Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Perangkat air-gapped Google Distributed Cloud (GDC) menggunakan Linux Unified Key Setup (LUKS) untuk mengenkripsi data di disk saat HSM eksternal tidak disediakan.
Array RAID5 dibuat di atas 4 drive data, dan satu perangkat LUKS dibuat di atas array RAID5. KEK LUKS dibuat secara acak dan dapat dirotasi.
Dokumen ini menjelaskan langkah-langkah untuk mengganti KEK LUKS yang harus dilakukan untuk:
Pastikan Anda dapat login ke tiga node sebagai pengguna root.
Merotasi KEK
Sistem appliance air-gapped Google Distributed Cloud (GDC) menggunakan cluster NetApp ONTAP Select (OTS) dua node yang di-deploy di node bm01 dan bm02 (biasanya tanpa GPU). Setiap node memiliki 4 drive data khusus yang dikonfigurasi sebagai array RAID5 untuk meningkatkan redundansi. Satu perangkat yang dienkripsi LUKS disusun di atas setiap array RAID5 untuk memastikan keamanan data.
KEK enkripsi LUKS disimpan di disk booting yang berada di /etc/luks. Merotasi KEK LUKS memerlukan rotasi enkripsi LUKS di kedua node untuk menjaga keamanan di seluruh cluster. Untuk melakukan rotasi KEK reguler atau jika KEK terekspos, ulangi langkah-langkah berikut di bm01 dan bm02:
Login ke node sebagai pengguna root.
Pastikan perangkat RAID ada, dan dapatkan jalur lengkap RAID_DEVICE.
ll/dev/md
Pastikan file kunci LUKS lama ada, dan dapatkan jalur lengkap OLD_KEY.
ll/etc/luks
Tambahkan KEK lama ke slot kunci 1, sehingga slot kunci 0 dan 1 memiliki KEK yang sama.
Jika node di-reboot sebelum rotasi selesai, perangkat LUKS masih dapat dibuka setelah booting. Anda dapat melanjutkan langkah-langkah setelah node kembali.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eGoogle Distributed Cloud (GDC) air-gapped appliance encrypts data on disks using Linux Unified Key Setup (LUKS).\u003c/p\u003e\n"],["\u003cp\u003eEach physical disk is converted into a LUKS-encrypted logical volume during bootstrapping.\u003c/p\u003e\n"],["\u003cp\u003eAn external passphrase is required by LUKS to decrypt and access the device.\u003c/p\u003e\n"],["\u003cp\u003ePassphrase rotation is necessary for both regularly scheduled maintenance and in the event of passphrase exposure.\u003c/p\u003e\n"],["\u003cp\u003eAccess to detailed passphrase rotation instructions is restricted to approved operating partners; contact your account manager for access.\u003c/p\u003e\n"]]],[],null,["# Rotate disk encryption keys\n\nGoogle Distributed Cloud (GDC) air-gapped appliance uses the Linux Unified Key Setup (LUKS) to encrypt data on disks when external HSM is not provided.\nA RAID5 array is created on top of the 4 data drives, and a single LUKS device is created on top of the RAID5 array. The LUKS KEK is randomly generated and can be rotated.\n\nThis document describes the steps to rotate the LUKS KEK that must be performed for:\n\n- regularly scheduled KEK rotation.\n- KEK exposure.\n\n| **Note:** Rotate the exposed KEK as soon as possible.\n\nBefore you begin\n----------------\n\nComplete the following steps:\n\n1. Verify that you meet the [laptop prerequisites](/distributed-cloud/hosted/docs/latest/appliance/admin/laptop).\n2. Ensure that you can sign in to the three nodes as root user.\n\nRotate KEK\n----------\n\nThe Google Distributed Cloud (GDC) air-gapped appliance system utilizes a two-node NetApp ONTAP Select (OTS) cluster deployed on nodes bm01 and bm02 (typically without GPUs). Each node possesses 4 dedicated data drives configured as a RAID5 array for enhanced redundancy. A single LUKS encrypted device is layered on top of each RAID5 array to ensure data security.\n\nThe LUKS encryption KEK is stored on the boot disk located in `/etc/luks`. Rotating the LUKS KEK necessitates rotating the LUKS encryption on both nodes to maintain security across the cluster. To perform a regular KEK rotation or if the KEK is exposed, repeat the following steps on both bm01 and bm02:\n\n1. Sign in to the node as root user.\n\n2. Make sure the RAID device exists, and get the \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e full path.\n\n ll /dev/md\n\n3. Make sure the old LUKS key file exists, and get the `OLD_KEY` full path.\n\n ll /etc/luks\n\n4. Add the old KEK to key slot 1, so that both key slot 0 and 1 have the same KEK.\n\n cryptsetup luksAddKey \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e --key-slot 1 --key-file \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e and `OLD_KEY` with the paths from the previous steps.\n5. Remove the old KEK from key slot 0.\n\n cryptsetup luksKillSlot \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e 0 --key-file \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\n6. Generate a new KEK, and store it in the new key file `NEW_KEY`.\n\n dd if=/dev/urandom of=\u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e bs=512 count=1\n chmod u=r,go-rwx \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e\n\n Replace `NEW_KEY` with the full path to the new key file.\n7. Add the new KEK to key slot 0.\n\n cryptsetup luksAddKey \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e --key-slot 0 --key-file \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\n8. Set persistent config to open or close the LUKS device on machine boot or shutdown.\n\n DEVICE_UUID=$(cryptsetup luksUUID \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e)\n echo \"luksrd5 UUID=${DEVICE_UUID} \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e luks,discard\" \u003e /etc/crypttab\n\n9. Remove the old KEK from key slot 1.\n\n cryptsetup luksKillSlot \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e 1 --key-file \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e\n\n10. Verify the new KEK is working.\n\n cryptsetup luksDump --dump-master-key \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e --key-file \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e\n\n11. Verify the old KEK is not working anymore.\n\n cryptsetup luksDump --dump-master-key \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e --key-file \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\n12. Remove the old KEK.\n\n rm \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\nIf a node is rebooted before the rotation completes, the LUKS device can still be opened after boot. You can resume the steps after the node is back."]]
