Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
O appliance isolado do Google Distributed Cloud (GDC) usa o Linux Unified Key Setup (LUKS) para criptografar dados em discos quando um HSM externo não é fornecido.
Uma matriz RAID5 é criada com base nas quatro unidades de dados, e um único dispositivo LUKS é criado com base na matriz RAID5. A KEK do LUKS é gerada aleatoriamente e pode ser substituída.
Este documento descreve as etapas para fazer a rotação da KEK do LUKS, que precisa ser realizada para:
Verifique se você pode fazer login nos três nós como usuário raiz.
Alternar KEK
O sistema de appliance isolado do Google Distributed Cloud (GDC) usa um cluster NetApp ONTAP Select (OTS) de dois nós implantado nos nós bm01 e bm02 (normalmente sem GPUs). Cada nó tem quatro unidades de dados dedicadas configuradas como uma matriz RAID5 para aumentar a redundância. Um único dispositivo criptografado com LUKS é colocado em cima de cada matriz RAID5 para garantir segurança de dados.
A KEK de criptografia LUKS é armazenada no disco de inicialização localizado em /etc/luks. A rotação da KEK do LUKS exige a rotação da criptografia do LUKS nos dois nós para manter a segurança em todo o cluster. Para fazer uma rotação regular da KEK ou se ela for exposta, repita as etapas a seguir em bm01 e bm02:
Faça login no nó como usuário raiz.
Verifique se o dispositivo RAID existe e receba o caminho completo RAID_DEVICE.
ll/dev/md
Verifique se o arquivo de chave LUKS antigo existe e extraia o caminho completo OLD_KEY.
ll/etc/luks
Adicione a KEK antiga ao slot de chave 1 para que os slots 0 e 1 tenham a mesma KEK.
Se um nó for reinicializado antes da conclusão da rotação, o dispositivo LUKS ainda poderá ser aberto após a inicialização. Você pode retomar as etapas depois que o nó voltar.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[[["\u003cp\u003eGoogle Distributed Cloud (GDC) air-gapped appliance encrypts data on disks using Linux Unified Key Setup (LUKS).\u003c/p\u003e\n"],["\u003cp\u003eEach physical disk is converted into a LUKS-encrypted logical volume during bootstrapping.\u003c/p\u003e\n"],["\u003cp\u003eAn external passphrase is required by LUKS to decrypt and access the device.\u003c/p\u003e\n"],["\u003cp\u003ePassphrase rotation is necessary for both regularly scheduled maintenance and in the event of passphrase exposure.\u003c/p\u003e\n"],["\u003cp\u003eAccess to detailed passphrase rotation instructions is restricted to approved operating partners; contact your account manager for access.\u003c/p\u003e\n"]]],[],null,["# Rotate disk encryption keys\n\nGoogle Distributed Cloud (GDC) air-gapped appliance uses the Linux Unified Key Setup (LUKS) to encrypt data on disks when external HSM is not provided.\nA RAID5 array is created on top of the 4 data drives, and a single LUKS device is created on top of the RAID5 array. The LUKS KEK is randomly generated and can be rotated.\n\nThis document describes the steps to rotate the LUKS KEK that must be performed for:\n\n- regularly scheduled KEK rotation.\n- KEK exposure.\n\n| **Note:** Rotate the exposed KEK as soon as possible.\n\nBefore you begin\n----------------\n\nComplete the following steps:\n\n1. Verify that you meet the [laptop prerequisites](/distributed-cloud/hosted/docs/latest/appliance/admin/laptop).\n2. Ensure that you can sign in to the three nodes as root user.\n\nRotate KEK\n----------\n\nThe Google Distributed Cloud (GDC) air-gapped appliance system utilizes a two-node NetApp ONTAP Select (OTS) cluster deployed on nodes bm01 and bm02 (typically without GPUs). Each node possesses 4 dedicated data drives configured as a RAID5 array for enhanced redundancy. A single LUKS encrypted device is layered on top of each RAID5 array to ensure data security.\n\nThe LUKS encryption KEK is stored on the boot disk located in `/etc/luks`. Rotating the LUKS KEK necessitates rotating the LUKS encryption on both nodes to maintain security across the cluster. To perform a regular KEK rotation or if the KEK is exposed, repeat the following steps on both bm01 and bm02:\n\n1. Sign in to the node as root user.\n\n2. Make sure the RAID device exists, and get the \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e full path.\n\n ll /dev/md\n\n3. Make sure the old LUKS key file exists, and get the `OLD_KEY` full path.\n\n ll /etc/luks\n\n4. Add the old KEK to key slot 1, so that both key slot 0 and 1 have the same KEK.\n\n cryptsetup luksAddKey \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e --key-slot 1 --key-file \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e and `OLD_KEY` with the paths from the previous steps.\n5. Remove the old KEK from key slot 0.\n\n cryptsetup luksKillSlot \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e 0 --key-file \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\n6. Generate a new KEK, and store it in the new key file `NEW_KEY`.\n\n dd if=/dev/urandom of=\u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e bs=512 count=1\n chmod u=r,go-rwx \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e\n\n Replace `NEW_KEY` with the full path to the new key file.\n7. Add the new KEK to key slot 0.\n\n cryptsetup luksAddKey \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e --key-slot 0 --key-file \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\n8. Set persistent config to open or close the LUKS device on machine boot or shutdown.\n\n DEVICE_UUID=$(cryptsetup luksUUID \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e)\n echo \"luksrd5 UUID=${DEVICE_UUID} \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e luks,discard\" \u003e /etc/crypttab\n\n9. Remove the old KEK from key slot 1.\n\n cryptsetup luksKillSlot \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e 1 --key-file \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e\n\n10. Verify the new KEK is working.\n\n cryptsetup luksDump --dump-master-key \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e --key-file \u003cvar translate=\"no\"\u003eNEW_KEY\u003c/var\u003e\n\n11. Verify the old KEK is not working anymore.\n\n cryptsetup luksDump --dump-master-key \u003cvar translate=\"no\"\u003eRAID_DEVICE\u003c/var\u003e --key-file \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\n12. Remove the old KEK.\n\n rm \u003cvar translate=\"no\"\u003eOLD_KEY\u003c/var\u003e\n\nIf a node is rebooted before the rotation completes, the LUKS device can still be opened after boot. You can resume the steps after the node is back."]]
