Skip to content

Commit e0a2f9b

Browse files
subhtksubhtk
committed
Added a section for day2 operator for azure disk encryption sets.
1 parent 21a925a commit e0a2f9b

File tree

3 files changed

+104
-0
lines changed

3 files changed

+104
-0
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,8 @@ Topics:
251251
File: preparing-to-install-on-azure
252252
- Name: Configuring an Azure account
253253
File: installing-azure-account
254+
- Name: Enabling user-managed encryption for Azure
255+
File: enabling-user-managed-encryption-azure
254256
- Name: Installer-provisioned infrastructure
255257
Dir: ipi
256258
Distros: openshift-origin,openshift-enterprise

‎installing/installing_azure/enabling-user-managed-encryption-azure.adoc‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="enabling-user-managed-encryption-azure"]
3+
= Enabling user-managed encryption for Azure
4+
include::_attributes/common-attributes.adoc[]
5+
:context: enabling-user-managed-encryption-azure
6+
7+
toc::[]
8+
9+
In {product-title} version {product-version}, you can install a cluster with a user-managed encryption key in Azure. To enable this feature, you can prepare an Azure `DiskEncryptionSet` before installation, modify the `install-config.yaml` file, and then complete the installation.
10+
11+
include::modules/installation-azure-preparing-diskencryptionsets.adoc[leveloffset=+1]
12+
13+
include::modules/installation-azure-day2-operations-diskencryptionsets.adoc[leveloffset=+1]
14+
15+
[id="enabling-disk-encrytpion-additional-resources"]
16+
== Additional resources
17+
18+
* link:https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-cli#prerequisites[Use the Azure portal to enable end-to-end encryption using encryption at host]
19+
20+
* xref:../../nodes/nodes/nodes-nodes-working.adoc#nodes-nodes-working-evacuating_nodes-nodes-working[Understanding how to evacuate pods on nodes]
21+
22+
[id="enabling-disk-encryption-sets-azure-next-steps"]
23+
== Next steps
24+
25+
* Install an {product-title} cluster:
26+
** xref:../../installing/installing_azure/ipi/installing-azure-customizations.adoc#installing-azure-customizations[Install a cluster with customizations on installer-provisioned infrastructure]
27+
** xref:../../installing/installing_azure/ipi/installing-azure-network-customizations.adoc#installing-azure-network-customizations[Install a cluster with network customizations on installer-provisioned infrastructure]
28+
** xref:../../installing/installing_azure/ipi/installing-azure-vnet.adoc#installing-azure-vnet[Install a cluster into an existing VNet on installer-provisioned infrastructure]
29+
** xref:../../installing/installing_azure/ipi/installing-azure-private.adoc#installing-azure-private[Install a private cluster on installer-provisioned infrastructure]
30+
** xref:../../installing/installing_azure/ipi/installing-azure-government-region.adoc#installing-azure-government-region[Install a cluster into an government region on installer-provisioned infrastructure]

‎modules/installation-azure-day2-operations-diskencryptionsets.adoc‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
//Module included in the following assemblies:
2+
//
3+
// * installing/installing_azure/enabling-disk-encryption-sets-azure.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="preparing-disk-encryption-sets-day2-operator_{context}"]
7+
= Preparing an Azure Disk Encryption Set for Day2 Operator
8+
The {product-title} installer can use an existing Disk Encryption Set with a user-managed key. To enable this feature, create a `DiskEncryptionSet` in Azure and provide the key to the installer.
9+
10+
.Prerequisite
11+
12+
* The `EncryptionAtHost` feature must be enabled in your Azure subscription. For more information, see "Use the Azure portal to enable end-to-end encryption using encryption at host".
13+
14+
.Procedure
15+
16+
. Mark the node from the `encyptionAtHost` cluster resource group as unschedulable using the following command:
17+
+
18+
[source,terminal]
19+
----
20+
$ oc adm cordon <node_name>
21+
----
22+
23+
. Evacuate the pods from the compute node. There are several ways to do this. For example, you can evacuate all or selected pods on a node:
24+
+
25+
[source,terminal]
26+
----
27+
$ oc adm drain <compute_node> [--pod-selector=<pod_selector>]
28+
----
29+
+
30+
See the "Understanding how to evacuate pods on nodes" section for other options to evacuate pods from a node.
31+
32+
. De-allocate the node by running the following command:
33+
+
34+
[source,terminal]
35+
----
36+
$ az vm deallocate -n <node_name> -g <cluster_resource_group>
37+
----
38+
39+
. Set the `encryptionAtHost` property to `true` by running the following command:
40+
+
41+
[source,terminal]
42+
----
43+
$ az vm update -n <node_name> -g <cluster_resource_group> --set securityProfile.encryptionAtHost=true
44+
----
45+
46+
. Start the node by running the following commands:
47+
+
48+
[source,terminal]
49+
----
50+
$ az vm start -n <node_name> -g <cluster_resource_group>
51+
----
52+
53+
. Mark the node as schedulable using the follwoing command:
54+
+
55+
[source,terminal]
56+
----
57+
$ oc adm uncordon <node_name>
58+
----
59+
60+
. Make sure that all the operators are available.
61+
62+
. Repeat the above steps on all the nodes of the `encryptionAtHost`.
63+
64+
[NOTE]
65+
====
66+
If you want to enable encryption at host during installation, set the following fields in the `install-config.yaml` file:
67+
68+
* `compute.platform.azure.encryptionAtHost`
69+
* `controlPlane.platform.azure.encryptionAtHost`
70+
* `platform.azure.defaultMachinePlatform.encryptionAtHost`
71+
72+
====

0 commit comments

Comments
 (0)