Previously we reviewed some important characteristics and tradeoffs for various encryption at rest solutions for VMware on IBM Cloud. Below are some more detailed decision matrices for encryption both in motion and at rest.
Encryption in motion
|Subject||Encryption layer||Encryption method||Notes|
|Application traffic||Network or lower||None||There are no established mesh encryption technologies for VXLAN or Geneve.|
|Transport||TLS||This is normally enabled in application specific configuration. Special care must be taken for many requirements, e.g., to exclude older TLS and SSL versions, exclude vulnerable ciphersuites, enforce the use of appropriate certificates, and use FIPS 140-2 if required.|
|vSAN||Application||None||VMware does not support encryption of host to host vSAN traffic currently.|
|vMotion||Application||Proprietary||This is enabled in a VM’s options, and can be set to disabled, opportunistic (default), or required.|
|Site to site||Network||VMware HCX (IPsec)||HCX uses a proprietary and highly efficient layer 2 transport to convey traffic from site to site through one or more IPsec tunnels using NIST Suite B AES-GCM encryption. Site to site vMotion is also supported with WAN optimization of the vMotion traffic.|
|IPsec||IPsec connections between sites can use a variety of solutions, including NSX ESG, FortiGate virtual or physical appliance, or vSRX appliance. Occasionally L2VPN may be used in combination with IPsec. Occasionally this may be combined with GRE encapsulation to alleviate addressing and routing problems.|
Encryption at rest
Note that in the table below:
- While IBM Cloud Object Storage (COS) cannot function as a VMware vSphere datastore, it may be used for other aspects of your VMware environment, such as Veeam backup repositories or data accessed directly by your applications. Compatibility statements for Cloud Object Storage are not applicable since it does not serve as disk storage for virtual machines.
- IBM Key Protect and IBM Hyper Protect Crypto Services are IBM Cloud key management service offerings. These interface directly with some IBM Cloud services like COS, and indirectly with VMware vSphere and vSAN encryption using the IBM Cloud KMIP for VMware intermediary service.
- IBM Security Key Lifecycle Manager (SKLM) and IBM Guardium Data Encryption are two key management and encryption software offerings from IBM.
- Compatibility statements imply “when properly configured.” For example, the HyTrust Key Control and Guardium KMS must be remain available or must be recovered in case of a disaster; and Veeam in some cases is limited to the HotAdd transport mode.
- HyTrust Key Control can be deployed as a standalone KMS, but it also serves as the underlying KMS for HyTrust Data Control. HyTrust Cloud Control offers advanced VM placement policy control and geofencing when combined with HyTrust Data Control.
|IBM Cloud Object Storage||IBM managed keys (native)||n/a||IBM||IBM||All objects||TLS||n/a||n/a||n/a||n/a||n/a||n/a||n/a|
|IBM Key Protect (KP) or Hyper Protect Crypto Services (HPCS)||IBM KP or HPCS||Customer||IBM||Bucket||TLS||n/a||n/a||n/a||n/a||n/a||n/a||n/a|
|IBM Cloud storage (Endurance, Performance) × (file, block)||IBM managed keys (native)||n/a||IBM||IBM||Entire volume||No||n/a||Yes||Yes||Yes||Yes||Yes||No|
|vSphere encryption||IBM KP or HPCS||Customer||IBM||VM disk||Yes||n/a||No||No||No||No||Yes||No|
|IBM SKLM||Customer||Customer||VM disk|
|HyTrust Key Control||Customer||Customer||VM disk||Yes||n/a||No||No||No||No||Yes||No|
|HyTrust Data Control||HyTrust Key Control||Customer||Customer||VM disk||Yes||n/a||Yes||Yes||Yes||Yes||Yes||Yes|
|IBM Guardium Data Encryption||Guardium||Customer||Customer||VM disk||Yes||n/a||Yes||Yes||Yes||Yes||Yes||No|
|vSAN storage||vSAN encryption||IBM KP or HPCS||Customer||IBM||vSAN drives||No||Yes||Yes||Yes||Yes||Yes||Yes||No|
|IBM SKLM||Customer||Customer||vSAN drives||No||Yes||Yes||Yes||Yes||Yes||Yes||No|
|HyTrust Key Control||Customer||Customer||vSAN drives||No||Yes||Yes||Yes||Yes||Yes||Yes||No|
|vSphere encryption||IBM KP or HPCS||Customer||IBM||VM disk||Yes||No||No||No||No||No||Yes||No|
|IBM SKLM||Customer||Customer||VM disk||Yes||No||No||No||No||No||Yes||No|
|HyTrust Key Control||Customer||Customer||VM disk||Yes||No||No||No||No||No||Yes||No|
|HyTrust Data Control||HyTrust Key Control||Customer||Customer||VM disk||Yes||No||Yes||Yes||Yes||Yes||Yes||Yes|
|IBM Guardium Data Encryption||Guardium||Customer||Customer||VM disk||Yes||No||Yes||Yes||Yes||Yes||Yes||No|
You should probably be using the tool that you hate the most. You hate it because you know the most about it.Dan McKinley
Crossposted to I gotta have my orange juice.
IBM Cloud for VMware Solutions recently released a set of public APIs. These APIs allow you to use your IBM Cloud API key to perform operations such as:
- Get information about your vCenter instance, admin credentials, deployment history, clusters, and hosts
- Verify parameters for ordering a new vCenter instance, cluster, or hosts
- Order or remove a vCenter instance, cluster, or hosts
I’ve written some sample code demonstrating how you can authenticate with the IBM Cloud APIs using your API key, and how to interact with the IBM Cloud for VMware APIs. Note that these samples only perform order verification, but you can easily extend them to perform actual orders or removals.
A key use case for these APIs is to expand and contract your VMware instance based on utilization or for workload bursting scenarios. With these APIs, you can now fully automate this process.
On Monday, March 25, IBM Cloud released the latest updates to our VMware Solutions offerings. The enhancements in this release include:
- As we announced at Think 2019, IBM Cloud now offers Caveonix RiskForesight as an add–on service for your VMware vCenter Server (VCS) instance. Caveonix RiskForesight helps you to manage compliance risks with proactive monitoring and automated defense controls to protect against threats and to meet industry and government regulations.
- You now have the option to deploy a VMware vCenter Server (VCS), hybridity bundle, or VMware vSphere Server (VSS) instance using VMware vSphere 6.7u1 and vCenter Server 6.7u1, in addition to version 6.5u2. Note that vSphere 6.7u1 is not available on all hardware combinations.
- You now have the option to deploy a VMware vCenter Server (VCS) or hybridity bundle instance using VMware NSX-T version 2.4, in addition to NSX-V version 6.4.4. We offer NSX-T at this time for proof of concept, test, and sandbox purposes to test drive this exciting new network technology from VMware.
- IBM Cloud has updated the versions of several add–on services available for VCS. F5 BIG–IP Virtual Edition is updated to V188.8.131.52; HyTrust Cloud Control is updated to V5.4.2; Zerto Virtual Replication is updated to V6.5 update 3; and Veeam Backup & Replication is updated to V9.5 update 4.
- The latest version of Veeam now supports IBM Cloud Object Storage as a storage tier, which enables much more cost effective long–term storage for your virtual machine backups.
- IBM Cloud for VMware Solutions now deploys new ESXi servers for your VCS instance with secure shell (SSH) disabled.
- You can now simultaneously add or remove ESXi servers from multiple clusters in a VCS instance.
- You now have the option to add new ESXi servers to their VCS clusters in maintenance mode. This allows you to perform custom configuration on these servers before any virtual machines run on that server.
- IBM Cloud for VMware Solutions now provides a REST API that you can use to deploy and delete VCS instances, clusters, and hosts.
- IBM Cloud increased the maximum size of Endurance file storage for a VCS instance from 12 TB to 24 TB. The larger sizes are available at performance levels of 0.25, 2, and 4 IOPS/GB.
- IBM Cloud’s KMIP for VMware key management service offering is now available in the Sydney multi–zone region (MZR).
- You can now display the VLANs and subnets allocated to your VCS instance on the instance’s Infrastructure view in the IBM Cloud portal.
Additionally, you should be aware of the following announcements:
- Beginning May 13, IBM Cloud will no longer support VMware Cloud Foundation (VCF). IBM Cloud is actively working with existing VCF customers on a transition or migration plan.
- Beginning in August, IBM Cloud for VMware Solutions will no longer support VLAN spanning. If you are using VLAN spanning, you should convert your account to Virtual Routing and Forwarding (VRF) by this time. Additionally, you will be required to enable Service Endpoints for your account by this time.
For details on all of these features and announcements, see the IBM Cloud for VMware Solutions release notes and related documentation.
Autocorrect of the day: Ansible → Zanzibar
IBM Cloud for VMware Solutions had a strong presence at the IBM Think 2019 conference in San Francisco last week, with many main stage announcements, think tank discussions, and breakout sessions.
See the IBM Cloud blog for the full list of our announcements: VMware on IBM Cloud at Think 2019.
There was particularly strong interest in our forthcoming offering of Caveonix RiskForesight on IBM Cloud. RiskForesight provides a set of powerful compliance monitoring, remediation, and reporting capabilities for both your cloud and on-premises workloads. We are very excited to be working with Caveonix!