You can enable encryption by editing the configuration parameters of an existing vSAN cluster.
You must have set up a KMS cluster and established a trusted connection between vCenter Server and the KMS.
The cluster's disk-claiming mode must be set to manual.
- Navigate to the vSAN host cluster in the vSphere Web Client.
- Click the Configure tab.
- Under vSAN, select General.
- In the vSAN is turned ON pane, click the Edit button.
- On the Edit vSAN settings dialog, check the Encryption check box, and select a KMS cluster.
- (Optional) If the storage devices in your cluster contain sensitive data, select the Erase disks before use check box.
This setting directs vSAN to wipe existing data from the storage devices as they are encrypted.
- Click OK.
A rolling reformat of all disk groups takes places as vSAN encrypts all data in the vSAN datastore.