One of biggest feature introduced in the upcoming vSAN 6.6 release is the native vSAN Data-at-Rest Encryption capability. My good friend Duncan Epping even posted a video recently demo'ing the feature and showing how easy it is to enable with just a couple of clicks. Just like VM Encryption which was introduced in vSphere 6.5, vSAN Encryption also requires a Key Management Interoperability Protocol (KMIP) Server which needs to be associated with your vCenter Server.

The really nice thing about this is that because both VM Encryption and vSAN Encryption uses the exact same encryption library, as long as you have a supported KMS (which you can find over on the VMware KMS HCL here, more are being certified and added), you can actually leverage the same KMS for both types of encryption across different vSphere Clusters with different requirements. For the ultra paranoid, you could even "double" encrypt by running Encrypted VMs on top of a vSAN Encrypted Datastore 😉

As with any feature that relies on 3rd party tools, it can take some time to acquire evaluational licenses. For those of you who would like to try out either vSAN or VM Encryption from a functional standpoint, you can quickly get started in under a few minutes by using the KMIP Docker Container that I had built last year. This is a great way to familiarize yourself with the workflow or even try out some of the new vSphere and vSAN APIs if you plan to automate the KMIP configuration or even deployment of encrypted VMs. Another great use case for this is doing live demos and all you need is just a couple of Nested ESXi VMs and a Docker Container Host like Photon OS or even just your laptop for example. Below are the instructions on how to get started.

Disclaimer: It is also very important to note that you should NOT be using this for any production workloads or any VMs that you care about. For actual production deployments of VM Encryption or vSAN Encryption, you should be leveraging a production grade KMIP Server as PyKMIP stores the encryption keys in memory and will be lost upon a restart. This will also be true even for the virtual appliance, so this is really for quick evaluational purposes, do NOT run anything important that you care about due to the risks mentioned earlier.

Step 1 - Setup the KMIP Docker Container and associate it with your vCenter Server. You can find the complete instructions here.

Step 2 - Enable vSAN Encryption by editing the vSAN Cluster configuration. You should see the KMS Cluster that you had configured from Step 1. If you only have a single existing diskgroup, you may need to select the "Allow Reduced Redundancy" as the existing diskgroup will be destroyed which may violate the existing availability policy.

At this point, you should see a new task kicked off to reformat the vSAN diskgroup and once that has completed, you have now successfully enabled vSAN Encryption! Pretty straight forward, right?

There is also a vSAN Health Check for vSAN Encryption which you can view by going to vSAN->Monitor->vSAN and under the "Encryption" check, it should show all green that your CPUs support the AES-NI instruction sets. You can also see that I have gone ahead and deployed a new VM which is now being secured by vSAN Encryption!