6.3. Disabling etcd encryption

Procedure

1. Modify the APIServer object:

   $ oc edit apiserver

   Copy to Clipboard Toggle word wrap

2. Set the encryption field type to identity:

   spec:
     encryption:
       type: identity 

   1

   Copy to Clipboard Toggle word wrap

   1

   The identity type is the default value and means that no encryption is performed.

3. Save the file to apply the changes.

   The decryption process starts. It can take 20 minutes or longer for this process to complete, depending on the size of your cluster.

4. Verify that etcd decryption was successful.

   1. Review the Encrypted status condition for the OpenShift API server to verify that its resources were successfully decrypted:

      $ oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      Copy to Clipboard Toggle word wrap

      The output shows DecryptionCompleted upon successful decryption:

      DecryptionCompleted
      Encryption mode set to identity and everything is decrypted

      Copy to Clipboard Toggle word wrap

      If the output shows DecryptionInProgress, this means that decryption is still in progress. Wait a few minutes and try again.

   2. Review the Encrypted status condition for the Kubernetes API server to verify that its resources were successfully decrypted:

      $ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

      Copy to Clipboard Toggle word wrap

      The output shows DecryptionCompleted upon successful decryption:

      DecryptionCompleted
      Encryption mode set to identity and everything is decrypted

      Copy to Clipboard Toggle word wrap

      If the output shows DecryptionInProgress, this means that decryption is still in progress. Wait a few minutes and try again.