Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

12.4. Configuring an NVMe/TCP host using TLS with Pre-Shared-Keys

You can configure a Non-volatile Memory Express™ (NVMe™) over TCP (NVMe™/TCP) host while enabling TLS encryption. The NVMe/TLS configuration uses a TLS Pre-Shared Key (PSK).

The NVM Express TCP Transport Specification specifies a PSK Interchange Format for exchanging PSK information between systems. You can use nvme-cli or other methods to generate PSKs in this format (for example, create it on a storage target, see your vendor documentation). These configured PSKs are then used by nvme-cli to derive retained PSKs, which are inserted into a kernel keyring for use.

重要

NVMe/TCP using TLS is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

Prerequisites

  • The nvme_tcp kernel module is installed on your system.

  • The following packages are installed on your system:

    • nvme-cli
    • ktls-utils
  • You have the Subsystem NVMe Qualified Name (Subsystem NQN).
  • You have root permissions on the system.

Procedure

  1. Configure Pre-Shared-Key Keyring.

    1. Identify Host NQN: 

      # HOSTNQN=$(nvme show-hostnqn)

    2. Generate and copy a newly configured PSK: 

      # PSK=$(nvme gen-tls-key)
       
      # echo $PSK

    3. Configure Pre-Shared-Key Keyring: 

      # nvme check-tls-key --insert --hostnqn=${HOSTNQN} --subsysnqn=${SUBSYSTEM} --keydata=${PSK} --identity=1

  2. Configure the tlshd service.

    1. Add the keyring name to the /etc/tlshd.conf configuration file: 

      ...
[authenticate]
keyring=.nvme
...

    2. Restart the tlshd service: 

      # systemctl restart tlshd

  3. Enable TLS for NVMe fabrics connections: 

    # nvme discover -t tcp --tls -a ${TRADDR} -s 4420
     
    # nvme connect -t tcp --tls -a ${TRADDR} -s 4420 -n ${SUBSYSTEM}

Verification

  • List the NVMe devices that are currently connected: 

    # nvme list
Node              	Generic           	SN               	Model                                	Namespace  Usage                  	Format       	FW Rev
--------------------- --------------------- -------------------- ---------------------------------------- ---------- -------------------------- ---------------- --------
/dev/nvme4n1      	/dev/ng4n1        	81JJAJTOpnmUAAAAAAAB NetApp ONTAP Controller              	0x1     	16.17  GB / 161.06  GB  	4 KiB +  0 B   9.16.1
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2026 Red Hat返回顶部