Bootstrapping an encrypted single node VSAN cluster

1. A method, comprising:

receiving a request to create an encrypted virtual storage area network (VSAN) cluster from a single host in a software-defined datacenter;

deploying a virtual server on a VSAN datastore of the software-defined datacenter, wherein the VSAN datastore is encrypted with a native key provider (NKP);

registering the NKP in the virtual server;

creating an empty VSAN cluster encrypted by the NKP;

adding the single host to the encrypted empty cluster to create a one-host encrypted cluster;

registering a Key Management Interoperability Protocol-compliant Key Management Server (KMIP KMS) in the virtual server;

switching encryption of the one-host encrypted cluster from the NKP to the KMIP KMS; and

adding another host to the one-host encrypted cluster to create the encrypted cluster.

2. The method of claim 1 , wherein the method includes generating, by the virtual server, a random Key Derivation Key (KDK) and pushing the random KDK to the single host.

3. The method of claim 1 , wherein switching encryption of the one-host encrypted cluster from the NKP to the KMIP KMS includes performing a shallow rekey.

4. The method of claim 3 , wherein performing the shallow rekey includes:

generating a Key Encryption Key (KEK) by the KMIP KMS; and

replacing a previous KEK generated by the NKP with the KEK generated by the KMIP KMS.

5. The method of claim 1 , wherein the method includes leaving unchanged any Data Encryption Keys used to encrypt VSAN data.

6. The method of claim 1 , wherein the method includes receiving a user indication that identifies the KMIP KMS.

7. The method of claim 1 , wherein the NKP is provided by the software-defined datacenter and wherein the KMIP KMS is provided by an external source.

8. A non-transitory machine-readable medium having instructions stored thereon which, when executed by a processor, cause the processor to:

receive a request to create an encrypted virtual storage area network (VSAN) cluster from a single host in a software-defined datacenter;

deploy a virtual server on a VSAN datastore of the software-defined datacenter, wherein the VSAN datastore is encrypted with a native key provider (NKP);

register the NKP in the virtual server;

create an empty VSAN cluster encrypted by the NKP;

add the single host to the encrypted empty cluster to create a one-host encrypted cluster;

register a Key Management Interoperability Protocol-compliant Key Management Server (KMIP KMS) in the virtual server;

switch encryption of the one-host encrypted cluster from the NKP to the KMIP KMS; and

add another host to the one-host encrypted cluster to create the encrypted cluster.

9. The medium of claim 8 , including instructions to generate, by the virtual server, a random Key Derivation Key (KDK) and pushing the random KDK to the single host.

10. The medium of claim 8 , wherein the instructions to switch encryption of the one-host encrypted cluster from the NKP to the KMIP KMS include instructions to perform a shallow rekey.

11. The medium of claim 10 , wherein the instructions to perform the shallow rekey include instructions to:

generate a Key Encryption Key (KEK) by the KMIP KMS; and

replace a previous KEK generated by the NKP with the KEK generated by the KMIP KMS.

12. The medium of claim 8 , wherein including instructions to leave unchanged any Data Encryption Keys used to encrypt VSAN data.

13. The medium of claim 8 , including instructions to receive a user indication that identifies the KMIP KMS.

14. The medium of claim 8 , wherein the NKP is provided by the software-defined datacenter and wherein the KMIP KMS is provided by an external source.

15. A system, comprising:

a processor; and

a non-transitory computer readable medium having instructions stored thereon which, when executed by the processor, cause the processor to:

receive a request to create an encrypted virtual storage area network (VSAN) cluster from a single host in a software-defined datacenter;

deploy a virtual server on a VSAN datastore of the software-defined datacenter, wherein the VSAN datastore is encrypted with a native key provider (NKP);

register the NKP in the virtual server;

create an empty VSAN cluster encrypted by the NKP;

add the single host to the encrypted empty cluster to create a one-host encrypted cluster;

register a Key Management Interoperability Protocol-compliant Key Management Server (KMIP KMS) in the virtual server;

switch encryption of the one-host encrypted cluster from the NKP to the KMIP KMS; and

add another host to the one-host encrypted cluster to create the encrypted cluster.

16. The system of claim 15 , wherein the instructions further cause the processor to generate, by the virtual server, a random Key Derivation Key (KDK) and pushing the random KDK to the single host.

17. The system of claim 15 , wherein the instructions further cause the processor to perform a shallow rekey to switch encryption of the one-host encrypted cluster from the NKP to the KMIP KMS.

18. The system of claim 17 , wherein the instructions further cause the processor to:

generate a Key Encryption Key (KEK) by the KMIP KMS; and

replace a previous KEK generated by the NKP with the KEK generated by the KMIP KMS.

19. The system of claim 15 , wherein the system is configured to leave unchanged any Data Encryption Keys used to encrypt VSAN data.

20. The system of claim 15 , wherein the instructions further cause the processor to receive a user indication that identifies the KMIP KMS.