Before you begin

Review the following information:

• KMIP for VMware design
• KMIP for VMware implementation and management

Migration options

IBM Cloud® key management offerings introduce native KMIP providers to replace the Key Management Interoperability Protocol (KMIP™) for VMware® service provider. These new native providers have the following advantages:

• Improved performance because the calls from KMIP to key provider are closer in network distance and no longer cross the service-to-service authorization boundaries.
• Improved visibility and management for the KMIP keys.

The native providers share common code and their behavior is similar. For more information, see Key Protect: Using the key management interoperability protocol (KMIP).

The support of native KMIP providers is not available for the Hyper Protect Crypto Services offering of IBM Cloud.

Migrating to the new KMIP provider

If you already use the KMIP for VMware provider, switch to the new key provider for improved performance:

1. Go to https://cloud.ibm.com/infrastructure/vmware-solutions/console/instances/kmip.

2. Select your existing KMIP for VMware instance and note the Key Manager instance name.

3. Go to https://cloud.ibm.com/resources, expand Security, and choose the Key Manager instance from step 2.

   To implement this step, your account needs certain privileges. Complete the following steps to check your account privilege:

   1. In the console, Manage > Access (IAM) > Users.
   2. Under Access policies, select your user ID, and then select the Access tab.
   3. Ensure that the service - Key Protect and Role - Administrator permissions are added.

4. Select KMIP adapters from the left navigation menu, and click Create KMIP adapter.

5. Optionally, type a name, and then select a root key.

   Adding certificate details here is optional as vCenter Server generates a new certificate for each key provider that you configure. The certificate is generated in step 11.

6. Select the Endpoints tab from left navigation menu to identify the KMIP endpoint you need to configure. Choose the Private endpoint with type as KMIP.

   Only one endpoint is available here unlike the KMIP for VMware offering in IBM Cloud for VMware Solutions. A single hostname balances the load and it is highly available in each region.

7. In vCenter Server, choose the vCenter object.

8. Select Configure > Key Providers, and then add a standard key provider.

9. Verify the details, and click Trust.

10. Select the new key provider, and then the single server in that provider.

11. In the Make KMS trust vCenter section, click Establish Trust. Use the vCenter Certificate option that generates a new certificate just for this connection.

12. Copy the certificate, and click Done.

    Before you copy the certificate, wait for the screen to refresh because the certificate details can vary if you copy too quickly.

13. Return to the KMIP adapters page, and view the details of your KMIP adapter.

14. Under Adapter details, select the SSL certificates tab. Click Add certificate, and paste the certificate that you copied from vCenter.

    The key provider health status might take several minutes to change in the vCenter Server.

$kp = Get-KeyProvider <new-kmip>

foreach($vm in Get-VM) {
  if($vm.ExtensionData.Config.KeyId) {
    Set-VM $vm -KeyProvider $kp -Confirm:$false
  }
}

$kp = Get-KeyProvider <new-kmip>

foreach($vmhost in Get-VMHost) {
  if($vmhost.ExtensionData.Runtime.CryptoState -eq "safe") {
    Set-VMHost $vmhost -KeyProvider $kp
  }
}

$vmlist = @()

foreach($vm in Get-VM) {
  $vmlist += [pscustomobject]@{ vm = $vm.name; provider = $vm.ExtensionData.Config.KeyId.ProviderId.Id}
}

$vmlist | Format-Table
$hostlist = @()

foreach($vmhost in Get-VMHost) {
  $vmhostview = Get-View $vmhost
  $hostlist += [pscustomobject]@{ host = $vmhost.name; provider = $vmhostview.Runtime.CryptoKeyId.ProviderId.Id}
}

$hostlist | Format-Table
$clusterlist = @()
$vsanclusterconfig = Get-VsanView -Id "VsanVcClusterConfigSystem-vsan-cluster-config-system"

foreach($cluster in Get-Cluster) {
  $encryption = $vsanclusterconfig.VsanClusterGetConfig($cluster.ExtensionData.MoRef).DataEncryptionConfig
  $clusterlist += [pscustomobject]@{ cluster = $cluster.name; provider = $encryption.KmsProviderId.Id }
}

$clusterlist | Format-Table

Related links

• End of Support for KMIP for VMware
• FAQ about KMIP for VMware migration
• IBM® Key Protect for IBM Cloud