Encryption tasks are possibly only in environments that include vCenter Server. In addition, the ESXi host must have encryption mode enabled for most encryption tasks. The user who performs the task must have the appropriate privileges. A set of Cryptographic Operations privileges allows fine-grained control. If virtual machine encryption tasks require a change to the host encryption mode, additional privileges are required.
Cryptography Privileges and Roles
- Add Cryptographic Operations privileges.
You can assign the No cryptography administrator role to vCenter Server administrators that do not need Cryptographic Operations privileges.
To impose more limits on what users can do, you can clone the No cryptography administrator role and create a custom role with only some of the Cryptographic Operations privileges. For example, you can create a role that allows users to encrypt but not to decrypt virtual machines. See Using Roles to Assign Privileges.
Host Encryption Mode
Host encryption mode determines if an ESXi host is ready to accept cryptographic material for encrypting virtual machines and virtual disks. Before any cryptographic operations can occur on a host, host encryption mode must be enabled. Host encryption mode is often enabled automatically when it is required, but you can enable it explicitly. You can check and explicitly set the current host encryption mode from the vSphere Client or by using the vSphere API.
When host encryption mode is enabled, vCenter Server installs a host key on the host, which ensures that the host is cryptographically "safe." With the host key in place, other cryptographic operations can proceed, including vCenter Server obtaining keys from the key provider and pushing them to the ESXi hosts.
In "safe" mode, user worlds (that is, hostd) and encrypted virtual machines have their core dumps encrypted. Unencrypted virtual machines do not have their core dumps encrypted.
For more information about encrypted core dumps and how they are used by VMware Technical Support, see the VMware knowledge base article at http://kb.vmware.com/kb/2147388.
For instructions, see Enable Host Encryption Mode Explicitly.
After Host encryption mode is enabled, it cannot be disabled easily. See Disable Host Encryption Mode Using the API.
Automatic changes occur when encryption operations attempt to enable host encryption mode. For example, assume that you add an encrypted virtual machine to a standalone host. Host encryption mode is not enabled. If you have the required privileges on the host, encryption mode changes to enabled automatically.
Assume that a cluster has three ESXi hosts, host A, B, and C. You create an encrypted virtual machine on host A. What happens depends on several factors.
- If hosts A, B, and C already have encryption enabled, you need only privileges to create the virtual machine.
- If hosts A and B are enabled for encryption and C is not enabled, the system proceeds as follows.
- Assume that you have both the
For this case, you can also explicitly enable host encryption on host C.
and the privileges on each host. In that case, the virtual machine creation process enables encryption on host C. The encryption process enables host encryption mode on host C, and pushes the key to each host in the cluster.
- Assume that you have only privileges on the virtual machine or virtual machine folder. In that case, virtual machine creation succeeds and the key becomes available on host A and host B. Host C remains disabled for encryption and does not have the virtual machine key.
- Assume that you have both the
- If none of the hosts has encryption enabled, and you have privileges on host A, then the virtual machine creation process enables host encryption on that host. Otherwise, an error results.
- You can also use the vSphere API to set the encryption mode of a cluster to "force enable." Force enable causes all hosts in the cluster to be cryptographically "safe," that is, vCenter Server has installed a host key on the host. See vSphere Web Services SDK Programming Guide.
Disk Space Requirements
When you encrypt an existing virtual machine, you need at least twice the space that the virtual machine is currently using.