Encryption

Encrypting a volume is something you configure once, at the moment you create it — see Encryption under Creating a volume for supplying an encryption key and saving a recovery copy. This chapter covers what comes after that: unlocking an encrypted consistency group when it can't open on its own, and generating a key to use when you create an encrypted volume in the first place.

Supplying an encryption key to unlock a consistency group

An encrypted volume's data can only be read once its consistency group has been opened with its encryption key. Normally this happens automatically, but there are situations — most commonly after a system restart — where StorONE can't open an encrypted consistency group on its own and needs the key supplied again before the volume's data becomes accessible. Until the key is supplied, the volume stays offline.

Supplying the wrong key fails; supplying the correct key opens the consistency group so its volume(s) become available again.

Using the web interface

1. Open Application Volumes > Volumes, select the (offline) encrypted volume, and choose Supply Encryption Key.
2. Under Volume/Consistency Group Selection, the application and volume (or consistency group) are pre-filled from your selection.
3. Enter the encryption key.
4. Confirm to open the consistency group.

Using the CLI

applications encryption supply_encryption_key
    --cgid=<numbers>|(--application=<name> --volume=<name>) --encryptionKey=<encryptionKey>

Examples

Unlock an encrypted volume's consistency group by application and volume name:

applications encryption supply_encryption_key --application finance --volume ledgers --encryptionKey "correct-horse-battery-staple"

Unlock it by consistency group ID instead (useful in scripts, where you may already have the ID on hand):

applications encryption supply_encryption_key --cgid 42 --encryptionKey "correct-horse-battery-staple"

Generating an example encryption key

A quick way to get a strong, random key to use with --encryptionKey when creating an encrypted volume, if you don't already have a key-generation process of your own. It returns a random 256-bit value as a hex string — nothing is saved or applied to anything; it's purely a convenience generator. Note the key it returns down somewhere safe, since StorONE doesn't store it for you (unless you opt in to a recovery copy at volume-creation time).

This command is CLI-only.

Using the CLI

applications encryption encryption_key_example

This command takes no options.

Example

applications encryption encryption_key_example

See also: Volumes — Encryption