections: 

    # nvme discover -t tcp --tls -a ${TRADDR} -s 4420
     
    # nvme connect -t tcp --tls -a ${TRADDR} -s 4420 -n ${SUBSYSTEM}

Verification

  • List the NVMe devices that are currently connected: 

    # nvme list
Node              	Generic           	SN               	Model                                	Namespace  Usage                  	Format       	FW Rev
--------------------- --------------------- -------------------- ---------------------------------------- ---------- -------------------------- ---------------- --------
/dev/nvme4n1      	/dev/ng4n1        	81JJAJTOpnmUAAAAAAAB NetApp ONTAP Controller              	0x1     	16.17  GB / 161.06  GB  	4 KiB +  0 B   9.16.1
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2026 Red Hat맨 위로 이동