Cluster-Level Encryption: Hybrid Mode

The cluster-level encryption feature was originally intended to only support use cases where all volumes in the cluster are encrypted and there is no option to work in hybrid mode - where you can decide which volumes are encrypted and which are not.

As of v3.15.3 (LTS) and v3.18.2 (future LTS) - and any version above v3.19.1 - we will also support hybrid cluster-level encryption, where a cluster can have encrypted and unencrypted volumes. By default, once encryption is enabled, volumes created are encrypted but the user creating the volume can explicitly request in the API to create an un-encrypted volume.

One use case for this is when some volumes need to be encrypted and others do not. Another is when volumes need to be encrypted but use a golden image process, and the golden image needs to be un-encrypted but all cloned volumes created from the snapshot need to be encrypted.

As some clusters have to be always encrypted and other can be hybrid, only the cluster admin can decide whether to use hybrid mode. The UnencryptedVolumesAllowed configuration by default is disabled and the cluster admin can turn it on or off. Note that if the cluster admin enabled hybrid mode and some un-encrypted volumes/snapshots were created, they can then disable the hybrid mode but the existing un-encrypted volumes will remain un-encrypted and the configuration change will only impact newly created volumes. You cannot created an un-encrypted volume if the UnencryptedVolumesAllowed configuration is false.

See lbcli create volume for more on creating un-encrypted volumes.

Note that:

• Encrypted volumes and their derivative snapshots or clones of these snapshots will always remain encrypted.

• Un-encrypted volumes and their snapshots will always remain un-encrypted, but once you create an encrypted clone from an un-encrypted snapshot, all new data written to the volume will be encrypted.

• You cannot create an un-encrypted volume from an encrypted snapshot.

Enabling/Disabling the Encryption Hybrid Mode

CLI to Enable UnencryptedVolumesAllowed:

CLI to Disable UnencryptedVolumesAllowed: